[Emerging-Sigs] Binary Packer Signatures

Josh Smith famousjs at gmail.com
Wed Jan 21 17:08:17 EST 2009


I've been working (when I can get the chance from school) in my spare
time on converting the PEiD packer database straight to snort
signatures.  I've refined them to specific byte patterns, but when I
tested a pcap of a transferred binary packed with UPX, about 10
signatures fired off.  There are a little over 1800 signatures that I
have converted, but I feel they still need refining to reduce false
positives.  Attached is the snort signature database I have made,
along with my PEiD database.

-Josh Smith
-------------- next part --------------
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[!EP (ExE Pack) V1.0 -> Elite Coding Group] binary file"; flow:established,to_server; content: "|6068|";content: "|B8|"; distance: 4; within: 1;content: "|FF10|"; distance: 3; within: 2;sid: 20091; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[!EPack 1.4 lite (final) - by 6aHguT] binary file"; flow:established,to_server; content: "|33C08BC068|";content: "|68|"; distance: 7; within: 1;content: "|E8|"; distance: 3; within: 1;sid: 20092; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[$pirit v1.5] binary file"; flow:established,to_server; content: "|5B24555044FB322E315D|";sid: 20093; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[$PIRIT v1.5] binary file"; flow:established,to_server; content: "|B44DCD21E8|";content: "|FDE8|"; distance: 6; within: 2;content: "|B451CD21|"; distance: 3; within: 4;sid: 20094; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 --> Anorganix] binary file"; flow:established,to_server; content: "|9090909068|";content: "|6764FF360000676489260000F190909090|"; distance: 7; within: 17;sid: 20095; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [32Lite 0.03] --> Anorganix] binary file"; flow:established,to_server; content: "|6006FC1E07BE909090906A04689010909068|";content: "|E9|"; distance: 20; within: 1;sid: 20096; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [ACProtect 1.09] --> Anorganix] binary file"; flow:established,to_server; content: "|6090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090EB02000090909004909090909090909090909090909090909090909090|";sid: 20097; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [Armadillo 3.00] --> Anorganix] binary file"; flow:established,to_server; content: "|60E82A0000005D5051EB0FB9EB0FB8EB07B9EB0F90EB08FDEB0BF2EBF5EBF6F2EB08FDEBE9F3EBE4FCE959585051EB85E9|";sid: 20098; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [ASPack 2.xx Heuristic] --> Anorganix] binary file"; flow:established,to_server; content: "|9090909068|";content: "|6764FF360000676489260000F190909090A8030000617508B801000000C20C006800000000C38B85260400008D8D3B0400005150FF95|"; distance: 7; within: 54;sid: 20099; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [ASProtect] --> Anorganix] binary file"; flow:established,to_server; content: "|609090909090905D909090909090909090909003DDE9|";sid: 200910; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [Borland Delphi 3.0] --> Anorganix] binary file"; flow:established,to_server; content: "|558BEC83C49090909068|";content: "|9090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090|"; distance: 12; within: 71;sid: 200911; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [Borland Delphi 5.0 KOL/MCK] --> Anorganix] binary file"; flow:established,to_server; content: "|558BEC9090909068|";content: "|9090909090909090909090909090909090909090909090909090909000FF90909090909090900001909090909090909090EB0400000001909090909090900001909090909090909090|"; distance: 10; within: 73;sid: 200912; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [Borland Delphi 6.0 - 7.0] --> Anorganix] binary file"; flow:established,to_server; content: "|9090909068|";content: "|6764FF360000676489260000F190909090538BD833C0A3090909006A00E8090900FFA309090900A109090900A30909090033C0A30909090033C0A309090900E8|"; distance: 7; within: 64;sid: 200913; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [CD-Cops II] --> Anorganix] binary file"; flow:established,to_server; content: "|5360BD909090908D45908D5D90E8000000008D01E9|";sid: 200914; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [Code-Lock] --> Anorganix] binary file"; flow:established,to_server; content: "|434F44452D4C4F434B2E4F435800012801504B47054C3FB4044D4C474BE9|";sid: 200915; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [CodeSafe 2.0] --> Anorganix] binary file"; flow:established,to_server; content: "|90909090909090909090909090909090909090909090EB0B83EC10535657E8C4010085E9|";sid: 200916; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [Crunch/PE Heuristic] --> Anorganix] binary file"; flow:established,to_server; content: "|55E80E0000005D83ED068BC5556089AD|";content: "|2B8500000000E9|"; distance: 18; within: 7;sid: 200917; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [DEF 1.0] --> Anorganix] binary file"; flow:established,to_server; content: "|BE000140006A0559807E070074118B46909090909090909090909090909090909083C101E9|";sid: 200918; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [DxPack 1.0] --> Anorganix] binary file"; flow:established,to_server; content: "|60E8000000005D8BFD81ED909090902BB90000000081EF9090909083BD90909090900F8400000000E9|";sid: 200919; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [ExeSmasher] --> Anorganix] binary file"; flow:established,to_server; content: "|9CFE039060BE909041908DBE9010FFFF5783CDFFEB1090909090909090909090909090909090FE0BE9|";sid: 200920; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [FSG 1.0] --> Anorganix] binary file"; flow:established,to_server; content: "|9090909068|";content: "|6764FF360000676489260000F190909090BBD0014000BF00104000BE9090909053E80A00000002D275058A164612D2C3FCB280A46A025BE9|"; distance: 7; within: 56;sid: 200921; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [FSG 1.31] --> Anorganix] binary file"; flow:established,to_server; content: "|BE90909000BF90909000BB9090900053BB90909000B280E9|";sid: 200922; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [Gleam 1.00] --> Anorganix] binary file"; flow:established,to_server; content: "|90909090909090909090909090909090909090909090EB0B83EC0C535657E8240200FFE9|";sid: 200923; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [JDPack 1.x / JDProtect 0.9] --> Anorganix] binary file"; flow:established,to_server; content: "|60E8220000005D8BD581ED909090902B959090909081EA0690909089959090909083BD4500010001E9|";sid: 200924; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [LCC Win32 1.x] --> Anorganix] binary file"; flow:established,to_server; content: "|64A1010000005589E56AFF68|";content: "|689A10409050E9|"; distance: 14; within: 7;sid: 200925; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [LCC Win32 DLL] --> Anorganix] binary file"; flow:established,to_server; content: "|5589E5535657837D0C017505E817909090FF7510FF750CFF7508A1|";content: "|E9|"; distance: 29; within: 1;sid: 200926; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [Lockless Intro Pack] --> Anorganix] binary file"; flow:established,to_server; content: "|2CE8EB1A90905D8BC581EDF67390902B859090909083E8068985FF01ECADE9|";sid: 200927; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [LTC 1.3] --> Anorganix] binary file"; flow:established,to_server; content: "|54E8000000005D8BC581EDF67340002B858775400083E806E9|";sid: 200928; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [Macromedia Flash Projector 6.0] --> Anorganix] binary file"; flow:established,to_server; content: "|9090909068|";content: "|6764FF360000676489260000F19090909083EC4456FF15248149008BF08A063C22751C8A4601463C22740C84C074088A4601463C2275F4803E22750F46EB0CE9|"; distance: 7; within: 64;sid: 200929; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [MEW 11 SE 1.0] --> Anorganix] binary file"; flow:established,to_server; content: "|E909000000000000020000000C90E9|";sid: 200930; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [Microsoft Visual Basic 5.0 - 6.0] --> Anorganix] binary file"; flow:established,to_server; content: "|68|";content: "|E80A00000000000000000030000000E9|"; distance: 3; within: 16;sid: 200931; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [Microsoft Visual Basic 6.0 DLL] --> Anorganix] binary file"; flow:established,to_server; content: "|9090909068|";content: "|6764FF360000676489260000F1909090905A6890909090689090909052E99090FF|"; distance: 7; within: 33;sid: 200932; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [Microsoft Visual C++ 5.0+ (MFC)] --> Anorganix] binary file"; flow:established,to_server; content: "|558BEC6AFF68|";content: "|68|"; distance: 8; within: 1;content: "|64A10000000050E9|"; distance: 3; within: 8;sid: 200933; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [Microsoft Visual C++ 6.0 (Debug Version)] --> Anorganix] binary file"; flow:established,to_server; content: "|558BEC5190909001019090909068|";content: "|90909090909090909090909000019090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909000019090909090|"; distance: 16; within: 67;sid: 200934; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [Microsoft Visual C++ 6.20] --> Anorganix] binary file"; flow:established,to_server; content: "|9090909068|";content: "|6764FF360000676489260000F190909090558BEC83EC50535657BE909090908D7DF4A5A566A58B|"; distance: 7; within: 39;sid: 200935; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [Microsoft Visual C++ 7.0 DLL] --> Anorganix] binary file"; flow:established,to_server; content: "|558D6C010081EC000000008B459083F801560F840000000085C00F84|";content: "|E9|"; distance: 30; within: 1;sid: 200936; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [MinGW GCC 2.x] --> Anorganix] binary file"; flow:established,to_server; content: "|5589E5E802000000C9C39090455845E9|";sid: 200937; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [Morphine 1.2] --> Anorganix] binary file"; flow:established,to_server; content: "|90909090909090909090909090909090EB06009090909090909090EB08E890000000669090909090909090909090909090909090909090909090909090909090516690909059909090909090909090909090909090|";sid: 200938; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [Neolite 2.0] --> Anorganix] binary file"; flow:established,to_server; content: "|E9A60000009090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090|";sid: 200939; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [NorthStar PE Shrinker 1.3] --> Anorganix] binary file"; flow:established,to_server; content: "|9C60E8000000005DB8B38540002DAC8540002BE88DB500000000E9|";sid: 200940; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [Pack Master 1.0 (PEX Clone)] --> Anorganix] binary file"; flow:established,to_server; content: "|60E801010000E883C404E801909090E95D81EDD3224090E804029090E8EB08EB02CD20FF24249A66BE4746909090909090909090909090909090909090909090909090909090909090909090909090909090909090|";sid: 200941; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [PE Intro 1.0] --> Anorganix] binary file"; flow:established,to_server; content: "|8B04249C60E8140000005D81ED0A45409080BD67444090900F8548FFED0AE9|";sid: 200942; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [PE Pack 0.99] --> Anorganix] binary file"; flow:established,to_server; content: "|60E8110000005D83ED0680BDE0049090010F84F2FFCC0AE9|";sid: 200943; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [PE Protect 0.9] --> Anorganix] binary file"; flow:established,to_server; content: "|525155576467A1300085C0780DE8070000005883C007C690C3E9|";sid: 200944; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [PECompact 1.4+] --> Anorganix] binary file"; flow:established,to_server; content: "|9090909068|";content: "|6764FF360000676489260000F190909090EB066890909090C39C60E80290909033C08BC483C004938BE38B5BFC81|"; distance: 7; within: 46;sid: 200945; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [PENightMare 2 Beta] --> Anorganix] binary file"; flow:established,to_server; content: "|60E910000000EF4003A7078F071C375D43A704B92C3AE9|";sid: 200946; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [PENinja 1.31] --> Anorganix] binary file"; flow:established,to_server; content: "|909090909090909090909090909090909090909090909090909090909090909090909090E9|";sid: 200947; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [PESHiELD 0.25] --> Anorganix] binary file"; flow:established,to_server; content: "|60E82B0000009090909090909090909090909090909090909090909090909090909090909090909090909090909090CCCCE9|";sid: 200948; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [PEtite 2.x (level 0)] --> Anorganix] binary file"; flow:established,to_server; content: "|9090909068|";content: "|6764FF360000676489260000F190909090B8009090006A00689090900064FF350000000064892500000000669C60508BD8030068|"; distance: 7; within: 52;sid: 200949; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [PEX 0.99] --> Anorganix] binary file"; flow:established,to_server; content: "|60E8010000005583C404E801000000905D81FFFFFF0001E9|";sid: 200950; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [REALBasic] --> Anorganix] binary file"; flow:established,to_server; content: "|5589E5909090909090909090905090909090900001E9|";sid: 200951; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [Ste at lth PE 1.01] --> Anorganix] binary file"; flow:established,to_server; content: "|0BC00BC00BC00BC00BC00BC00BC00BC0BA|";content: "|FFE2BAE0104000B868241A40890283C203B84000E8EE890283C2FDFFE22D3D5B20486964655045205D3D2D90000000|"; distance: 19; within: 47;sid: 200952; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [UPX 0.6] --> Anorganix] binary file"; flow:established,to_server; content: "|60E8000000005883E83D508DB8000000FF578DB0E8000000E9|";sid: 200953; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [VBOX 4.3 MTE] --> Anorganix] binary file"; flow:established,to_server; content: "|0BC00BC00BC00BC00BC00BC00BC00BC0E9|";sid: 200954; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [Video-Lan-Client] --> Anorganix] binary file"; flow:established,to_server; content: "|5589E583EC08909090909090909090909090909001FFFF0101010001909090909090909090909090909000010001000190900001E9|";sid: 200955; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [VOB ProtectCD 5] --> Anorganix] binary file"; flow:established,to_server; content: "|363E268AC060E800000000E9|";sid: 200956; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [WATCOM C/C++ EXE] --> Anorganix] binary file"; flow:established,to_server; content: "|E900000000909090905741E9|";sid: 200957; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [XCR 0.11] --> Anorganix] binary file"; flow:established,to_server; content: "|608BF033DB83C30183C001E9|";sid: 200958; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.1 [Yoda's Protector 1.02] --> Anorganix] binary file"; flow:established,to_server; content: "|E803000000EB019090E9|";sid: 200959; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [.BJFNT 1.1b] --> Anorganix] binary file"; flow:established,to_server; content: "|EB01EA9CEB01EA53EB01EA51EB01EA52EB01EA5690|";sid: 200960; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [.BJFNT 1.2] --> Anorganix] binary file"; flow:established,to_server; content: "|EB0269B183EC04EB03CD20EBEB01EB9CEB01EBEB00|";sid: 200961; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [32Lite 0.03] --> Anorganix] binary file"; flow:established,to_server; content: "|6006FC1E07BE909090906A04689010909068|";sid: 200962; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [Armadillo 3.00] --> Anorganix] binary file"; flow:established,to_server; content: "|60E82A0000005D5051EB0FB9EB0FB8EB07B9EB0F90EB08FDEB0BF2EBF5EBF6F2EB08FDEBE9F3EBE4FCE959585051EB85|";sid: 200963; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [ASProtect] --> Anorganix] binary file"; flow:established,to_server; content: "|609090909090905D909090909090909090909003DD|";sid: 200964; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [Borland C++ 1999] --> Anorganix] binary file"; flow:established,to_server; content: "|EB1066623A432B2B484F4F4B90E990909090A1|";content: "|A3|"; distance: 21; within: 1;sid: 200965; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [Borland C++ DLL (Method 2)] --> Anorganix] binary file"; flow:established,to_server; content: "|EB1066623A432B2B484F4F4B90E990909090|";sid: 200966; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [Borland Delphi DLL] --> Anorganix] binary file"; flow:established,to_server; content: "|558BEC83C4B4B890909090E800000000E8000000008D4000|";sid: 200967; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [Borland Delphi Setup Module] --> Anorganix] binary file"; flow:established,to_server; content: "|558BEC83C49053565733C08945F08945D48945D0E800000000|";sid: 200968; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [CD-Cops II] --> Anorganix] binary file"; flow:established,to_server; content: "|5360BD909090908D45908D5D90E8000000008D01|";sid: 200969; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [Code-Lock] --> Anorganix] binary file"; flow:established,to_server; content: "|434F44452D4C4F434B2E4F435800012801504B47054C3FB4044D4C474B|";sid: 200970; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [CodeSafe 2.0] --> Anorganix] binary file"; flow:established,to_server; content: "|90909090909090909090909090909090909090909090EB0B83EC10535657E8C4010085|";sid: 200971; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [Crunch/PE Heuristic] --> Anorganix] binary file"; flow:established,to_server; content: "|55E80E0000005D83ED068BC5556089AD|";content: "|2B8500000000|"; distance: 18; within: 6;sid: 200972; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [DEF 1.0] --> Anorganix] binary file"; flow:established,to_server; content: "|BE000140006A0559807E070074118B46909090909090909090909090909090909083C101|";sid: 200973; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [DxPack 1.0] --> Anorganix] binary file"; flow:established,to_server; content: "|60E8000000005D8BFD81ED909090902BB90000000081EF9090909083BD90909090900F8400000000|";sid: 200974; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [ExeSmasher] --> Anorganix] binary file"; flow:established,to_server; content: "|9CFE039060BE909041908DBE9010FFFF5783CDFFEB1090909090909090909090909090909090FE0B|";sid: 200975; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [FSG 1.0] --> Anorganix] binary file"; flow:established,to_server; content: "|9090909068|";content: "|6764FF360000676489260000F190909090BBD0014000BF00104000BE9090909053E80A00000002D275058A164612D2C3FCB280A46A025B|"; distance: 7; within: 55;sid: 200976; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [FSG 1.31] --> Anorganix] binary file"; flow:established,to_server; content: "|BE90909000BF90909000BB9090900053BB90909000B280|";sid: 200977; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [Gleam 1.00] --> Anorganix] binary file"; flow:established,to_server; content: "|90909090909090909090909090909090909090909090EB0B83EC0C535657E8240200FF|";sid: 200978; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [JDPack 1.x / JDProtect 0.9] --> Anorganix] binary file"; flow:established,to_server; content: "|60E8220000005D8BD581ED909090902B959090909081EA0690909089959090909083BD4500010001|";sid: 200979; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [LCC Win32 1.x] --> Anorganix] binary file"; flow:established,to_server; content: "|64A1010000005589E56AFF68|";content: "|689A10409050|"; distance: 14; within: 6;sid: 200980; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [LCC Win32 DLL] --> Anorganix] binary file"; flow:established,to_server; content: "|5589E5535657837D0C017505E817909090FF7510FF750CFF7508A1|";sid: 200981; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [Lockless Intro Pack] --> Anorganix] binary file"; flow:established,to_server; content: "|2CE8EB1A90905D8BC581EDF67390902B859090909083E8068985FF01ECAD|";sid: 200982; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [Macromedia Flash Projector 6.0] --> Anorganix] binary file"; flow:established,to_server; content: "|9090909068|";content: "|6764FF360000676489260000F19090909083EC4456FF15248149008BF08A063C22751C8A4601463C22740C84C074088A4601463C2275F4803E22750F46EB0C|"; distance: 7; within: 63;sid: 200983; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [MEW 11 SE 1.0] --> Anorganix] binary file"; flow:established,to_server; content: "|E909000000000000020000000C90|";sid: 200984; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [Microsoft Visual Basic 5.0 - 6.0] --> Anorganix] binary file"; flow:established,to_server; content: "|68|";content: "|E80A00000000000000000030000000|"; distance: 3; within: 15;sid: 200985; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [Microsoft Visual C++ 7.0 DLL] --> Anorganix] binary file"; flow:established,to_server; content: "|558D6C010081EC000000008B459083F801560F840000000085C00F84|";sid: 200986; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [MinGW GCC 2.x] --> Anorganix] binary file"; flow:established,to_server; content: "|5589E5E802000000C9C39090455845|";sid: 200987; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [NorthStar PE Shrinker 1.3] --> Anorganix] binary file"; flow:established,to_server; content: "|9C60E8000000005DB8B38540002DAC8540002BE88DB500000000|";sid: 200988; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [PE Intro 1.0] --> Anorganix] binary file"; flow:established,to_server; content: "|8B04249C60E8140000005D81ED0A45409080BD67444090900F8548FFED0A|";sid: 200989; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [PE Pack 0.99] --> Anorganix] binary file"; flow:established,to_server; content: "|60E8110000005D83ED0680BDE0049090010F84F2FFCC0A|";sid: 200990; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [PE Protect 0.9] --> Anorganix] binary file"; flow:established,to_server; content: "|525155576467A1300085C0780DE8070000005883C007C690C3|";sid: 200991; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [PENightMare 2 Beta] --> Anorganix] binary file"; flow:established,to_server; content: "|60E910000000EF4003A7078F071C375D43A704B92C3A|";sid: 200992; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [PESHiELD 0.25] --> Anorganix] binary file"; flow:established,to_server; content: "|60E82B0000009090909090909090909090909090909090909090909090909090909090909090909090909090909090CCCC|";sid: 200993; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [PEX 0.99] --> Anorganix] binary file"; flow:established,to_server; content: "|60E8010000005583C404E801000000905D81FFFFFF0001|";sid: 200994; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [REALBasic] --> Anorganix] binary file"; flow:established,to_server; content: "|5589E5909090909090909090905090909090900001|";sid: 200995; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [UPX 0.6] --> Anorganix] binary file"; flow:established,to_server; content: "|60E8000000005883E83D508DB8000000FF578DB0E8000000|";sid: 200996; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [VBOX 4.3 MTE] --> Anorganix] binary file"; flow:established,to_server; content: "|0BC00BC00BC00BC00BC00BC00BC00BC0|";sid: 200997; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [Video-Lan-Client] --> Anorganix] binary file"; flow:established,to_server; content: "|5589E583EC08909090909090909090909090909001FFFF0101010001909090909090909090909090909000010001000190900001|";sid: 200998; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [VOB ProtectCD 5] --> Anorganix] binary file"; flow:established,to_server; content: "|363E268AC060E800000000|";sid: 200999; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [Watcom C/C++ DLL] --> Anorganix] binary file"; flow:established,to_server; content: "|535657558B7424148B7C24188B6C241C83FF030F8701000000F1|";sid: 2009100; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [WATCOM C/C++ EXE] --> Anorganix] binary file"; flow:established,to_server; content: "|E900000000909090905741|";sid: 2009101; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [XCR 0.11] --> Anorganix] binary file"; flow:established,to_server; content: "|608BF033DB83C30183C001|";sid: 2009102; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [Yoda's Protector 1.02] --> Anorganix] binary file"; flow:established,to_server; content: "|E803000000EB019090|";sid: 2009103; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* PseudoSigner 0.2 [ZCode 1.01] --> Anorganix] binary file"; flow:established,to_server; content: "|E912000000000000000000000000000000E9FBFFFFFFC3680000000064FF3500000000|";sid: 2009104; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[* [MSLRH] V0.31 -> emadicius] binary file"; flow:established,to_server; content: "|60D1CB0FCAC1CAE0D1CA0FC8EB01F1|";sid: 2009105; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[*** Protector v1.1.11 (DDeM->PE Engine v0.9, DDeM->CI v0.9.2)] binary file"; flow:established,to_server; content: "|535156E8000000005B81EB081000008DB334100000B9F3030000BA63172AEE311683C604|";sid: 2009106; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[.BJFnt v1.1b] binary file"; flow:established,to_server; content: "|EB01EA9CEB01EA53EB01EA51EB01EA52EB01EA56|";sid: 2009107; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[.BJFnt v1.2 RC] binary file"; flow:established,to_server; content: "|EB0269B183EC04EB03CD20EBEB01EB9CEB01EBEB|";sid: 2009108; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[.BJFnt v1.3] binary file"; flow:established,to_server; content: "|EB|";content: "|3A|"; distance: 1; within: 1;content: "|1EEB|"; distance: 2; within: 2;content: "|CD209CEB|"; distance: 2; within: 4;content: "|CD20EB|"; distance: 4; within: 3;content: "|CD2060EB|"; distance: 3; within: 4;sid: 2009109; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[32Lite v0.03a] binary file"; flow:established,to_server; content: "|6006FC1E07BE|";content: "|6A0468|"; distance: 8; within: 3;content: "|10|"; distance: 3; within: 1;content: "|68|"; distance: 2; within: 1;sid: 2009110; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[624 (Six to Four) v1.0] binary file"; flow:established,to_server; content: "|50554C5083|";content: "|FCBF|"; distance: 6; within: 2;content: "|BE|"; distance: 3; within: 1;content: "|B5|"; distance: 2; within: 1;content: "|57F3A5C333ED|"; distance: 1; within: 6;sid: 2009111; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AcidCrypt] binary file"; flow:established,to_server; content: "|60B9|";content: "|00BA|"; distance: 3; within: 2;content: "|00BE|"; distance: 3; within: 2;content: "|000238404E75FA8BC28A1832DFC0CB|"; distance: 3; within: 15;sid: 2009112; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AcidCrypt] binary file"; flow:established,to_server; content: "|BE|";content: "|0238404E75FA8BC28A1832DFC0CB|"; distance: 3; within: 14;sid: 2009113; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ACProtect 1.09g -> Risco software Inc.] binary file"; flow:established,to_server; content: "|60F950E8010000007C58584950E8010000007E5858790466B9B872E8010000007A83C40485C8EB01EBC1F8BE72037301740F8101000000F9EB0175F9E8010000|";sid: 2009114; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ACProtect V1.3X -> risco] binary file"; flow:established,to_server; content: "|6050E8010000007583|";sid: 2009115; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ACProtect v1.41] binary file"; flow:established,to_server; content: "|60760377017B74037501784787EEE8010000007683C40485EEEB017F85F2EB01790F8601000000FCEB0178790287F261518F051938010160EB01E9E901000000|";sid: 2009116; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ACProtect V1.4X -> risco] binary file"; flow:established,to_server; content: "|60E8010000007C83042406C3|";sid: 2009117; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ACProtect v1.90g -> Risco software Inc.] binary file"; flow:established,to_server; content: "|600F87020000001BF8E8010000007383042406C3|";sid: 2009118; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ACProtect V2.0 -> risco] binary file"; flow:established,to_server; content: "|68|";content: "|68|"; distance: 3; within: 1;content: "|C3C3|"; distance: 3; within: 2;sid: 2009119; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ActiveMARK[TM] R5.31.1140 -> Trymedia] binary file"; flow:established,to_server; content: "|79117FAB9A4A83B5C96B1A48F927B425|";sid: 2009120; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AdFlt2] binary file"; flow:established,to_server; content: "|6800019C0FA00FA860FD6A000FA1BE|";content: "|AD|"; distance: 16; within: 1;sid: 2009121; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Ady's Glue 1.10] binary file"; flow:established,to_server; content: "|2E|";content: "|0E1FBF|"; distance: 3; within: 3;content: "|33DB33C0AC|"; distance: 4; within: 5;sid: 2009122; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Ady`s Glue v0.10] binary file"; flow:established,to_server; content: "|2E8C06|";content: "|0E0733C08ED8BE|"; distance: 4; within: 7;content: "|BF|"; distance: 8; within: 1;content: "|FCB9|"; distance: 2; within: 2;content: "|56F3A51E075F|"; distance: 3; within: 6;sid: 2009123; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AHPack 0.1 -> FEUERRADER] binary file"; flow:established,to_server; content: "|606854|";content: "|00B848|"; distance: 4; within: 3;content: "|00FF1068B3|"; distance: 4; within: 5;content: "|0050B844|"; distance: 6; within: 4;content: "|00FF106800|"; distance: 5; within: 5;sid: 2009124; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AHpack 0.1 -> FEUERRADER] binary file"; flow:established,to_server; content: "|606854|";content: "|B848|"; distance: 4; within: 2;content: "|FF1068B3|"; distance: 3; within: 4;content: "|50B844|"; distance: 5; within: 3;content: "|FF106800|"; distance: 4; within: 4;content: "|6A40FFD08905CA|"; distance: 5; within: 7;content: "|89C7BE0010|"; distance: 8; within: 5;content: "|60FCB28031DBA4B302E86D00000073F631C9E864000000731C31C0E85B0000007323B30241|"; distance: 6; within: 37;sid: 2009125; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AHTeam EP Protector 0.3 (fake ASPack 2.12) -> FEUERRADER] binary file"; flow:established,to_server; content: "|90|";content: "|90FFE060E803000000E9EB045D4555C3E801000000EB5DBBEDFFFFFF03DD81EB|"; distance: 24; within: 32;sid: 2009126; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AHTeam EP Protector 0.3 (fake ASProtect 1.0) -> FEUERRADER] binary file"; flow:established,to_server; content: "|90|";content: "|90FFE060E801000000905D81ED00000000BB0000000003DD2B9D|"; distance: 24; within: 26;sid: 2009127; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AHTeam EP Protector 0.3 (fake Borland Delphi 6.0-7.0) -> FEUERRADER] binary file"; flow:established,to_server; content: "|90|";content: "|90FFE0538BD833C0A3000000006A00E8000000FFA300000000A100000000A30000000033C0A30000000033C0A300000000E8|"; distance: 24; within: 50;sid: 2009128; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AHTeam EP Protector 0.3 (fake k.kryptor 9/kryptor a) -> FEUERRADER] binary file"; flow:established,to_server; content: "|90|";content: "|90FFE060E8|"; distance: 24; within: 5;content: "|5EB9000000002BC002040ED3C04979F8418D7E2C3346|"; distance: 7; within: 22;content: "|66B9|"; distance: 22; within: 2;sid: 2009129; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AHTeam EP Protector 0.3 (fake Microsoft Visual C++ 7.0) -> FEUERRADER] binary file"; flow:established,to_server; content: "|90|";content: "|90FFE06A0068|"; distance: 24; within: 6;content: "|E8|"; distance: 8; within: 1;content: "|BF|"; distance: 3; within: 1;content: "|8BC7E8|"; distance: 3; within: 3;content: "|8965008BF4893E56FF15|"; distance: 5; within: 10;content: "|8B4E|"; distance: 12; within: 2;content: "|890D|"; distance: 2; within: 2;content: "|008B4600A3|"; distance: 3; within: 5;sid: 2009130; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AHTeam EP Protector 0.3 (fake PCGuard 4.03-4.15) -> FEUERRADER] binary file"; flow:established,to_server; content: "|90|";content: "|90FFE0FC5550E8000000005DEB01E360E803000000D2EB0B58EB014840EB01|"; distance: 24; within: 31;sid: 2009131; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AHTeam EP Protector 0.3 (fake PE Lock NT 2.04) -> FEUERRADER] binary file"; flow:established,to_server; content: "|90|";content: "|90FFE0EB03CD20C71EEB03CD20EA9CEB02EB01EB01EB60EB03CD20EBEB01EB|"; distance: 24; within: 31;sid: 2009132; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AHTeam EP Protector 0.3 (fake PE-Crypt 1.02) -> FEUERRADER] binary file"; flow:established,to_server; content: "|90|";content: "|90FFE0E8000000005B83EB05EB04524E44|"; distance: 24; within: 17;sid: 2009133; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AHTeam EP Protector 0.3 (fake PESHiELD 2.x) -> FEUERRADER] binary file"; flow:established,to_server; content: "|90|";content: "|90FFE060E800000000414E414B494E5D83ED06EB02EA04|"; distance: 24; within: 23;sid: 2009134; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AHTeam EP Protector 0.3 (fake PEtite 2.2) -> FEUERRADER] binary file"; flow:established,to_server; content: "|90|";content: "|90FFE0B800000000680000000064FF350000000064892500000000669C6050|"; distance: 24; within: 31;sid: 2009135; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AHTeam EP Protector 0.3 (fake Spalsher 1.x-3.x) -> FEUERRADER] binary file"; flow:established,to_server; content: "|90|";content: "|90FFE09C608B442424E8000000005D81ED0000000050E8ED0200008CC00F84|"; distance: 24; within: 31;sid: 2009136; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AHTeam EP Protector 0.3 (fake Stone's PE Encryptor 2.0) -> FEUERRADER] binary file"; flow:established,to_server; content: "|90|";content: "|90FFE0535152565755E8000000005D81ED42304000FF9532354000B83730400003C52B851B34400089852734400083|"; distance: 24; within: 47;sid: 2009137; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AHTeam EP Protector 0.3 (fake SVKP 1.3x) -> FEUERRADER] binary file"; flow:established,to_server; content: "|90|";content: "|90FFE060E8000000005D81ED06000000EB05B80000000064A023000000EB03C784E884C0EB03C784E97567B9490000008DB5C50200005680064446E2FA8B8DC10200005E55516A00|"; distance: 24; within: 72;sid: 2009138; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AHTeam EP Protector 0.3 (fake tElock 0.61) -> FEUERRADER] binary file"; flow:established,to_server; content: "|90|";content: "|90FFE0E90000000060E8000000005883C008F3EBFFE083C02850E8000000005EB3338D460E8D76312818F87300C38BFEB93C02|"; distance: 24; within: 51;sid: 2009139; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AHTeam EP Protector 0.3 (fake VIRUS/I-Worm Hybris) -> FEUERRADER] binary file"; flow:established,to_server; content: "|90|";content: "|90FFE0EB16A85400004741424C4B43474300000000000052495300FC684C704000FF15|"; distance: 24; within: 35;sid: 2009140; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AHTeam EP Protector 0.3 (fake VOB ProtectCD) -> FEUERRADER] binary file"; flow:established,to_server; content: "|90|";content: "|90FFE05F81EF00000000BE000040008B870000000003C657568CA700000000FF108987000000005E5F|"; distance: 24; within: 41;sid: 2009141; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AHTeam EP Protector 0.3 (fake Xtreme-Protector 1.05) -> FEUERRADER] binary file"; flow:established,to_server; content: "|90|";content: "|90FFE0E8000000005D8100000000006A45E8A30000006800000000E8|"; distance: 24; within: 28;sid: 2009142; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AHTeam EP Protector 0.3 (fake ZCode 1.01) -> FEUERRADER] binary file"; flow:established,to_server; content: "|90|";content: "|90FFE0E912000000000000000000000000000000E9FBFFFFFFC3680000000064FF35|"; distance: 24; within: 34;sid: 2009143; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AINEXE v2.1] binary file"; flow:established,to_server; content: "|A1|";content: "|2D|"; distance: 2; within: 1;content: "|8ED0BC|"; distance: 2; within: 3;content: "|8CD836A3|"; distance: 4; within: 4;content: "|05|"; distance: 5; within: 1;content: "|36A3|"; distance: 2; within: 2;content: "|2EA1|"; distance: 3; within: 2;content: "|8AD4B104D2EAFEC9|"; distance: 3; within: 8;sid: 2009144; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AINEXE v2.30] binary file"; flow:established,to_server; content: "|0E07B9|";content: "|BE|"; distance: 4; within: 1;content: "|33FFFCF3A4A1|"; distance: 2; within: 6;content: "|2D|"; distance: 7; within: 1;content: "|8ED0BC|"; distance: 2; within: 3;content: "|8CD8|"; distance: 4; within: 2;sid: 2009145; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Alex Protector v1.0 -> Alex] binary file"; flow:established,to_server; content: "|60E8000000005D81ED06104000E824000000EB01E98B|";sid: 2009146; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Alloy 4.x -> PGWare LLC] binary file"; flow:established,to_server; content: "|9C60E80200000033C08BC483C004938BE38B5BFC81EB0730400087DD6A04680010000068000200006A00FF95A83340000BC00F84F601000089852E33400083BDE832400001740D83BDE432400001742A8BF8EB3E68|";sid: 2009147; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Alloy v1.x.2000] binary file"; flow:established,to_server; content: "|9C60E802|";content: "|33C08BC483C004938BE38B5BFC81EB072040|"; distance: 5; within: 18;content: "|87DD6A0468|"; distance: 18; within: 5;content: "|10|"; distance: 5; within: 1;content: "|68|"; distance: 2; within: 1;content: "|02|"; distance: 1; within: 1;content: "|6A|"; distance: 2; within: 1;content: "|FF95462340|"; distance: 1; within: 5;content: "|0B|"; distance: 5; within: 1;sid: 2009148; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Aluwain v8.09] binary file"; flow:established,to_server; content: "|8BEC1EE8|";content: "|9D5E|"; distance: 5; within: 2;sid: 2009149; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ANDpakk2 0.18 - by Dmitry "AND" Andreev] binary file"; flow:established,to_server; content: "|FCBED4004000BF00|";content: "|005783CDFF33C9F9EB05A402DB75058A1E4612DB72F433C04002DB75058A1E4612DB13C002DB75058A1E4612DB720E4802DB75058A1E4612DB13C0EBDC83E803720FC1E008AC83F0FF744DD1F88BE8EB0902DB75058A1E4612DB13C902DB75058A1E4612DB13C9751A4102DB75058A1E4612DB13C902DB75058A1E4612DB73EA83C10281FD00FBFFFF83D101568D342FF3A45EE973FFFFFFC3|"; distance: 9; within: 153;sid: 2009150; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Anskya Binder v1.1 -> Anskya] binary file"; flow:established,to_server; content: "|BE|";content: "|00BBF811400033ED83EE04392E7411|"; distance: 2; within: 15;sid: 2009151; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Anslym Crypter] binary file"; flow:established,to_server; content: "|558BEC83C4F05356B838170510E85A45FBFF33C05568211C051064FF30648920EB08FCFCFCFCFCFC2754E8854CFBFF6A00E80E47FBFF6A0AE82749FBFFE8EA47FBFF6A0A68301C0510A16056051050E86847FBFF8BD885DB0F84B602000053A16056051050E8F248FBFF8BF085F60F84A0020000E8F3|";sid: 2009152; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Anslym FUD Crypter] binary file"; flow:established,to_server; content: "|558BEC83C4F05356B838170510E85A45FBFF33C05568211C051064FF30648920EB08FCFCFCFCFCFC2754E8854CFBFF6A00E80E47FBFF6A0AE82749FBFFE8EA47FBFF6A0A|";sid: 2009153; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Anticrack Software Protector v1.09 (ACProtect)] binary file"; flow:established,to_server; content: "|60|";content: "|0000|"; distance: 5; within: 2;content: "|E801000000|"; distance: 8; within: 5;content: "|83042406C3|"; distance: 5; within: 5;content: "|00|"; distance: 7; within: 1;sid: 2009154; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AntiDote 1.0 Beta -> SIS-Team] binary file"; flow:established,to_server; content: "|E8BBFFFFFF84C0742F680401000068C02360006A00FF1508106000E840FFFFFF506878116000686811600068C0236000E8ABFDFFFF83C41033C0C210009090908B4C2408568B74240833D28BC6F7F18BC685D2740833D2F7F1400FAFC15EC3908B4424045355568B483C5703C833D28B79548B71388BC7F7F685D2740C8BC733D2F7F68BF8470FAFFE33C033DB668B41148D54081833C0668B4106895424148D68FF85ED7C3733C0|";sid: 2009155; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AntiDote 1.2 Beta (Demo) -> SIS-Team] binary file"; flow:established,to_server; content: "|6869D60000E8C6FDFFFF6869D60000E8BCFDFFFF83C408E8A4FFFFFF84C0742F680401000068B02160006A00FF1508106000E829FFFFFF506888106000687810600068B0216000E8A4FDFFFF83C41033C0C210009090909090909090909090908B4C2408568B74240833D28BC6F7F18BC685D2740833D2F7F1400FAFC15EC3908B4424045355568B483C5703C833D28B79548B71388BC7F7F685D2740C8BC733D2F7F68BF8470FAFFE33C033DB668B41148D54081833C0|";sid: 2009156; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AntiDote 1.2/1.4 SE DLL -> SIS-Team] binary file"; flow:established,to_server; content: "|EB1066623A432B2B484F4F4B90E9083290909090909090909090807C2408010F85|";content: "|60BE|"; distance: 35; within: 2;content: "|8DBE|"; distance: 4; within: 2;content: "|5783CDFFEB0B908A064688074701DB75078B1E83EEFC11DB72EDB80100000001DB75078B1E83EEFC11DB11C001DB73|"; distance: 4; within: 47;content: "|75|"; distance: 47; within: 1;content: "|8B1E83EEFC11DB|"; distance: 1; within: 7;sid: 2009157; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AntiDote 1.4 SE -> SIS-Team] binary file"; flow:established,to_server; content: "|6890030000E8C6FDFFFF6890030000E8BCFDFFFF6890030000E8B2FDFFFF50E8ACFDFFFF50E8A6FDFFFF6869D60000E89CFDFFFF50E896FDFFFF50E890FDFFFF83C420E878FFFFFF84C0744F680401000068102260006A00FF15081060006890030000E868FDFFFF6869D60000E85EFDFFFF50E858FDFFFF50E852FDFFFFE8DDFEFFFF5068A410600068941060006810226000E858FDFFFF83C42033C0C210008B4C2408568B74240833D28BC6F7F18BC685D2740833D2F7F1400FAFC15EC3|";sid: 2009158; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AntiVirus Vaccine v.1.03] binary file"; flow:established,to_server; content: "|FA33DBB9|";content: "|0E1F33F6FCAD35|"; distance: 5; within: 7;content: "|03D8E2|"; distance: 8; within: 3;sid: 2009159; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[aPack v0.62] binary file"; flow:established,to_server; content: "|1E068CC88ED8|";content: "|8EC050BE|"; distance: 7; within: 4;content: "|33FFFCB6|"; distance: 5; within: 4;sid: 2009160; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[aPack v0.82] binary file"; flow:established,to_server; content: "|1E068CCBBA|";content: "|03DA8D|"; distance: 6; within: 3;content: "|FC33F633FF484B8EC08EDB|"; distance: 4; within: 11;sid: 2009161; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[APatch GUI v1.1] binary file"; flow:established,to_server; content: "|5231C0E8FFFFFFFF|";sid: 2009162; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[APEX_C (BLT Apex 4.0) -> 500mhz] binary file"; flow:established,to_server; content: "|68|";content: "|B9FFFFFF0001D0F7E2720148E2F7B9FF0000008B34248036FD46E2FAC3|"; distance: 3; within: 29;sid: 2009163; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Apex_c beta -> 500mhz] binary file"; flow:established,to_server; content: "|68|";content: "|B9FFFFFF0001D0F7E2720148E2F7B9FF0000008B34248036FD46E2FAC3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000|"; distance: 3; within: 80;sid: 2009164; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[App Encryptor -> Silent Team] binary file"; flow:established,to_server; content: "|60E8000000005D81ED1F1F4000B97B0900008DBD671F40008BF7AC|";sid: 2009165; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[App Protector -> Silent Team] binary file"; flow:established,to_server; content: "|E9970000000D0A53696C656E74205465616D204170702050726F746563746F720D0A437265617465642062792053696C656E7420536F6674776172650D0A5468656E6B7A20746F20446F6368746F7220580D0A0D0A|";sid: 2009166; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ARC-SFX Archive] binary file"; flow:established,to_server; content: "|8CC88CDB8ED88EC089|";content: "|2BC3A3|"; distance: 10; within: 3;content: "|89|"; distance: 4; within: 1;content: "|BE|"; distance: 2; within: 1;content: "|B9|"; distance: 2; within: 1;content: "|BF|"; distance: 2; within: 1;content: "|BA|"; distance: 2; within: 1;content: "|FCAC32C28AD8|"; distance: 2; within: 6;sid: 2009167; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ARM Protector 0.1 - by SMoKE] binary file"; flow:established,to_server; content: "|E8040000008360EB0C5DEB054555EB04B8EBF900C3E8000000005DEB010081ED5E1F4000EB0283098DB5EF1F4000EB028309BAA3110000EB01008D8D923140008B09E81400000083EB01008BFEE8000000005883C00750C300EB04584050C38A0646EB0100D0C8E81400000083EB01002AC2E8000000005B83C30753C300EB045B4353C3EB010032C2E80B0000000032C1EB0100C0C002EB092AC25BEB01004353C38807EB0100474A75B4|";sid: 2009168; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ARM Protector v0.2-> SMoKE] binary file"; flow:established,to_server; content: "|E8040000008360EB0C5DEB054555EB04B8EBF900C3E8000000005DEB010081ED09204000EB0283098DB59A204000EB028309BA0B120000EB01008D8DA5324000|";sid: 2009169; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo 3.00a -> Silicon Realms Toolworks] binary file"; flow:established,to_server; content: "|60E8000000005D5051EB0F|";content: "|EB0F|"; distance: 11; within: 2;content: "|EB07|"; distance: 2; within: 2;content: "|EB0F|"; distance: 2; within: 2;content: "|EB08FDEB0BF2EBF5EBF6F2EB08FDEBE9F3EBE4FC|"; distance: 2; within: 20;content: "|59585051EB0F|"; distance: 20; within: 6;content: "|EB0F|"; distance: 6; within: 2;content: "|EB07|"; distance: 2; within: 2;content: "|EB0F|"; distance: 2; within: 2;content: "|EB08FDEB0BF2EBF5EBF6F2EB08FDEBE9F3EBE4FC|"; distance: 2; within: 20;content: "|59585051EB0F|"; distance: 20; within: 6;sid: 2009170; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo 3.X-5.X -> Silicon Realms Toolworks] binary file"; flow:established,to_server; content: "|60E8000000005D50510FCAF7D29CF7D20FCAEB0FB9EB0FB8EB07B9EB0F90EB08FDEB0BF2EBF5EBF6F2EB08FDEBE9F3EBE4FCE99D0FC98BCAF7D1595850510FCAF7D29CF7D20FCAEB0FB9EB0FB8EB07B9EB0F90EB08FDEB0BF2EBF5EBF6F2EB08FDEBE9F3EBE4FCE99D0FC98BCAF7D1595850510FCAF7D29CF7D20FCAEB0FB9EB0FB8EB07B9EB0F90EB08FDEB0BF2EBF5EBF6F2EB08FDEBE9F3EBE4FCE99D0FC98BCAF7D159586033C97502EB15EB33|";sid: 2009171; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo 5.0 Dll -> Silicon Realms Toolworks] binary file"; flow:established,to_server; content: "|837C2408017505E8DE4B0000FF7424048B4C24108B54240CE8EDFEFFFF59C20C006A0C68|";content: "|E8E52400008B4D0833FF3BCF762E6AE05833D2F7F13B450C1BC040751FE88F150000C7000C0000005757575757E82015000083C41433C0E9D50000000FAF4D0C8BF18975083BF7750333F64633DB895DE483FEE07769833D|"; distance: 38; within: 88;content: "|03754B83C60F83E6F089750C8B45083B05|"; distance: 90; within: 17;content: "|77376A04E8D723000059897DFCFF7508E8EC530000598945E4C745FCFEFFFFFFE85F0000008B5DE43BDF7411FF75085753E82BC5FFFF83C40C3BDF7561566A08FF35|"; distance: 19; within: 66;content: "|FF15|"; distance: 68; within: 2;content: "|8BD83BDF754C393D|"; distance: 4; within: 8;content: "|743356E819EDFFFF5985C00F8572FFFFFF8B45103BC70F8450FFFFFFC7000C000000E945FFFFFF33FF8B750C6A04E87D22000059C3|"; distance: 10; within: 53;sid: 2009172; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo 5.00 -> Silicon Realms Toolworks] binary file"; flow:established,to_server; content: "|E8E3400000E916FEFFFF6A0C68|";content: "|E8441500008B4D0833FF3BCF762E6AE05833D2F7F13B450C1BC040751FE836130000C7000C0000005757575757E8C712000083C41433C0E9D50000000FAF4D0C8BF18975083BF7750333F64633DB895DE483FEE07769833D|"; distance: 15; within: 88;content: "|03754B83C60F83E6F089750C8B45083B05|"; distance: 90; within: 17;content: "|77376A04E84811000059897DFCFF7508E801490000598945E4C745FCFEFFFFFFE85F0000008B5DE43BDF7411FF75085753E866D3FFFF83C40C3BDF7561566A08FF35|"; distance: 19; within: 66;content: "|FF15|"; distance: 68; within: 2;content: "|8BD83BDF754C393D|"; distance: 4; within: 8;content: "|743356E8AFF9FFFF5985C00F8572FFFFFF8B45103BC70F8450FFFFFFC7000C000000E945FFFFFF33FF8B750C6A04E8EE0F000059C3|"; distance: 10; within: 53;sid: 2009173; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v1.60a] binary file"; flow:established,to_server; content: "|558BEC6AFF689871400068482D400064A100000000506489250000000083EC58|";sid: 2009174; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v1.71] binary file"; flow:established,to_server; content: "|558BEC6AFF68|";content: "|68|"; distance: 8; within: 1;content: "|64A1|"; distance: 3; within: 2;sid: 2009175; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v1.72 - v1.73] binary file"; flow:established,to_server; content: "|558BEC6AFF68E8C1|";content: "|68F486|"; distance: 9; within: 3;content: "|64A1|"; distance: 4; within: 2;content: "|50648925|"; distance: 4; within: 4;content: "|83EC58|"; distance: 6; within: 3;sid: 2009176; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v1.77] binary file"; flow:established,to_server; content: "|558BEC6AFF68B0714000686C37400064A100000000506489250000000083EC58|";sid: 2009177; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v1.80] binary file"; flow:established,to_server; content: "|558BEC6AFF68E8C1000068F486000064A100000000506489250000000083EC58|";sid: 2009178; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v1.82] binary file"; flow:established,to_server; content: "|558BEC6AFF68E0C14000687481400064A100000000506489250000000083EC58|";sid: 2009179; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v1.83] binary file"; flow:established,to_server; content: "|558BEC6AFF68E0C14000686484400064A100000000506489250000000083EC58|";sid: 2009180; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v1.84] binary file"; flow:established,to_server; content: "|558BEC6AFF68E8C1400068F486400064A100000000506489250000000083EC58|";sid: 2009181; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v1.90] binary file"; flow:established,to_server; content: "|558BEC6AFF6810F2400068649A400064A100000000506489250000000083EC58|";sid: 2009182; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v1.90a] binary file"; flow:established,to_server; content: "|558BEC64FF6810F2400068149B400064A100000000506489250000000083EC58|";sid: 2009183; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v1.90b1] binary file"; flow:established,to_server; content: "|558BEC6AFF68E0C14000680489400064A100000000506489250000000083EC58|";sid: 2009184; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v1.90b2] binary file"; flow:established,to_server; content: "|558BEC6AFF68F0C1400068A489400064A100000000506489250000000083EC58|";sid: 2009185; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v1.90b3] binary file"; flow:established,to_server; content: "|558BEC6AFF6808E24000689495400064A100000000506489250000000083EC58|";sid: 2009186; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v1.90b4] binary file"; flow:established,to_server; content: "|558BEC6AFF6808E2400068B496400064A100000000506489250000000083EC58|";sid: 2009187; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v1.90c] binary file"; flow:established,to_server; content: "|558BEC6AFF6810F2400068749D400064A100000000506489250000000083EC58|";sid: 2009188; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v1.9x] binary file"; flow:established,to_server; content: "|558BEC6AFF6898|";content: "|6810|"; distance: 8; within: 2;content: "|64A1|"; distance: 3; within: 2;content: "|50648925|"; distance: 4; within: 4;content: "|83EC585356578965E8FF15|"; distance: 6; within: 11;sid: 2009189; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v1.xx - v2.xx] binary file"; flow:established,to_server; content: "|558BEC538B5D08568B750C578B7D1085F6|";sid: 2009190; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.00] binary file"; flow:established,to_server; content: "|558BEC6AFF680002410068C4A0400064A100000000506489250000000083EC58|";sid: 2009191; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.00b2-2.00b3] binary file"; flow:established,to_server; content: "|558BEC6AFF6800F2400068C4A0400064A100000000506489250000000083EC58|";sid: 2009192; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.01] binary file"; flow:established,to_server; content: "|558BEC6AFF680802410068049A400064A100000000506489250000000083EC58|";sid: 2009193; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.10b2] binary file"; flow:established,to_server; content: "|558BEC6AFF68181241006824A0400064A100000000506489250000000083EC58|";sid: 2009194; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.20] binary file"; flow:established,to_server; content: "|558BEC6AFF681012410068F4A0400064A100000000506489250000000083EC58|";sid: 2009195; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.20b1] binary file"; flow:established,to_server; content: "|558BEC6AFF683012410068A4A5400064A100000000506489250000000083EC58|";sid: 2009196; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.50] binary file"; flow:established,to_server; content: "|558BEC6AFF68B8|";content: "|68F8|"; distance: 8; within: 2;content: "|64A100000000506489250000000083EC585356578965E8FF1520|"; distance: 3; within: 26;content: "|33D28AD48915D0|"; distance: 27; within: 7;sid: 2009197; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.50b3] binary file"; flow:established,to_server; content: "|558BEC6AFF68B8|";content: "|68F8|"; distance: 8; within: 2;content: "|64A1|"; distance: 3; within: 2;content: "|50648925|"; distance: 4; within: 4;content: "|83EC585356578965E8FF1520|"; distance: 6; within: 12;content: "|33D28AD48915D0|"; distance: 13; within: 7;sid: 2009198; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.51] binary file"; flow:established,to_server; content: "|558BEC6AFF68B8|";content: "|68D0|"; distance: 8; within: 2;content: "|64A1|"; distance: 3; within: 2;content: "|50648925|"; distance: 4; within: 4;content: "|83EC585356578965E8FF1520|"; distance: 6; within: 12;sid: 2009199; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.52] binary file"; flow:established,to_server; content: "|558BEC6AFF68|";content: "|E0|"; distance: 8; within: 1;content: "|68D464A100000000506489250000000083EC585356578965E8FF|"; distance: 3; within: 26;content: "|1538|"; distance: 27; within: 2;sid: 2009200; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.52] binary file"; flow:established,to_server; content: "|558BEC6AFF68E0|";content: "|68D4|"; distance: 8; within: 2;content: "|64A1|"; distance: 3; within: 2;content: "|50648925|"; distance: 4; within: 4;content: "|83EC585356578965E8FF1538|"; distance: 6; within: 12;sid: 2009201; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.52 beta2] binary file"; flow:established,to_server; content: "|558BEC6AFF68|";content: "|B0|"; distance: 8; within: 1;content: "|686064A100000000506489250000000083EC585356578965E8FF|"; distance: 3; within: 26;content: "|1524|"; distance: 27; within: 2;sid: 2009202; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.52b2] binary file"; flow:established,to_server; content: "|558BEC6AFF68B0|";content: "|6860|"; distance: 8; within: 2;content: "|64A1|"; distance: 3; within: 2;content: "|50648925|"; distance: 4; within: 4;content: "|83EC585356578965E8FF1524|"; distance: 6; within: 12;sid: 2009203; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.53] binary file"; flow:established,to_server; content: "|558BEC6AFF6840|";content: "|6854|"; distance: 8; within: 2;content: "|64A1|"; distance: 3; within: 2;content: "|50648925|"; distance: 4; within: 4;content: "|83EC585356578965E8FF1558|"; distance: 6; within: 12;content: "|33D28AD48915EC|"; distance: 13; within: 7;sid: 2009204; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.53] binary file"; flow:established,to_server; content: "|558BEC6AFF68|";content: "|40|"; distance: 8; within: 1;content: "|685464A100000000506489250000000083EC585356578965E8FF|"; distance: 3; within: 26;content: "|155833D28AD489|"; distance: 27; within: 7;sid: 2009205; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.53b3] binary file"; flow:established,to_server; content: "|558BEC6AFF68D8|";content: "|6814|"; distance: 8; within: 2;content: "|64A1|"; distance: 3; within: 2;content: "|50648925|"; distance: 4; within: 4;content: "|83EC585356578965E8FF15|"; distance: 6; within: 11;sid: 2009206; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.5x - v2.6x] binary file"; flow:established,to_server; content: "|558BEC6AFF68|";content: "|68|"; distance: 8; within: 1;content: "|64A100000000506489250000000083EC585356578965E8FF1558|"; distance: 3; within: 26;content: "|33D28AD48915EC|"; distance: 27; within: 7;sid: 2009207; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.60] binary file"; flow:established,to_server; content: "|558BEC6AFF68D0|";content: "|6834|"; distance: 8; within: 2;content: "|64A1|"; distance: 3; within: 2;content: "|50648925|"; distance: 4; within: 4;content: "|83EC585356578965E8FF1568|"; distance: 6; within: 12;content: "|33D28AD4891584|"; distance: 13; within: 7;sid: 2009208; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.60a] binary file"; flow:established,to_server; content: "|558BEC6AFF68|";content: "|6894|"; distance: 8; within: 2;content: "|64A1|"; distance: 3; within: 2;content: "|50648925|"; distance: 4; within: 4;content: "|83EC585356578965E8FF156C|"; distance: 6; within: 12;content: "|33D28AD48915B4|"; distance: 13; within: 7;sid: 2009209; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.60b1] binary file"; flow:established,to_server; content: "|558BEC6AFF6850|";content: "|6874|"; distance: 8; within: 2;content: "|64A1|"; distance: 3; within: 2;content: "|50648925|"; distance: 4; within: 4;content: "|83EC585356578965E8FF1558|"; distance: 6; within: 12;content: "|33D28AD48915FC|"; distance: 13; within: 7;sid: 2009210; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.60b2] binary file"; flow:established,to_server; content: "|558BEC6AFF6890|";content: "|6824|"; distance: 8; within: 2;content: "|64A1|"; distance: 3; within: 2;content: "|50648925|"; distance: 4; within: 4;content: "|83EC585356578965E8FF1560|"; distance: 6; within: 12;content: "|33D28AD489153C|"; distance: 13; within: 7;sid: 2009211; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.60c] binary file"; flow:established,to_server; content: "|558BEC6AFF6840|";content: "|68F4|"; distance: 8; within: 2;content: "|64A1|"; distance: 3; within: 2;content: "|50648925|"; distance: 4; within: 4;content: "|83EC585356578965E8FF156C|"; distance: 6; within: 12;content: "|33D28AD48915F4|"; distance: 13; within: 7;sid: 2009212; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.61] binary file"; flow:established,to_server; content: "|558BEC6AFF6828|";content: "|68E4|"; distance: 8; within: 2;content: "|64A1|"; distance: 3; within: 2;content: "|50648925|"; distance: 4; within: 4;content: "|83EC585356578965E8FF156C|"; distance: 6; within: 12;content: "|33D28AD489150C|"; distance: 13; within: 7;sid: 2009213; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.65b1] binary file"; flow:established,to_server; content: "|558BEC6AFF6838|";content: "|6840|"; distance: 8; within: 2;content: "|64A1|"; distance: 3; within: 2;content: "|50648925|"; distance: 4; within: 4;content: "|83EC585356578965E8FF1528|"; distance: 6; within: 12;content: "|33D28AD48915F4|"; distance: 13; within: 7;sid: 2009214; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.75a] binary file"; flow:established,to_server; content: "|558BEC6AFF6868|";content: "|68D0|"; distance: 8; within: 2;content: "|64A1|"; distance: 3; within: 2;content: "|50648925|"; distance: 4; within: 4;content: "|83EC585356578965E8FF1528|"; distance: 6; within: 12;content: "|33D28AD4891524|"; distance: 13; within: 7;sid: 2009215; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.85] binary file"; flow:established,to_server; content: "|558BEC6AFF6868|";content: "|68|"; distance: 8; within: 1;content: "|64A1|"; distance: 3; within: 2;content: "|50648925|"; distance: 4; within: 4;content: "|83EC585356578965E8FF1528|"; distance: 6; within: 12;content: "|33D28AD4891524|"; distance: 13; within: 7;sid: 2009216; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v2.xx (CopyMem II)] binary file"; flow:established,to_server; content: "|6A|";content: "|8BB5|"; distance: 1; within: 2;content: "|C1E6048B85|"; distance: 4; within: 5;content: "|2507|"; distance: 7; within: 2;content: "|8079054883C8F84033C98A88|"; distance: 3; within: 12;content: "|8B95|"; distance: 14; within: 2;content: "|81E207|"; distance: 4; within: 3;content: "|8079054A83CAF84233C08A82|"; distance: 4; within: 12;sid: 2009217; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v3.00] binary file"; flow:established,to_server; content: "|60E8|";content: "|5D5051EB0FB9EB0FB8EB07B9EB0F90EB08FDEB0BF2EBF5EBF6F2EB08FDEBE9F3EBE4FCE959586033C9|"; distance: 4; within: 41;sid: 2009218; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v3.00a] binary file"; flow:established,to_server; content: "|60E8|";content: "|5D5051EB0FB9EB0FB8EB07B9EB0F90EB08FDEB0BF2EBF5EBF6F2EB08FDEBE9F3EBE4FCE959585051EB|"; distance: 4; within: 41;sid: 2009219; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v3.01, v3.05] binary file"; flow:established,to_server; content: "|60E8000000005D5051EB0FB9EB0FB8EB07B9EB0F90EB08FDEB0BF2EBF5EBF6F2EB08FDEBE9F3EBE4FCE959585051EB0FB9EB0FB8EB07B9EB0F90EB08FDEB0BF2EBF5EBF6F2EB08FDEBE9F3EBE4FCE959585051EB0F|";sid: 2009220; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v3.10] binary file"; flow:established,to_server; content: "|558BEC6AFF68E09744006820C0420064A100000000506489250000000083EC585356578965E8FF154C41440033D28AD4891590A144008BC881E1FF000000890D8CA14400C1E10803CA890D88A14400C1E810A384A1|";sid: 2009221; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v3.xx] binary file"; flow:established,to_server; content: "|60E8|";content: "|5D5051EB0FB9EB0FB8EB07B9EB0F90EB08FDEB0BF2EBF5EBF6F2EB08FDEBE9F3EBE4FCE95958|"; distance: 4; within: 38;sid: 2009222; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v4.00.0053 -> Silicon Realms Toolworks] binary file"; flow:established,to_server; content: "|558BEC6AFF68208B4B006880E4480064A100000000506489250000000083EC585356578965E8FF1588314B0033D28AD48915A4A14B008BC881E1FF000000890DA0A14B00C1E10803CA890D9CA14B00C1E810A398A1|";sid: 2009223; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v4.10 -> Silicon Realms Toolworks] binary file"; flow:established,to_server; content: "|558BEC6AFF68F88E4C0068D0EA490064A100000000506489250000000083EC585356578965E8FF1588314C0033D28AD489157CA54C008BC881E1FF000000890D78A54C00C1E10803CA890D74A54C00C1E810A370A5|";sid: 2009224; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v4.20 -> Silicon Realms Toolworks] binary file"; flow:established,to_server; content: "|558BEC6AFF68F88E4C0068F0EA490064A100000000506489250000000083EC585356578965E8FF1588314C0033D28AD4891584A54C008BC881E1FF000000890D80A54C00C1E10803CA890D7CA54C00C1E810A378A5|";sid: 2009225; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v4.30 - v4.40 -> Silicon Realms Toolworks] binary file"; flow:established,to_server; content: "|558BEC6AFF6840|";content: "|006880|"; distance: 8; within: 3;content: "|0064A100000000506489250000000083EC585356578965E8FF1588|"; distance: 4; within: 27;content: "|0033D28AD4891530|"; distance: 28; within: 8;content: "|008BC881E1FF000000890D2C|"; distance: 9; within: 12;content: "|00C1E10803CA890D28|"; distance: 13; within: 9;content: "|00C1E810A324|"; distance: 10; within: 6;sid: 2009226; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Armadillo v4.30 - v4.40 -> Silicon Realms Toolworks] binary file"; flow:established,to_server; content: "|60E8000000005D50510FCAF7D29CF7D20FCAEB0FB9EB0FB8EB07B9EB0F90EB08FDEB0BF2EBF5EBF6F2EB08FDEBE9F3EBE4FCE99D0FC98BCAF7D1595850510FCAF7D29CF7D20FCAEB0FB9EB0FB8EB07B9EB0F90EB08|";sid: 2009227; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASDPack 2.0 -> asd] binary file"; flow:established,to_server; content: "|8B442404565753E8CD010000C30000000000000000000000000010000000|";sid: 2009228; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v1.00b -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E8|";content: "|5D81ED921A44|"; distance: 4; within: 6;content: "|B88C1A44|"; distance: 6; within: 4;content: "|03C52B85CD1D44|"; distance: 4; within: 7;content: "|8985D91D44|"; distance: 7; within: 5;content: "|80BDC41D44|"; distance: 5; within: 5;sid: 2009229; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v1.01b -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E8|";content: "|5D81EDD22A44|"; distance: 4; within: 6;content: "|B8CC2A44|"; distance: 6; within: 4;content: "|03C52B85A52E44|"; distance: 4; within: 7;content: "|8985B12E44|"; distance: 7; within: 5;content: "|80BD9C2E44|"; distance: 5; within: 5;sid: 2009230; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v1.02a -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E8|";content: "|5D81ED3ED943|"; distance: 4; within: 6;content: "|B838|"; distance: 6; within: 2;content: "|03C52B850BDE43|"; distance: 3; within: 7;content: "|898517DE43|"; distance: 7; within: 5;content: "|80BD01DE43|"; distance: 5; within: 5;content: "|7515FE8501DE43|"; distance: 6; within: 7;content: "|E81D|"; distance: 7; within: 2;content: "|E87902|"; distance: 3; within: 3;content: "|E81203|"; distance: 4; within: 3;content: "|8B8503DE43|"; distance: 4; within: 5;content: "|038517DE43|"; distance: 5; within: 5;content: "|8944241C61FF|"; distance: 5; within: 6;sid: 2009231; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v1.02b -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E8000000005D81ED96784300B89078430003C5|";sid: 2009232; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v1.02b -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E8|";content: "|5D81ED967843|"; distance: 4; within: 6;content: "|B8907843|"; distance: 6; within: 4;content: "|03C52B857D7C43|"; distance: 4; within: 7;content: "|8985897C43|"; distance: 7; within: 5;content: "|80BD747C43|"; distance: 5; within: 5;sid: 2009233; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v1.03b -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E8|";content: "|5D81EDAE9843|"; distance: 4; within: 6;content: "|B8A89843|"; distance: 6; within: 4;content: "|03C52B85189D43|"; distance: 4; within: 7;content: "|8985249D43|"; distance: 7; within: 5;content: "|80BD0E9D43|"; distance: 5; within: 5;sid: 2009234; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v1.04b -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E8|";content: "|5D81ED|"; distance: 4; within: 3;content: "|B8|"; distance: 5; within: 1;content: "|03C52B85|"; distance: 3; within: 4;content: "|129D|"; distance: 4; within: 2;content: "|89851E9D|"; distance: 2; within: 4;content: "|80BD089D|"; distance: 5; within: 4;sid: 2009235; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v1.05b -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E8|";content: "|5D81EDCE3A44|"; distance: 4; within: 6;content: "|B8C83A44|"; distance: 6; within: 4;content: "|03C52B85B53E44|"; distance: 4; within: 7;content: "|8985C13E44|"; distance: 7; within: 5;content: "|80BDAC3E44|"; distance: 5; within: 5;sid: 2009236; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v1.061b -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E8|";content: "|5D81EDEAA843|"; distance: 4; within: 6;content: "|B8E4A843|"; distance: 6; within: 4;content: "|03C52B8578AD43|"; distance: 4; within: 7;content: "|898584AD43|"; distance: 7; within: 5;content: "|80BD6EAD43|"; distance: 5; within: 5;sid: 2009237; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v1.07b (DLL) -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E8000000005D|";content: "|B8|"; distance: 10; within: 1;content: "|03C5|"; distance: 3; within: 2;sid: 2009238; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v1.07b -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E8|";content: "|5D81ED|"; distance: 4; within: 3;content: "|B8|"; distance: 5; within: 1;content: "|03C52B85|"; distance: 3; within: 4;content: "|0BDE|"; distance: 4; within: 2;content: "|898517DE|"; distance: 2; within: 4;content: "|80BD01DE|"; distance: 5; within: 4;sid: 2009239; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v1.08.01 -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60EB0A5DEB02FF2545FFE5E8E9E8F1FFFFFFE981|";content: "|4400BB10|"; distance: 21; within: 4;content: "|440003DD2B9D|"; distance: 4; within: 6;sid: 2009240; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v1.08.01 -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60EB0A5DEB02FF2545FFE5E8E9E8F1FFFFFFE981|";content: "|44|"; distance: 21; within: 1;content: "|BB10|"; distance: 1; within: 2;content: "|44|"; distance: 2; within: 1;content: "|03DD2B9D|"; distance: 1; within: 4;sid: 2009241; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v1.08.01 -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60EB|";content: "|5DEB|"; distance: 2; within: 2;content: "|FF|"; distance: 2; within: 1;content: "|E9|"; distance: 3; within: 1;sid: 2009242; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v1.08.02 -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60EB0A5DEB02FF2545FFE5E8E9E8F1FFFFFFE981ED236A4400BB10|";content: "|440003DD2B9D72|"; distance: 27; within: 7;sid: 2009243; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v1.08.03 -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E8000000005D81ED0A4A4400BB044A440003DD|";sid: 2009244; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v1.08.03 -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E8000000005D81ED0A4A4400BB044A440003DD2B9DB150440083BDAC50440000899DBB4E|";sid: 2009245; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v1.08.03 -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E8000000005D|";content: "|BB|"; distance: 10; within: 1;content: "|03DD|"; distance: 3; within: 2;sid: 2009246; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v1.08.03 -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E8000000005D|";content: "|BB|"; distance: 10; within: 1;content: "|03DD2B9DB150440083BDAC50440000899DBB4E|"; distance: 3; within: 19;sid: 2009247; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v1.08.04 -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E841060000EB41|";sid: 2009248; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v1.08.x -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60EB035DFFE5E8F8FFFFFF81ED1B6A4400BB106A440003DD2B9D2A|";sid: 2009249; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v2.000 -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E870050000EB4C|";sid: 2009250; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v2.001 -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E872050000EB4C|";sid: 2009251; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v2.1 -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E872050000EB3387DB9000|";sid: 2009252; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v2.11b -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E802000000EB095D5581ED39394400C3E93D040000|";sid: 2009253; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v2.11c -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E802000000EB095D5581ED39394400C3E959040000|";sid: 2009254; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v2.11d -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E802000000EB095D55|";sid: 2009255; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v2.12 -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E803000000E9EB045D4555C3E801|";sid: 2009256; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v2.12 -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E803000000E9EB045D4555C3E801000000EB5DBBEDFFFFFF03DD81EB|";sid: 2009257; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v2.xx -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|A8030000617508B801000000C20C006800000000C38B85260400008D8D3B0400005150FF95|";sid: 2009258; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPack v2.xx -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|A803|";content: "|617508B801|"; distance: 3; within: 5;content: "|C20C|"; distance: 6; within: 2;content: "|68|"; distance: 2; within: 1;content: "|C38B852604|"; distance: 3; within: 5;content: "|8D8D3B04|"; distance: 6; within: 4;content: "|5150FF95|"; distance: 5; within: 4;sid: 2009259; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASPR Stripper v2.x unpacked] binary file"; flow:established,to_server; content: "|BB|";content: "|E9|"; distance: 3; within: 1;content: "|609CFCBF|"; distance: 3; within: 4;content: "|B9|"; distance: 6; within: 1;content: "|F3AA9D61C3558BEC|"; distance: 3; within: 8;sid: 2009260; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASProtect 1.33 - 2.1 Registered -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|6801|";content: "|E801000000C3C3|"; distance: 3; within: 7;sid: 2009261; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASProtect SKE 2.1x (dll) -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E803000000E9EB045D4555C3E801000000EB5DBBEDFFFFFF03DD81EB00|";content: "|807D4D01750C8B74242883FE01895D4E75318D45535053FFB5ED0900008D453550E9820000000000000000000000000000000000|"; distance: 31; within: 52;sid: 2009262; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASProtect v1.0] binary file"; flow:established,to_server; content: "|60E801|";content: "|905D81ED|"; distance: 4; within: 4;content: "|BB|"; distance: 6; within: 1;content: "|03DD2B9D|"; distance: 3; within: 4;sid: 2009263; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASProtect v1.1] binary file"; flow:established,to_server; content: "|60E9|";content: "|04|"; distance: 2; within: 1;content: "|E9|"; distance: 2; within: 1;content: "|EE|"; distance: 4; within: 1;sid: 2009264; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASProtect v1.1 MTE] binary file"; flow:established,to_server; content: "|60E9|";content: "|9178797979E9|"; distance: 4; within: 6;sid: 2009265; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASProtect v1.1 MTEc] binary file"; flow:established,to_server; content: "|9060E81B|";content: "|E9FC|"; distance: 5; within: 2;sid: 2009266; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASProtect v1.23 RC1] binary file"; flow:established,to_server; content: "|6801|";content: "|00E801000000C3C3|"; distance: 3; within: 8;sid: 2009267; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASProtect v1.23 RC4 build 08.07 (dll) -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E803000000E9EB045D4555C3E801000000EB5DBBEDFFFFFF03DD81EB00|";content: "|807D4D01750C8B74242883FE01895D4E75318D45535053FFB5D50900008D453550E9820000000000000000000000000000000000|"; distance: 31; within: 52;sid: 2009268; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASProtect v1.2x] binary file"; flow:established,to_server; content: "|00006801|";content: "|C3AA|"; distance: 5; within: 2;sid: 2009269; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASProtect v1.2x (New Strain)] binary file"; flow:established,to_server; content: "|6801|";content: "|E801|"; distance: 3; within: 2;content: "|C3C3|"; distance: 3; within: 2;sid: 2009270; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASProtect V2.X DLL -> Alexey Solodovnikov] binary file"; flow:established,to_server; content: "|60E803000000E9|";content: "|5D4555C3E801000000EB5DBB|"; distance: 8; within: 12;content: "|03DD|"; distance: 14; within: 2;sid: 2009271; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ASProtect vx.x] binary file"; flow:established,to_server; content: "|60|";content: "|905D|"; distance: 3; within: 2;content: "|03DD|"; distance: 7; within: 2;sid: 2009272; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ass - crypter -> by santasdad] binary file"; flow:established,to_server; content: "|558BEC83C4EC53|";content: "|8945ECB898400010E8ACEAFFFF33C055687851001064|"; distance: 9; within: 22;content: "|206A0A6888510010A1E097001050E8D8EAFFFF8BD853A1E097001050E812EBFFFF8BF853A1E097001050E8DCEAFFFF8BD853E8DCEAFFFF8BF085F674268BD74AB8F0970010E8C9E7FFFFB8F0970010E8B7E7FFFF8BCF8BD6E8EEEAFFFF53E898EAFFFF8D4DECBA9C510010A1F0970010E822EBFFFF8B55ECB8F0970010E889E6FFFFB8F0970010E87FE7FFFFE86EECFFFF33C05A5959648910687F5100108D45ECE811E6FFFFC3E9FFDFFFFFEBF05F5E5BE80DE5FFFF0053455454494E475300000000FFFFFFFF1C000000454E54455220594F5552204F574E2050415353574F52442048455245|"; distance: 24; within: 231;sid: 2009273; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AverCryptor 1.0 -> os1r1s] binary file"; flow:established,to_server; content: "|60E8000000005D81ED751740008BBD9C1840008B8DA4184000B8BC18400003C580300583F9007471817F1CAB00000075628B570C0395A018400033C05133C966B9FA006683F90074498B570C0395A01840008B85A818400083F802750681C200020000518B4F1083F802750681E90002000057BFC80000008BF1E8270000008BC85FB8BC18400003C5E8240000005949EBB15983C72849EB8A8B85981840008944241C61FFE056574FF7D723F78BC65F5EC3|";sid: 2009274; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AverCryptor 1.02 beta -> os1r1s] binary file"; flow:established,to_server; content: "|60E8000000005D81ED0C1740008BBD331840008B8D3B184000B85118400003C580300583F9007471817F1CAB00000075628B570C03953718400033C05133C966B9F7006683F90074498B570C0395371840008B853F18400083F802750681C200020000518B4F1083F802750681E90002000057BFC80000008BF1E8270000008BC85FB85118400003C5E8240000005949EBB15983C72849EB8A8B852F1840008944241C61FFE056574FF7D723F78BC65F5EC3|";sid: 2009275; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AVPACK v1.20] binary file"; flow:established,to_server; content: "|501E0E1F160733F68BFEB9|";content: "|FCF3A506BB|"; distance: 12; within: 5;content: "|53CB|"; distance: 6; within: 2;sid: 2009276; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[AZProtect 0001 - by AlexZ aka AZCRC] binary file"; flow:established,to_server; content: "|EB70FC608C804D110070258100400D91BB608C804D11007021811D610D810040CE608C804D11007025812581258125812961418131611D610040B73000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060BE00|";content: "|00BF00004000EB174B45524E454C33322E444C4C0000000000FF25|"; distance: 118; within: 27;content: "|008BC603C78BF857558BEC057F00000050E8E5FFFFFFBA8C|"; distance: 28; within: 24;content: "|008902E91A010000|"; distance: 25; within: 8;content: "|0000004765744D6F64756C6546696C654E616D654100476574566F6C756D65496E666F726D6174696F6E41004D657373616765426F7841004578697450726F63657373004765744D6F64756C6548616E646C6541|"; distance: 8; within: 84;sid: 2009277; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[bambam 0.01 -> bedrock] binary file"; flow:established,to_server; content: "|6A14E89A0500008BD85368|";content: "|E86CFDFFFFB9050000008BF3BF|"; distance: 13; within: 13;content: "|53F3A5E88D0500008B3D|"; distance: 15; within: 10;content: "|A1|"; distance: 12; within: 1;content: "|668B15|"; distance: 3; within: 3;content: "|B9|"; distance: 5; within: 1;content: "|2BCF8945E8890D|"; distance: 3; within: 7;content: "|668955EC8B413C33D203C183C410668B4806668B501481E1FFFF00008D5C02188D41FF85C0|"; distance: 9; within: 37;sid: 2009278; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[bambam 0.04 -> bedrock] binary file"; flow:established,to_server; content: "|BF|";content: "|83C9FF33C068|"; distance: 3; within: 6;content: "|F2AEF7D1495168|"; distance: 8; within: 7;content: "|E8110A000083C40C68|"; distance: 9; within: 9;content: "|FF15|"; distance: 11; within: 2;content: "|8BF0BF|"; distance: 4; within: 3;content: "|83C9FF33C0F2AEF7D149BF|"; distance: 5; within: 11;content: "|8BD168|"; distance: 13; within: 3;content: "|C1E902F3AB8BCA83E103F3AABF|"; distance: 5; within: 13;content: "|83C9FF33C0F2AEF7D1495168|"; distance: 15; within: 12;content: "|E8C0090000|"; distance: 14; within: 5;sid: 2009279; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[beria v0.07 public WIP --> symbiont] binary file"; flow:established,to_server; content: "|83EC18538B1D0030|";content: "|555657683007000033ED55FFD38BF03BF5740D89AE20070000E8880F0000EB0233F66A105589353040|"; distance: 9; within: 41;content: "|FFD38BF03BF57409892EE83CFEFFFFEB0233F66A18558935D843|"; distance: 42; within: 26;content: "|FFD38BF0|"; distance: 27; within: 4;sid: 2009280; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[BeRo Tiny Pascal -> BeRo] binary file"; flow:established,to_server; content: "|E9|";content: "|20436F6D70696C65642062793A204265526F54696E7950617363616C202D2028432920436F7079726967687420323030362C2042656E6A616D696E20274265526F2720526F73736561757820|"; distance: 3; within: 76;sid: 2009281; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[BeRoEXEPacker v1.00 DLL [LZBRR] -> BeRo / Farbrausch] binary file"; flow:established,to_server; content: "|837C2408010F85|";content: "|60BE|"; distance: 9; within: 2;content: "|BF|"; distance: 4; within: 1;content: "|FCB28033DBA4B302E8|"; distance: 3; within: 9;content: "|73F633C9E8|"; distance: 11; within: 5;content: "|731C33C0E8|"; distance: 7; within: 5;content: "|7323B30241B010|"; distance: 7; within: 7;sid: 2009282; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[BeRoEXEPacker v1.00 DLL [LZBRS] -> BeRo / Farbrausch] binary file"; flow:established,to_server; content: "|837C2408010F85|";content: "|60BE|"; distance: 9; within: 2;content: "|BF|"; distance: 4; within: 1;content: "|FCAD8D1C07B0803BFB733BE8|"; distance: 3; within: 12;content: "|7203A4EBF2E8|"; distance: 14; within: 6;content: "|8D51FFE8|"; distance: 8; within: 4;content: "|568BF72BF2F3A45EEBDB02C07503AC12C0C333|"; distance: 6; within: 19;sid: 2009283; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[BeRoEXEPacker v1.00 DLL [LZMA] -> BeRo / Farbrausch] binary file"; flow:established,to_server; content: "|837C2408010F85|";content: "|6068|"; distance: 9; within: 2;content: "|68|"; distance: 4; within: 1;content: "|68|"; distance: 3; within: 1;content: "|E8|"; distance: 3; within: 1;content: "|BE|"; distance: 3; within: 1;content: "|B9|"; distance: 3; within: 1;content: "|8BF981FE|"; distance: 3; within: 4;content: "|7F10AC4704182C0273F0293E03F103F9EBE8|"; distance: 6; within: 18;sid: 2009284; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[BeRoEXEPacker v1.00 [LZBRR] -> BeRo / Farbrausch] binary file"; flow:established,to_server; content: "|60BE|";content: "|BF|"; distance: 4; within: 1;content: "|FCB28033DBA4B302E8|"; distance: 3; within: 9;content: "|73F633C9E8|"; distance: 11; within: 5;content: "|731C33C0E8|"; distance: 7; within: 5;content: "|7323B30241B010|"; distance: 7; within: 7;sid: 2009285; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[BeRoEXEPacker v1.00 [LZBRS] -> BeRo / Farbrausch] binary file"; flow:established,to_server; content: "|60BE|";content: "|BF|"; distance: 4; within: 1;content: "|FCAD8D1C07B0803BFB733BE8|"; distance: 3; within: 12;content: "|7203A4EBF2E8|"; distance: 14; within: 6;content: "|8D51FFE8|"; distance: 8; within: 4;content: "|568BF72BF2F3A45EEBDB02C07503AC12C0C333|"; distance: 6; within: 19;sid: 2009286; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[BeRoEXEPacker v1.00 [LZMA] -> BeRo / Farbrausch] binary file"; flow:established,to_server; content: "|6068|";content: "|68|"; distance: 4; within: 1;content: "|68|"; distance: 3; within: 1;content: "|E8|"; distance: 3; within: 1;content: "|BE|"; distance: 3; within: 1;content: "|B9040000008BF981FE|"; distance: 3; within: 9;content: "|7F10AC4704182C0273F0293E03F103F9EBE8|"; distance: 11; within: 18;sid: 2009287; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[BlackEnergy DDoS Bot Crypter] binary file"; flow:established,to_server; content: "|55|";content: "|81EC1C0100005356576A04BE0030000056FF35002011136A00E8|"; distance: 2; within: 26;content: "|030000|"; distance: 26; within: 3;content: "|83C410|"; distance: 4; within: 3;content: "|FF897DF40F|"; distance: 3; within: 5;sid: 2009288; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Blade Joiner v1.5] binary file"; flow:established,to_server; content: "|558BEC81C4E4FEFFFF53565733C08945F08985|";sid: 2009289; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[BobPack v1.00 --> BoB / BobSoft] binary file"; flow:established,to_server; content: "|60E8000000008B0C2489CD83E90681ED|";content: "|E83D0000008985|"; distance: 18; within: 7;content: "|89C2B85D0A00008D0408E8E40000008B700401D6E876000000E851010000E80101|"; distance: 9; within: 33;sid: 2009290; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[BobSoft Mini Delphi -> BoB / BobSoft] binary file"; flow:established,to_server; content: "|558BEC83C4F05356B8|";content: "|E8|"; distance: 11; within: 1;content: "|33C05568|"; distance: 3; within: 4;content: "|64FF30648920B8|"; distance: 6; within: 7;sid: 2009291; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[BobSoft Mini Delphi -> BoB / BobSoft] binary file"; flow:established,to_server; content: "|558BEC83C4F053B8|";content: "|E8|"; distance: 10; within: 1;content: "|33C05568|"; distance: 3; within: 4;content: "|64FF30648920B8|"; distance: 6; within: 7;content: "|E8|"; distance: 9; within: 1;sid: 2009292; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[BobSoft Mini Delphi -> BoB / BobSoft] binary file"; flow:established,to_server; content: "|558BEC83C4F0B8|";content: "|E8|"; distance: 9; within: 1;sid: 2009293; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[BopCrypt v1.0] binary file"; flow:established,to_server; content: "|60BD|";content: "|E8|"; distance: 4; within: 1;content: "|0000|"; distance: 2; within: 2;sid: 2009294; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CD-Cops II] binary file"; flow:established,to_server; content: "|5360BD|";content: "|8D45|"; distance: 5; within: 2;content: "|8D5D|"; distance: 2; within: 2;content: "|E8|"; distance: 2; within: 1;content: "|8D|"; distance: 3; within: 1;sid: 2009295; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CDS SS 1.0 beta1 -> CyberDoom] binary file"; flow:established,to_server; content: "|60E8000000005D81EDCA474000FF742420E8D30300000BC00F84130300008985B84E4000668CD8A804740CC7858C4E400001000000EB1264A1300000000FB640020AC00F85E80200008D85F64C400050FFB5B84E4000E8FC0300000BC00F84CE020000E81E0300008985904E40008D85034D400050FFB5B84E4000E8D70300000BC00F84A9020000E8F90200008985944E40008D85124D400050|";sid: 2009296; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CDS SS v1.0 Beta 1 -> CyberDoom / Team-X] binary file"; flow:established,to_server; content: "|60E8000000005D81EDCA474000FF742420E8D30300000BC00F84130300008985B84E4000668CD8A804740CC7858C4E400001000000EB1264A1300000000FB640020AC00F85E80200008D85F64C400050FFB5B84E4000E8FC0300000BC00F84CE020000E81E0300008985904E40008D85034D400050FFB5B8|";sid: 2009297; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Celsius Crypt 2.1 -> Z3r0] binary file"; flow:established,to_server; content: "|5589E583EC08C7042401000000FF1584924400E8C8FEFFFF908DB426000000005589E583EC08C7042402000000FF1584924400E8A8FEFFFF908DB42600000000558B0DC492440089E55DFFE18D742600558B0DAC92440089E55DFFE1909090905589E55DE977C20000909090909090905589E583EC288B4510890424E83F140100488945FC8B450C488945F48D45F4894424048D45FC890424E812A303008B008945F88B45FC8945F0C645EF01C745E8000000008B45E83B45F87339807DEF0074338B45F0894424048B4510890424E81C1A010089C18B45088B55E801C20FB6013A020F94C08845EF8D45F0FF088D45E8FF00EBBF837DF0007434807DEF00742E8B45F0894424048B4510890424E8DD19010089C18B45088B55F801C20FB6013A020F94C08845EF8D45F0FF08EBC6C7442404000000008B4510890424E8AE19010089C18B45088B55F801C20FB6013A027F0C0FB645EF83E0018845E7EB04C645E7000FB645E78845EF0FB645EFC9C3|";sid: 2009298; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CERBERUS v2.0] binary file"; flow:established,to_server; content: "|9C2BED8C|";content: "|8C|"; distance: 5; within: 1;content: "|FAE4|"; distance: 2; within: 2;content: "|88|"; distance: 2; within: 1;content: "|1607BF|"; distance: 2; within: 3;content: "|8EDD9BF5B9|"; distance: 4; within: 5;content: "|FCF3A5|"; distance: 6; within: 3;sid: 2009299; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CExe v1.0a] binary file"; flow:established,to_server; content: "|558BEC81EC0C02|";content: "|56BE0401|"; distance: 8; within: 4;content: "|8D85F8FEFFFF56506A|"; distance: 5; within: 9;content: "|FF15541040|"; distance: 9; within: 5;content: "|8A8DF8FEFFFF33D284C98D85F8FEFFFF7416|"; distance: 5; within: 18;sid: 2009300; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CHECKPRG (c) 1992] binary file"; flow:established,to_server; content: "|33C0BE|";content: "|8BD8B9|"; distance: 4; within: 3;content: "|BF|"; distance: 4; within: 1;content: "|BA|"; distance: 2; within: 1;content: "|474A74|"; distance: 2; within: 3;sid: 2009301; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ChSfx (small) v1.1] binary file"; flow:established,to_server; content: "|BA|";content: "|E8|"; distance: 2; within: 1;content: "|8BEC83EC|"; distance: 2; within: 4;content: "|8CC8BB|"; distance: 4; within: 3;content: "|B1|"; distance: 4; within: 1;content: "|D3EB03C38ED805|"; distance: 1; within: 7;content: "|89|"; distance: 8; within: 1;sid: 2009302; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CICompress v1.0] binary file"; flow:established,to_server; content: "|6A046800100000FF359C1440006A00FF1538104000A3FC10400097BE00204000E8710000003B059C14400075616A006A206A026A006A0368000000C06894104000FF152C104000A3F81040006A0068F4104000FF35|";sid: 2009303; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CipherWall Self-Extrator/Decryptor (Console) v1.5] binary file"; flow:established,to_server; content: "|9061BE001042008DBE0000FEFFC787C02002000B6E5B9B5783CDFFEB0E909090908A064688074701DB75078B1E83EEFC11DB72EDB80100000001DB75078B1E83EEFC11DB11C001DB73EF75098B1E83EEFC11DB73E4|";sid: 2009304; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CipherWall Self-Extrator/Decryptor (GUI) v1.5] binary file"; flow:established,to_server; content: "|9061BE001042008DBE0000FEFFC787C0200200F989C76A5783CDFFEB0E909090908A064688074701DB75078B1E83EEFC11DB72EDB80100000001DB75078B1E83EEFC11DB11C001DB73EF75098B1E83EEFC11DB73E4|";sid: 2009305; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Code-Lock vx.x] binary file"; flow:established,to_server; content: "|434F44452D4C4F434B2E4F435800|";sid: 2009306; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CodeCrypt v0.14b] binary file"; flow:established,to_server; content: "|E9C5020000EB02833D58EB02FF1D5BEB020FC75F|";sid: 2009307; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CodeCrypt v0.15b] binary file"; flow:established,to_server; content: "|E931030000EB02833D58EB02FF1D5BEB020FC75F|";sid: 2009308; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CodeCrypt v0.164] binary file"; flow:established,to_server; content: "|E92E030000EB02833D58EB02FF1D5BEB020FC75FEB03FF1D34|";sid: 2009309; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CodeCrypt v0.16b - v0.163b] binary file"; flow:established,to_server; content: "|E92E030000EB02833D58EB02FF1D5BEB020FC75F|";sid: 2009310; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[codeCrypter 0.31 -> Tibbar] binary file"; flow:established,to_server; content: "|5058535B90BB|";content: "|00FFE390CCCCCC558BEC5DC3CCCCCCCCCCCCCCCCCCCCCC|"; distance: 7; within: 23;sid: 2009311; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[COP v1.0 (c) 1988] binary file"; flow:established,to_server; content: "|BF|";content: "|BE|"; distance: 2; within: 1;content: "|B9|"; distance: 2; within: 1;content: "|AC32|"; distance: 2; within: 2;content: "|AAE2|"; distance: 3; within: 2;content: "|8B|"; distance: 2; within: 1;content: "|EB|"; distance: 2; within: 1;content: "|90|"; distance: 1; within: 1;sid: 2009312; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Copy Protector v2.0] binary file"; flow:established,to_server; content: "|2EA2|";content: "|5351521E06B4|"; distance: 3; within: 6;content: "|1E0E1FBA|"; distance: 6; within: 4;content: "|CD211F|"; distance: 5; within: 3;sid: 2009313; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CopyControl v3.03] binary file"; flow:established,to_server; content: "|CC9090EB0B0150515253546133612D35CAD10752D1A13C|";sid: 2009314; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CopyMinder -> Microcosm.Ltd] binary file"; flow:established,to_server; content: "|8325|";content: "|EF6A00E8|"; distance: 4; within: 4;content: "|E8|"; distance: 6; within: 1;content: "|CCFF25|"; distance: 3; within: 3;content: "|FF25|"; distance: 5; within: 2;content: "|FF25|"; distance: 4; within: 2;content: "|FF25|"; distance: 4; within: 2;content: "|FF25|"; distance: 4; within: 2;content: "|FF25|"; distance: 4; within: 2;content: "|FF25|"; distance: 4; within: 2;content: "|FF25|"; distance: 4; within: 2;content: "|FF25|"; distance: 4; within: 2;content: "|FF25|"; distance: 4; within: 2;content: "|FF25|"; distance: 4; within: 2;content: "|FF25|"; distance: 4; within: 2;content: "|FF25|"; distance: 4; within: 2;content: "|FF25|"; distance: 4; within: 2;content: "|FF25|"; distance: 4; within: 2;content: "|FF25|"; distance: 4; within: 2;content: "|FF25|"; distance: 4; within: 2;content: "|FF25|"; distance: 4; within: 2;sid: 2009315; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CPAV] binary file"; flow:established,to_server; content: "|E8|";content: "|4D5AB1019301000002|"; distance: 2; within: 9;sid: 2009316; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CrackStop v1.01 (c) Stefan Esser 1997] binary file"; flow:established,to_server; content: "|B448BBFFFFB9EB278BECCD21FAFC|";sid: 2009317; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CreateInstall Stub vx.x] binary file"; flow:established,to_server; content: "|558BEC81EC200200005356576A00FF15186140006800704000894508FF151461400085C074276A00A10020400050FF153C6140008BF06A0656FF15386140006A0356FF1538614000E93603000068027F000033F656|";sid: 2009318; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Crinkler V0.1-V0.2 -> Rune L.H.Stubbe and Aske Simon Christensen] binary file"; flow:established,to_server; content: "|B9|";content: "|01C068|"; distance: 3; within: 3;content: "|6A0058506A005F485DBB03000000BE|"; distance: 5; within: 15;content: "|E9|"; distance: 17; within: 1;sid: 2009319; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Crinkler V0.3-V0.4 -> Rune L.H.Stubbe and Aske Simon Christensen] binary file"; flow:established,to_server; content: "|B80000420031DB43EB58|";sid: 2009320; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Crunch v4.0] binary file"; flow:established,to_server; content: "|EB100000000000000000000000000000000055E8000000005D81ED180000008BC555609C2B85E90600008985E1060000FF74242CE8BB0100000F8292050000E8F1030000490F8886050000686CD9B29633C050E824|";sid: 2009321; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Crunch v5 -> Bit-Arts] binary file"; flow:established,to_server; content: "|EB1503000000060000000000000000000000680000000055E8000000005D81ED1D0000008BC555609C2B85FC0700008985E8070000FF74242CE8200200000F8294060000E8F3040000490F88880600008BB5E80700|";sid: 2009322; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Crunch/PE] binary file"; flow:established,to_server; content: "|55E8|";content: "|5D83ED068BC5556089AD|"; distance: 4; within: 10;content: "|2B85|"; distance: 12; within: 2;sid: 2009323; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Crunch/PE v1.0.x.x] binary file"; flow:established,to_server; content: "|55E8|";content: "|5D83ED068BC5556089AD|"; distance: 4; within: 10;content: "|2B85|"; distance: 12; within: 2;content: "|8985|"; distance: 4; within: 2;content: "|80BD|"; distance: 4; within: 2;content: "|7509C685|"; distance: 4; within: 4;sid: 2009324; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Crunch/PE v2.0.x.x] binary file"; flow:established,to_server; content: "|55E8|";content: "|5D83ED068BC5556089AD|"; distance: 4; within: 10;content: "|2B85|"; distance: 12; within: 2;content: "|8985|"; distance: 4; within: 2;content: "|55BB|"; distance: 4; within: 2;content: "|03DD536467FF36|"; distance: 4; within: 7;content: "|64678926|"; distance: 8; within: 4;sid: 2009325; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Crunch/PE v3.0.x.x] binary file"; flow:established,to_server; content: "|EB10|";content: "|55E8|"; distance: 10; within: 2;content: "|5D81ED18|"; distance: 4; within: 4;content: "|8BC555609C2B85|"; distance: 5; within: 7;content: "|8985|"; distance: 9; within: 2;content: "|FF74|"; distance: 4; within: 2;sid: 2009326; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Cruncher v1.0] binary file"; flow:established,to_server; content: "|2E|";content: "|2E|"; distance: 3; within: 1;content: "|B430CD213C0373|"; distance: 2; within: 7;content: "|BB|"; distance: 7; within: 1;content: "|8EDB8D|"; distance: 2; within: 3;content: "|B409CD210633C050CB|"; distance: 4; within: 9;sid: 2009327; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CrypKey v5 - v6] binary file"; flow:established,to_server; content: "|E8|";content: "|5883E805505F578BF781EF|"; distance: 3; within: 11;content: "|83C639BA|"; distance: 13; within: 4;content: "|8BDFB90B|"; distance: 6; within: 4;content: "|8B06|"; distance: 5; within: 2;sid: 2009328; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CrypKey V5.6.X -> Kenonic Controls Ltd.] binary file"; flow:established,to_server; content: "|E8|";content: "|E8|"; distance: 3; within: 1;content: "|83F80075076A00E8|"; distance: 3; within: 8;sid: 2009329; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CrypKey V5.6.X DLL -> Kenonic Controls Ltd.] binary file"; flow:established,to_server; content: "|8B1D|";content: "|83FB00750AE8|"; distance: 4; within: 6;content: "|E8|"; distance: 8; within: 1;sid: 2009330; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CrypKey V6.1X DLL -> CrypKey (Canada) Inc.] binary file"; flow:established,to_server; content: "|833D|";content: "|00753468|"; distance: 4; within: 4;content: "|E8|"; distance: 6; within: 1;sid: 2009331; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CRYPT Version 1.7 (c) Dismember] binary file"; flow:established,to_server; content: "|0E179C58F6|";content: "|74|"; distance: 6; within: 1;content: "|E9|"; distance: 1; within: 1;sid: 2009332; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Cryptic 2.0 -> Tughack] binary file"; flow:established,to_server; content: "|B800004000BB|";content: "|00B900100000BA|"; distance: 7; within: 7;content: "|0003D803C803D13BCA74068031|"; distance: 8; within: 13;content: "|41EBF6FFE3|"; distance: 13; within: 5;sid: 2009333; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Crypto-Lock v2.02 (Eng) -> Ryan Thian] binary file"; flow:established,to_server; content: "|60BE159040008DBEEB7FFFFF5783CDFFEB109090909090908A0646880747|";sid: 2009334; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Crypto-Lock v2.02 (Eng) -> Ryan Thian] binary file"; flow:established,to_server; content: "|60BE159040008DBEEB7FFFFF5783CDFFEB109090909090908A064688074701DB75078B1E83EEFC11DB72EDB80100000001DB75078B1E83EEFC11DB11C001DB73EF75098B1E83EEFC11DB73E431C983E803720DC1E0|";sid: 2009335; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Crypto-Lock v2.02 (Eng) -> Ryan Thian] binary file"; flow:established,to_server; content: "|60BE|";content: "|9040008DBE|"; distance: 2; within: 5;content: "|FFFF5783CDFFEB109090909090908A064688074701DB75078B1E83EEFC11DB72EDB80100000001DB75078B1E83EEFC11DB11C001DB73EF75098B1E83EEFC11DB73E431C983E803720DC1E0|"; distance: 6; within: 75;sid: 2009336; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CRYPToCRACk's PE Protector V0.9.2 -> Lukas Fleischer] binary file"; flow:established,to_server; content: "|E801000000E8585B81E300FFFFFF66813B4D5A753784DB75338BF303|";content: "|813E504500007526|"; distance: 29; within: 8;sid: 2009337; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CRYPToCRACk's PE Protector V0.9.3 -> Lukas Fleischer] binary file"; flow:established,to_server; content: "|5B81E300FFFFFF66813B4D5A75338BF303733C813E5045000075260FB746188BC869C0AD0B0000F7E02DAB5D414B69C9DEC0000003C1|";sid: 2009338; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[CrypWrap vx.x] binary file"; flow:established,to_server; content: "|E8B8|";content: "|E89002|"; distance: 3; within: 3;content: "|83F8|"; distance: 4; within: 2;content: "|75076A|"; distance: 2; within: 3;content: "|E8|"; distance: 3; within: 1;content: "|FF15498F40|"; distance: 3; within: 5;content: "|A9|"; distance: 5; within: 1;content: "|80740E|"; distance: 2; within: 3;sid: 2009339; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Cygwin32] binary file"; flow:established,to_server; content: "|5589E583EC04833D|";sid: 2009340; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[DAEMON Protect v0.6.7] binary file"; flow:established,to_server; content: "|60609C8CC932C9E30C520F014C24FE5A83C20C8B1A9D61|";sid: 2009341; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[DalKrypt 1.0 - by DalKiT] binary file"; flow:established,to_server; content: "|68001040005868|";content: "|005F33DBEB0D8A140380EA0780F2048814034381FB|"; distance: 8; within: 21;content: "|0072EBFFE7|"; distance: 22; within: 5;sid: 2009342; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[DBPE v1.53] binary file"; flow:established,to_server; content: "|9C5557565251539CFAE8|";content: "|5D81ED5B5340|"; distance: 12; within: 6;content: "|B0|"; distance: 6; within: 1;content: "|E8|"; distance: 1; within: 1;content: "|5E83C611B927|"; distance: 3; within: 6;content: "|3006464975FA|"; distance: 7; within: 6;sid: 2009343; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[DBPE v2.10] binary file"; flow:established,to_server; content: "|9C6A10730BEB02C151E806|";content: "|C41173F75BCD83C404EB0299EBFF0C247101E879E07A017583C4049DEB0175685F2040|"; distance: 12; within: 35;content: "|E8B0EFFFFF7203730175BE|"; distance: 35; within: 11;sid: 2009344; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[DBPE v2.10 -> Ding Boy] binary file"; flow:established,to_server; content: "|EB20|";content: "|9C5557565251539CE8|"; distance: 18; within: 9;content: "|5D81ED|"; distance: 11; within: 3;content: "|EB587573657233322E646C6C|"; distance: 5; within: 12;content: "|4D657373616765426F7841|"; distance: 12; within: 11;content: "|6B65726E656C|"; distance: 11; within: 6;sid: 2009345; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[DBPE v2.33 -> Ding Boy] binary file"; flow:established,to_server; content: "|EB20|";content: "|40|"; distance: 3; within: 1;content: "|9C5557565251539CE8|"; distance: 15; within: 9;content: "|5D81ED|"; distance: 11; within: 3;content: "|9C6A10730BEB02C151E806|"; distance: 5; within: 11;content: "|C41173F75BCD83C404EB0299EBFF0C2471|"; distance: 12; within: 17;sid: 2009346; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[DBPE vx.xx -> Ding Boy] binary file"; flow:established,to_server; content: "|EB20|";content: "|40|"; distance: 3; within: 1;content: "|9C5557565251539CE8|"; distance: 15; within: 9;content: "|5D81ED|"; distance: 11; within: 3;sid: 2009347; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[DCrypt Private 0.9b -> drmist] binary file"; flow:established,to_server; content: "|B9|";content: "|00E8000000005868|"; distance: 2; within: 8;content: "|0083E80B0F1800D00048E2FBC3|"; distance: 9; within: 13;sid: 2009348; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[DEF 1.0 -> bart/xt] binary file"; flow:established,to_server; content: "|BE|";content: "|40006A|"; distance: 2; within: 3;content: "|59807E070074118B460C05000040008B56103010404A75FA83C628E2E468|"; distance: 3; within: 30;content: "|4000C300000000000000000000000000000000000000000000000000000000000000000000000000000000000000|"; distance: 31; within: 46;sid: 2009349; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[DEF v1.0] binary file"; flow:established,to_server; content: "|BE|";content: "|0140006A0559807E070074118B46|"; distance: 1; within: 14;sid: 2009350; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[DEF v1.00 (Eng) -> bart/xt] binary file"; flow:established,to_server; content: "|BE|";content: "|0140006A|"; distance: 1; within: 4;content: "|59807E070074118B460C05000040008B56103010404A75FA83C628E2E468|"; distance: 4; within: 30;content: "|4000C300000000000000000000000000000000000000000000000000000000000000000000000000000000000000|"; distance: 31; within: 46;sid: 2009351; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[dePACK -> deNULL] binary file"; flow:established,to_server; content: "|EB01DD606800|";content: "|68|"; distance: 7; within: 1;content: "|0000E8|"; distance: 2; within: 3;content: "|000000|"; distance: 3; within: 3;sid: 2009352; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[dePACK -> deNULL] binary file"; flow:established,to_server; content: "|EB01DD606800|";content: "|68|"; distance: 7; within: 1;content: "|00E8|"; distance: 2; within: 2;content: "|000000|"; distance: 2; within: 3;content: "|D2|"; distance: 67; within: 1;sid: 2009353; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Dev-C++ 4.9.9.2 -> Bloodshed Software] binary file"; flow:established,to_server; content: "|5589E583EC08C7042401000000FF15|";content: "|00E8C8FEFFFF908DB426000000005589E583EC08C7042402000000FF15|"; distance: 16; within: 29;content: "|00E8A8FEFFFF908DB42600000000558B0D|"; distance: 30; within: 17;content: "|0089E55DFFE18D742600558B0D|"; distance: 18; within: 13;sid: 2009354; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIET v1.00, v1.00d] binary file"; flow:established,to_server; content: "|BF|";content: "|3BFC72|"; distance: 2; within: 3;content: "|B44CCD21BE|"; distance: 3; within: 5;content: "|B9|"; distance: 6; within: 1;content: "|FDF3A5FC|"; distance: 2; within: 4;sid: 2009355; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIET v1.00d] binary file"; flow:established,to_server; content: "|FC061E0E8CC801|";content: "|BA|"; distance: 8; within: 1;content: "|03|"; distance: 2; within: 1;content: "|00000000|"; distance: 8; within: 4;sid: 2009356; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIET v1.02b, v1.10a, v1.20] binary file"; flow:established,to_server; content: "|BE|";content: "|BF|"; distance: 2; within: 1;content: "|B9|"; distance: 2; within: 1;content: "|3BFC72|"; distance: 2; within: 3;content: "|B44CCD21FDF3A5FC|"; distance: 3; within: 8;sid: 2009357; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[DIET v1.44, v1.45f] binary file"; flow:established,to_server; content: "|F89C061E5756525153500EFC8CC8BA|";content: "|03D052|"; distance: 16; within: 3;sid: 2009358; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Ding Boy's PE-lock Phantasm v0.8] binary file"; flow:established,to_server; content: "|555756525153E8000000005D8BD581ED0D394000|";sid: 2009359; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Ding Boy's PE-lock Phantasm v1.0 / v1.1] binary file"; flow:established,to_server; content: "|5557565251536681C3EB02EBFC6681C3EB02EBFC|";sid: 2009360; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Ding Boy's PE-lock Phantasm v1.5b3] binary file"; flow:established,to_server; content: "|9C5557565251539CFAE8000000005D81ED5B534000B0|";sid: 2009361; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Ding Boy's PE-lock v0.07] binary file"; flow:established,to_server; content: "|555756525153E8000000005D8BD581ED23354000|";sid: 2009362; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[diPacker V1.X -> diProtector Software] binary file"; flow:established,to_server; content: "|0F002DE90100A0E3680100EB8C0000EB2B0000EB000020E01C108FE28E208FE20030A0E3670100EB0F00BDE800C08FE200F09CE5|";sid: 2009363; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[diProtector V1.X -> diProtector Software] binary file"; flow:established,to_server; content: "|0100A0E3140000EB000020E044109FE5032AA0E34030A0E3AE0000EB30008FE50020A0E13A0E8FE2000080E21C109FE520308FE20E0000EB14009FE514109FE57F20A0E3C50000EB04C08FE200F09CE5|";sid: 2009364; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[DJoin v0.7 public (RC4 encryption) -> drmist] binary file"; flow:established,to_server; content: "|C605|";content: "|400000C605|"; distance: 3; within: 5;content: "|400000|"; distance: 6; within: 3;content: "|00|"; distance: 7; within: 1;content: "|00|"; distance: 3; within: 1;content: "|00|"; distance: 3; within: 1;sid: 2009365; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[DJoin v0.7 public (xor encryption) -> drmist] binary file"; flow:established,to_server; content: "|C605|";content: "|400000|"; distance: 3; within: 3;content: "|00|"; distance: 7; within: 1;content: "|00|"; distance: 3; within: 1;content: "|00|"; distance: 3; within: 1;sid: 2009366; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[DotFix NiceProtect vna] binary file"; flow:established,to_server; content: "|60E8550000008DBD0010400068|";content: "|00033C248BF79068311040009BDBE355DB04248BC7DB442404DEC1DB1C248B1C2466AD51DB04249090DA8D77104000DB1C24D1E129|"; distance: 14; within: 53;sid: 2009367; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Dr.Web Virus-Finding Engine -> InSoft EDV-Systeme] binary file"; flow:established,to_server; content: "|B801000000C20C008D80000000008BD28B|";content: "|2404|"; distance: 17; within: 2;sid: 2009368; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[DSHIELD] binary file"; flow:established,to_server; content: "|06E8|";content: "|5E83EE|"; distance: 3; within: 3;content: "|16179C58B9|"; distance: 3; within: 5;content: "|25|"; distance: 6; within: 1;content: "|2E|"; distance: 2; within: 1;sid: 2009369; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Dual's eXe 1.0] binary file"; flow:established,to_server; content: "|558BEC81EC00050000E8000000005D81ED0E0000008D8508030000892833FF8D857D0200008D8D080300002BC88B9D58030000E81C0200008D9D610200008DB57C02000046803E00742456FF950A04000046803E00|";sid: 2009370; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Dual's eXe Encryptor 1.0b -> Dual] binary file"; flow:established,to_server; content: "|558BEC81EC00050000E8000000005D81ED0E0000008D853A040000892833FF8D85800300008D8D3A0400002BC88B9D8A040000E8240200008D9D580300008DB57F03000046803E00742456FF955805000046803E0075FA46803E0074E7505650FF955C05000089035883C304EBE38D8569020000FFD08D855604000050681F0002006A008D857A04000050|";sid: 2009371; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[dUP2 -> diablo2oo2] binary file"; flow:established,to_server; content: "|E8|";content: "|E8|"; distance: 3; within: 1;content: "|8BF06A0068|"; distance: 3; within: 5;content: "|56E8|"; distance: 7; within: 2;content: "|A2|"; distance: 4; within: 1;content: "|6A0068|"; distance: 3; within: 3;content: "|56E8|"; distance: 5; within: 2;content: "|A2|"; distance: 4; within: 1;content: "|6A0068|"; distance: 3; within: 3;content: "|56E8|"; distance: 5; within: 2;content: "|A2|"; distance: 4; within: 1;content: "|68|"; distance: 3; within: 1;content: "|68|"; distance: 3; within: 1;content: "|56E8|"; distance: 3; within: 2;content: "|3C017519BE|"; distance: 4; within: 5;content: "|68000200005668|"; distance: 7; within: 7;sid: 2009372; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[DxPack 1.0] binary file"; flow:established,to_server; content: "|60E8|";content: "|5D8BFD81ED|"; distance: 4; within: 5;content: "|2BB9|"; distance: 7; within: 2;content: "|81EF|"; distance: 4; within: 2;content: "|83BD|"; distance: 4; within: 2;content: "|0F84|"; distance: 4; within: 2;sid: 2009373; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[DxPack V0.86 -> Dxd] binary file"; flow:established,to_server; content: "|60E8000000005D8BFD81ED061040002BBD9412400081EF0600000083BD14134000010F842F010000|";sid: 2009374; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[E language] binary file"; flow:established,to_server; content: "|E80600000050E8|";content: "|010000558BEC81C4F0FEFFFF|"; distance: 7; within: 12;sid: 2009375; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[E.You.Di.Dai-> YueHeiFengGao] binary file"; flow:established,to_server; content: "|558BECB8|";content: "|E8|"; distance: 6; within: 1;content: "|5356570F318BD80F318BD02BD3C1EA10B8|"; distance: 3; within: 17;content: "|0F6EC0B8|"; distance: 19; within: 4;content: "|0F6EC80FF5C10F7EC00F7703C2|"; distance: 6; within: 13;content: "|FFE0|"; distance: 15; within: 2;sid: 2009376; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[E2C by DoP] binary file"; flow:established,to_server; content: "|BE|";content: "|BF|"; distance: 2; within: 1;content: "|B9|"; distance: 2; within: 1;content: "|FC57F3A5C3|"; distance: 2; within: 5;sid: 2009377; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EEXE Version 1.12] binary file"; flow:established,to_server; content: "|B430CD213C0373|";content: "|BA1F000E1FB409CD21B8FF4CCD21|"; distance: 7; within: 14;sid: 2009378; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Embed PE v1.13 -> cyclotron] binary file"; flow:established,to_server; content: "|83EC5060685DB9525AE82F990000DC99F3570568|";sid: 2009379; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EmbedPE 1.13 -> cyclotron] binary file"; flow:established,to_server; content: "|83EC5060685DB9525AE82F990000DC99F3570568B85E2DC6DAFD4863053C71B85E977C367E327C084F06516410A3F14ECF25CB80D2995446EDE1D346862D106893835C464D439B8CD67CBB996997712A2FA3386B33|";sid: 2009380; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EmbedPE v1.24 -> cyclotron] binary file"; flow:established,to_server; content: "|83EC506068|";content: "|E8CBFF0000|"; distance: 7; within: 5;sid: 2009381; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EmbedPE V1.X -> cyclotron] binary file"; flow:established,to_server; content: "|83EC506068|";content: "|E8|"; distance: 7; within: 1;content: "|0000|"; distance: 2; within: 2;sid: 2009382; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EncryptPE 1.2003.3.18-1.2003.5.18 -> WFS] binary file"; flow:established,to_server; content: "|609C64FF3500000000E879010000000000000000000000000000|";content: "|0000000000000000000000000000000000000000|"; distance: 30; within: 20;content: "|000000006B65726E656C33322E646C6C00000047657453797374656D4469726563746F72794100000043726561746546696C654100000043726561746546696C654D617070696E67410000004D6170566965774F6646696C65000000556E6D6170566965774F6646696C65000000436C6F736548616E646C650000004C6F61644C6962726172794100000047657450726F63416464726573730000004578697450726F63657373|"; distance: 38; within: 167;sid: 2009383; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EncryptPE 1.2003.5.18 -> WFS] binary file"; flow:established,to_server; content: "|609C64FF3500000000E879|";sid: 2009384; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EncryptPE 2.2004.6.16-2.2006.6.30 -> WFS] binary file"; flow:established,to_server; content: "|609C64FF3500000000E87A010000000000000000000000000000|";content: "|0000000000000000000000000000000000000000|"; distance: 30; within: 20;content: "|000000006B65726E656C33322E646C6C00000047657453797374656D4469726563746F72794100000043726561746546696C654100000043726561746546696C654D617070696E67410000004D6170566965774F6646696C65000000556E6D6170566965774F6646696C65000000436C6F736548616E646C650000004C6F61644C6962726172794100000047657450726F63416464726573730000004578697450726F63657373|"; distance: 38; within: 167;sid: 2009385; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EncryptPE 2.2004.8.10 - 2.2005.3.14 -> WFS] binary file"; flow:established,to_server; content: "|609C64FF3500000000E87A|";sid: 2009386; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EncryptPE 2.2006.7.10-2.2006.10.25 -> WFS] binary file"; flow:established,to_server; content: "|609C64FF3500000000E873010000000000000000000000000000|";content: "|0000000000000000000000000000000000000000|"; distance: 30; within: 20;content: "|000000006B65726E656C33322E646C6C00000047657454656D70506174684100000043726561746546696C654100000043726561746546696C654D617070696E67410000004D6170566965774F6646696C65000000556E6D6170566965774F6646696C65000000436C6F736548616E646C650000004C6F61644C6962726172794100000047657450726F63416464726573730000004578697450726F63657373|"; distance: 38; within: 160;sid: 2009387; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EncryptPE V2.2006.7.10 -> WFS] binary file"; flow:established,to_server; content: "|609C64FF3500000000E873010000|";sid: 2009388; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EncryptPE V2.2006.7.10 -> WFS] binary file"; flow:established,to_server; content: "|609C64FF3500000000E873010000000000000000000000000000|";content: "|0000000000000000000000000000000000000000|"; distance: 30; within: 20;content: "|000000006B65726E656C33322E646C6C00000047657454656D70506174684100000043726561746546696C654100000043726561746546696C654D617070696E67410000004D6170566965774F6646696C65000000556E6D6170566965774F6646696C65000000436C6F736548616E646C650000004C6F61644C6962726172794100000047657450726F63416464726573730000004578697450726F6365737300000000|"; distance: 38; within: 164;sid: 2009389; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EncryptPE V2.2007.04.11 -> WFS] binary file"; flow:established,to_server; content: "|609C64FF3500000000E81B020000000000000000000000000000|";content: "|0000000000000000000000000000000000000000|"; distance: 30; within: 20;content: "|000000006B65726E656C33322E646C6C00000047657454656D70506174684100000043726561746546696C654100000043726561746546696C654D617070696E67410000004D6170566965774F6646696C65000000556E6D6170566965774F6646696C65000000436C6F736548616E646C650000004C6F61644C6962726172794100000047657450726F63416464726573730000004578697450726F63657373|"; distance: 38; within: 160;sid: 2009390; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EncryptPE V2.2007.4.11 -> WFS] binary file"; flow:established,to_server; content: "|609C64FF3500000000E81B020000000000000000000000000000|";content: "|0000000000000000000000000000000000000000|"; distance: 30; within: 20;content: "|000000006B65726E656C33322E646C6C00000047657454656D70506174684100000043726561746546696C654100000043726561746546696C654D617070696E67410000004D6170566965774F6646696C65000000556E6D6170566965774F6646696C65000000436C6F736548616E646C650000004C6F61644C6962726172794100000047657450726F63416464726573730000004578697450726F63657373000000000000|"; distance: 38; within: 166;sid: 2009391; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Enigma Protector 1.31 Build 20070615 Dll -> Sukhov Vladimir & Serge N. Markin] binary file"; flow:established,to_server; content: "|60E8000000005D81ED0600000081ED|";content: "|E949000000|"; distance: 17; within: 5;content: "|0000000000000000000000000000000000000000000000000000000000000000008A84242800000080F8010F8407000000B8|"; distance: 25; within: 50;content: "|FFE0E904000000|"; distance: 52; within: 7;content: "|B8|"; distance: 9; within: 1;content: "|03C581C0|"; distance: 3; within: 4;content: "|B9|"; distance: 6; within: 1;content: "|BA|"; distance: 3; within: 1;content: "|301040490F85F6FFFFFFE904000000|"; distance: 3; within: 15;sid: 2009392; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ENIGMA Protector V1.1-> Sukhov Vladimir] binary file"; flow:established,to_server; content: "|60E8000000005D83|";content: "|81|"; distance: 9; within: 1;sid: 2009393; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ENIGMA Protector V1.1-V1.2-> Sukhov Vladimir] binary file"; flow:established,to_server; content: "|60E8000000005D83ED0681|";sid: 2009394; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Enigma Protector v1.12 LITE] binary file"; flow:established,to_server; content: "|60E8000000005D83ED0681ED|";content: "|00|"; distance: 13; within: 1;content: "|E8010000009A83C404EB02FF3560E8240000000000FFEB02CD208B44240C8380B80000000331|"; distance: 16; within: 38;sid: 2009395; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ENIGMA Protector V1.12-> Sukhov Vladimir] binary file"; flow:established,to_server; content: "|60E8000000005D83C5FA81ED|";content: "|00|"; distance: 13; within: 1;content: "|E8010000009A83C404EB02FF3560E8240000000000FFEB02CD208B44240C8380B80000000331|"; distance: 16; within: 38;sid: 2009396; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EP v1.0] binary file"; flow:established,to_server; content: "|5083C0178BF09733C033C9B124AC86C4ACAA86C4AAE2F600B8400003003C40D2338B661450708B8D3402448B1810487003BA0C|";content: "|C033FE8B30AC30D0C1F010C2D030F030C2C1AA104242CAC1E2045FE95EB1|"; distance: 53; within: 30;sid: 2009397; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EPW v1.2] binary file"; flow:established,to_server; content: "|06571E5655525153502E|";content: "|8CC005|"; distance: 12; within: 3;content: "|2E|"; distance: 4; within: 1;content: "|8ED8A1|"; distance: 2; within: 3;content: "|2E|"; distance: 4; within: 1;sid: 2009398; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EPW v1.30] binary file"; flow:established,to_server; content: "|06571E5655525153502E8C0608008CC083C0102E|";sid: 2009399; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Escargot 0.1 (final) -> ++Meat] binary file"; flow:established,to_server; content: "|EB0440302E31606861|";content: "|64FF350000000064892500000000B892|"; distance: 10; within: 16;content: "|8B00FFD050B8CD|"; distance: 17; within: 7;content: "|8138DEC03713752D68C9|"; distance: 8; within: 10;content: "|6A406800|"; distance: 11; within: 4;content: "|0000680000|"; distance: 4; within: 5;content: "|B896|"; distance: 6; within: 2;content: "|8B00FFD08B4424F08B4C24F4EB0549C60401400BC975F7BE0010|"; distance: 3; within: 26;content: "|B900|"; distance: 27; within: 2;content: "|00EB0549803431400BC975F7580BC0740833C0C700DEC0AD0BBE|"; distance: 3; within: 26;content: "|E9AC0000008B460CBB0000|"; distance: 28; within: 11;content: "|03C35050|"; distance: 12; within: 4;sid: 2009400; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Escargot V0.1 -> ++Meat] binary file"; flow:established,to_server; content: "|EB0440302E31606861|";sid: 2009401; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Excalibur 1.03 -> forgot] binary file"; flow:established,to_server; content: "|E90000000060E8140000005D81ED00000000|";sid: 2009402; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Excalibur V1.03 -> forgot] binary file"; flow:established,to_server; content: "|E90000000060E8140000005D81ED000000006A45E8A30000006800000000E85861EB39|";sid: 2009403; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[eXcalibur v1.03 -> forgot/us] binary file"; flow:established,to_server; content: "|E90000000060E8140000005D81ED000000006A45E8A30000006800000000E85861EB3920457863616C696275722028632920627920666F72676F742F75532F44464347202020202020202020202020202020202020|";sid: 2009404; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Exe Guarder v1.8 -> Exeicon.com] binary file"; flow:established,to_server; content: "|558BEC83C4D05356578D75FC8B442430250000FFFF81384D5A900074072D00100000EBF18945FCE8C8FFFFFF2DB20400008945F48B068B403C03068B407803068BC88B512003168B5924031E895DF08B591C031E89|";sid: 2009405; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXE joiner -> Amok] binary file"; flow:established,to_server; content: "|A114A14000C1E002A318A140|";sid: 2009406; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Exe Locker 1.0 -> IonIce] binary file"; flow:established,to_server; content: "|E800000000608B6C242081ED05000000|";sid: 2009407; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Exe Locker v1.0 --> IonIce] binary file"; flow:established,to_server; content: "|E800000000608B6C242081ED050000003E8F856C0000003E8F85680000003E8F85640000003E8F85600000003E8F855C0000003E8F85580000003E8F85540000|";sid: 2009408; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXE Manager Version 3.0 1994 (c) Solar Designer] binary file"; flow:established,to_server; content: "|B4301E06CD212E|";content: "|BF|"; distance: 8; within: 1;content: "|B9|"; distance: 2; within: 1;content: "|33C02E|"; distance: 2; within: 3;content: "|47E2|"; distance: 4; within: 2;sid: 2009409; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXE Packer v7.0 by TurboPower Software] binary file"; flow:established,to_server; content: "|1E068CC383|";content: "|2E|"; distance: 6; within: 1;content: "|B9|"; distance: 3; within: 1;content: "|8CC88ED88BF14E8BFE|"; distance: 2; within: 9;sid: 2009410; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXE Shield v0.1b - v0.3b, v0.3 -> SMoKE] binary file"; flow:established,to_server; content: "|E8040000008360EB0C5DEB05|";sid: 2009411; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXE Shield V0.5 -> Smoke] binary file"; flow:established,to_server; content: "|E8040000008360EB0C5DEB054555EB04B8EBF900C3E8000000005D81EDBC1A4000EB01008DB5461B4000BAB30A0000EB01008D8DF92540008B09E81400000083EB01008BFEE8000000005883C00750C300EB045840|";sid: 2009412; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXE Shield V0.5 -> Smoke] binary file"; flow:established,to_server; content: "|E8040000008360EB0C5DEB054555EB04B8EBF900C3E8000000005D81EDBC1A4000EB01008DB5461B4000BAB30A0000EB01008D8DF92540008B09E81400000083EB01008BFEE8000000005883C00750C300EB04584050C38A0646EB0100D0C8E81400000083EB01002AC2E8000000005B83C30753C300EB045B4353C3EB010032C2E80B0000000032C1EB0100C0C002EB092AC25BEB01004353C38807EB0100474A75B490|";sid: 2009413; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXE Shield V0.6 -> SMoKE] binary file"; flow:established,to_server; content: "|E8040000008360EB0C5DEB054555EB04B8EBF900C3E8000000005D81EDD41A4000EB01008DB55E1B4000BAA10B0000EB01008D8DFF2640008B09E81400000083EB01008BFEE8000000005883C00750C300EB045840|";sid: 2009414; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXE Shield V0.6 -> SMoKE] binary file"; flow:established,to_server; content: "|E8040000008360EB0C5DEB054555EB04B8EBF900C3E8000000005D81EDD41A4000EB01008DB55E1B4000BAA10B0000EB01008D8DFF2640008B09E81400000083EB01008BFEE8000000005883C00750C300EB04584050C38A0646EB0100D0C8E81400000083EB01002AC2E8000000005B83C30753C300EB045B4353C3EB010032C2E80B0000000032C1EB0100C0C002EB092AC25BEB01004353C38807EB0100474A75B490|";sid: 2009415; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Exe Shield v1.7] binary file"; flow:established,to_server; content: "|EB0668901F0600C39C60E80200000033C08BC483C004938BE38B5BFC81EB3F90|";sid: 2009416; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Exe Shield v2.7] binary file"; flow:established,to_server; content: "|EB0668F4860600C39C60E8020000|";sid: 2009417; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Exe Shield v2.7b] binary file"; flow:established,to_server; content: "|EB066840850600C39C60E80200000033C08BC483C004938BE38B5BFC81EB3F90400087DD8B85E690400001853390400066C7853090400090900185DA9040000185DE9040000185E2904000BB7B110000039DEA9040|";sid: 2009418; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Exe Shield v2.9] binary file"; flow:established,to_server; content: "|60E8000000005D81ED0B204000B9EB0800008DBD532040008BF7AC|";content: "|F8|"; distance: 28; within: 1;sid: 2009419; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Exe Shield vx.x] binary file"; flow:established,to_server; content: "|65786573686C2E646C6CC05D00|";sid: 2009420; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Exe Stealth 2.75a -> WebtoolMaster] binary file"; flow:established,to_server; content: "|EB585368617265776172652D56657273696F6E20457865537465616C74682C20636F6E7461637420737570706F727440776562746F6F6C6D61737465722E636F6D202D207777772E776562746F6F6C6D6173746572|";sid: 2009421; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXE Stealth v1.1] binary file"; flow:established,to_server; content: "|60E8000000005D81EDFB1D4000B97B0900008BF7AC|";sid: 2009422; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXE Stealth v2.7] binary file"; flow:established,to_server; content: "|EB0060EB00E8000000005D81EDD32640|";sid: 2009423; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXE Stealth v2.71] binary file"; flow:established,to_server; content: "|EB0060EB00E8000000005D81EDB02740|";sid: 2009424; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXE Stealth v2.72] binary file"; flow:established,to_server; content: "|EB00EB2F536861726577617265202D20|";sid: 2009425; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXE Stealth v2.74 -> WebToolMaster] binary file"; flow:established,to_server; content: "|EB00EB17|";content: "|6090E8000000005D|"; distance: 15; within: 8;sid: 2009426; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXE Stealth v2.76 -> WebToolMaster] binary file"; flow:established,to_server; content: "|EB65457865537465616C7468205632202D207777772E776562746F6F6C6D61737465722E636F6D20594F55522041442048455245215069524143592069532041|";sid: 2009427; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXE32Pack v1.36] binary file"; flow:established,to_server; content: "|3BC074028183553BC074028183533BC97401BC|";content: "|0281|"; distance: 21; within: 2;content: "|3BDB7401BE5D8BD581EDCC8D40|"; distance: 5; within: 13;sid: 2009428; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXE32Pack v1.37] binary file"; flow:established,to_server; content: "|3BC074028183553BC074028183533BC97401BC|";content: "|0281|"; distance: 21; within: 2;content: "|3BDB7401BE5D8BD581ED4C8E40|"; distance: 5; within: 13;sid: 2009429; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXE32Pack v1.38] binary file"; flow:established,to_server; content: "|3BC074028183553BC074028183533BC97401BC|";content: "|0281|"; distance: 21; within: 2;content: "|3BDB7401BE5D8BD581EDDC8D40|"; distance: 5; within: 13;sid: 2009430; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXE32Pack v1.39] binary file"; flow:established,to_server; content: "|3BC074028183553BC074028183533BC97401BC|";content: "|0281|"; distance: 21; within: 2;content: "|3BDB7401BE5D8BD581EDEC8D40|"; distance: 5; within: 13;sid: 2009431; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXE32Pack v1.3x] binary file"; flow:established,to_server; content: "|3B|";content: "|74028183553B|"; distance: 1; within: 6;content: "|740281|"; distance: 6; within: 3;content: "|533B|"; distance: 3; within: 2;content: "|7401|"; distance: 2; within: 2;content: "|0281|"; distance: 4; within: 2;content: "|E8|"; distance: 3; within: 1;content: "|3B7401|"; distance: 3; within: 3;content: "|5D8BD581ED|"; distance: 3; within: 5;sid: 2009432; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ExeBundle v3.0 (small loader)] binary file"; flow:established,to_server; content: "|0000000060BE00F040008DBE0020FFFF5783CDFFEB109090909090908A064688074701DB75078B1E83EEFC11DB72EDB80100000001DB75078B1E83EEFC11|";sid: 2009433; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ExeBundle v3.0 (standard loader)] binary file"; flow:established,to_server; content: "|0000000060BE00B042008DBE0060FDFFC787B0E40200313C4BDF5783CDFFEB0E909090908A064688074701DB75078B1E83EEFC11DB72EDB80100000001DB|";sid: 2009434; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXECrypt 1.0 -> ReBirth] binary file"; flow:established,to_server; content: "|909060E8000000005D81EDD1274000B91500000083C10483C101EB05EBFE83C756EB00EB0083E90281C178432765EB0081C11025940081E963850000B9960C0000908DBD4E2840008BF7AC|";sid: 2009435; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h1)] binary file"; flow:established,to_server; content: "|E8F7FEFFFF05|";content: "|0000FFE0E8EBFEFFFF05|"; distance: 7; within: 10;content: "|0000FFE0E804000000FFFFFFFF5EC3|"; distance: 11; within: 15;sid: 2009436; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h2)] binary file"; flow:established,to_server; content: "|E8F7FEFFFF05|";content: "|0000FFE0E8EBFEFFFF05|"; distance: 7; within: 10;content: "|0000FFE0E8|"; distance: 11; within: 5;content: "|000000|"; distance: 5; within: 3;sid: 2009437; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXECryptor 2.2.6 (minimum protection)] binary file"; flow:established,to_server; content: "|5068|";content: "|5881E0|"; distance: 4; within: 3;content: "|E9|"; distance: 5; within: 1;content: "|00870C2459E8|"; distance: 2; within: 6;content: "|008945F8E9|"; distance: 7; within: 5;content: "|0F83|"; distance: 7; within: 2;content: "|00E9|"; distance: 3; within: 2;content: "|8714245A5768|"; distance: 4; within: 6;content: "|E9|"; distance: 8; within: 1;content: "|5881C0|"; distance: 3; within: 3;content: "|2B05|"; distance: 5; within: 2;content: "|81C8|"; distance: 4; within: 2;content: "|81E0|"; distance: 4; within: 2;content: "|E9|"; distance: 4; within: 1;content: "|00C3E9|"; distance: 2; within: 3;content: "|C3BF|"; distance: 5; within: 2;content: "|81CB|"; distance: 4; within: 2;content: "|BA|"; distance: 4; within: 1;content: "|52E9|"; distance: 3; within: 2;content: "|00E8|"; distance: 3; within: 2;content: "|00E9|"; distance: 3; within: 2;content: "|00E9|"; distance: 3; within: 2;content: "|8734245E668B006625|"; distance: 4; within: 9;content: "|E9|"; distance: 10; within: 1;content: "|8BCD870C248BEC5189EC5D8B05|"; distance: 3; within: 13;content: "|09C0E9|"; distance: 15; within: 3;content: "|5981C1|"; distance: 5; within: 3;content: "|C1C1|"; distance: 5; within: 2;content: "|230D|"; distance: 2; within: 2;content: "|81F9|"; distance: 4; within: 2;content: "|E9|"; distance: 4; within: 1;content: "|C3E9|"; distance: 3; within: 2;content: "|0013D00BF9E9|"; distance: 3; within: 6;content: "|51E8|"; distance: 8; within: 2;content: "|8B64240831C0648F05000000005AE9|"; distance: 4; within: 15;content: "|3CA40F85|"; distance: 17; within: 4;content: "|008B45FC668138|"; distance: 5; within: 7;content: "|0F8405000000E9|"; distance: 8; within: 7;content: "|0F84|"; distance: 9; within: 2;content: "|E9|"; distance: 4; within: 1;content: "|873C245F31DB31C931D268|"; distance: 3; within: 11;content: "|E9|"; distance: 13; within: 1;content: "|8945FC33C08945F4837DFC00E9|"; distance: 3; within: 13;content: "|53528BD187142481C0|"; distance: 15; within: 9;content: "|0F88|"; distance: 11; within: 2;content: "|3BCB|"; distance: 4; within: 2;sid: 2009438; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXECryptor 2.2.6 DLL (minimum protection)] binary file"; flow:established,to_server; content: "|508BC687042468|";content: "|5EE9|"; distance: 9; within: 2;content: "|85C8E9|"; distance: 4; within: 3;content: "|81C3|"; distance: 5; within: 2;content: "|0F81|"; distance: 4; within: 2;content: "|0081FA|"; distance: 3; within: 3;content: "|33D0E9|"; distance: 5; within: 3;content: "|000F8D|"; distance: 4; within: 3;content: "|0081D5|"; distance: 4; within: 3;content: "|F7D10B15|"; distance: 5; within: 4;content: "|C1C2|"; distance: 6; within: 2;content: "|81C2|"; distance: 2; within: 2;content: "|9DE9|"; distance: 4; within: 2;content: "|C1E2|"; distance: 4; within: 2;content: "|C1E8|"; distance: 2; within: 2;content: "|81EA|"; distance: 2; within: 2;content: "|13DA81E9|"; distance: 4; within: 4;content: "|8704248BC8E9|"; distance: 6; within: 6;content: "|558BEC83C4F88945FC8B45FC8945F88B4508E9|"; distance: 8; within: 19;content: "|8B45E0C60000FF45E4E9|"; distance: 21; within: 10;content: "|FF45E4E9|"; distance: 12; within: 4;content: "|00F7D30F81|"; distance: 5; within: 5;content: "|E9|"; distance: 7; within: 1;content: "|8734245E8B45F4E8|"; distance: 3; within: 8;content: "|008B45F48BE55DC3E9|"; distance: 9; within: 9;sid: 2009439; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXECryptor 2.3.9 (compressed resources)] binary file"; flow:established,to_server; content: "|5168|";content: "|5981F1123CCB98E9532C0000F7D7E9EB6000008345F802E9E3360000F645F8200F841E21000055E980620000870C248BE9|"; distance: 4; within: 49;content: "|000023C181E9|"; distance: 51; within: 6;content: "|57E9ED0000000F88|"; distance: 8; within: 8;content: "|E92C0D000081EDBB43CB79C1E01CE99E1400000B15|"; distance: 10; within: 21;content: "|81E22A707F4981C29D83123BE80C500000E9A0160000595BC364FF350000000064892500000000E841420000E99333000031DB89D8595BC3A1|"; distance: 23; within: 57;content: "|8A002C99E9823000000F8A|"; distance: 59; within: 11;content: "|B80100000031D20FA225FF0F0000E9722100000F86570B0000E9|"; distance: 13; within: 26;content: "|C1C003E8F0360000E9410A000081F7B36E85EA81C7|"; distance: 28; within: 21;content: "|873C24E9745200000F8E|"; distance: 23; within: 10;content: "|E85E37000068B17496135AE9A104000081D149C01227E9504E0000C1C81B1BC381E19636E5|"; distance: 12; within: 37;sid: 2009440; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXECryptor 2.3.9 (minimum protection)] binary file"; flow:established,to_server; content: "|68|";content: "|E9|"; distance: 3; within: 1;content: "|FF50C1C8188905|"; distance: 2; within: 7;content: "|C3C1C01851E9|"; distance: 9; within: 6;content: "|FF84C00F846AF9FFFFE9|"; distance: 7; within: 10;content: "|FFC3E9|"; distance: 11; within: 3;content: "|FFE8CFE9FFFFB801000000E9|"; distance: 4; within: 12;content: "|FF2BD068A03680D45981C96498FF99E9|"; distance: 13; within: 16;content: "|FF84C00F848EECFFFFE9|"; distance: 17; within: 10;content: "|FFC3873C245F8B000345FC83C018E9|"; distance: 11; within: 15;content: "|FF870C2459B801000000D3E023D0E9021800000F8DDB000000C1E814E9CA0000009D870C2459871C2468AE73B996E9C51000000F8A|"; distance: 16; within: 53;content: "|E9|"; distance: 55; within: 1;content: "|FF81FDF5FF8F07E94F100000C3E95E120000873C24E9|"; distance: 2; within: 22;content: "|FFE8|"; distance: 23; within: 2;content: "|FF833D|"; distance: 3; within: 3;content: "|000F85|"; distance: 5; within: 3;content: "|8D55ECB8|"; distance: 5; within: 4;content: "|E9|"; distance: 6; within: 1;content: "|FFE8A71A0000E82ACBFFFFE9|"; distance: 2; within: 12;content: "|FFC3E9|"; distance: 13; within: 3;content: "|FF598945E0|"; distance: 4; within: 5;sid: 2009441; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXECryptor 2.3.9 DLL (compressed resources)] binary file"; flow:established,to_server; content: "|5068|";content: "|58C1C00FE9|"; distance: 4; within: 5;content: "|00870424588945FCE9|"; distance: 6; within: 9;content: "|FFFF05|"; distance: 10; within: 3;content: "|E9|"; distance: 5; within: 1;content: "|00C1C318E9|"; distance: 2; within: 5;content: "|8B55080942F8E9|"; distance: 7; within: 7;content: "|FF837DF0010F85|"; distance: 8; within: 7;content: "|E9|"; distance: 9; within: 1;content: "|008734245E8B45FC33D2568BF2E9|"; distance: 2; within: 14;content: "|00BA|"; distance: 15; within: 2;content: "|E8|"; distance: 4; within: 1;content: "|00A3|"; distance: 2; within: 2;content: "|C3E9|"; distance: 4; within: 2;content: "|00C383C404C3E9|"; distance: 3; within: 7;content: "|FF64FF350000000064892500000000E8|"; distance: 8; within: 16;content: "|00E9|"; distance: 17; within: 2;content: "|FFC1C20381CA|"; distance: 3; within: 6;content: "|81C2|"; distance: 8; within: 2;content: "|03C25AE9|"; distance: 4; within: 4;content: "|FF81E7|"; distance: 5; within: 3;content: "|81EF|"; distance: 5; within: 2;content: "|81C7|"; distance: 4; within: 2;content: "|8907E9|"; distance: 4; within: 3;content: "|0F89|"; distance: 5; within: 2;content: "|8714245A50C1C810|"; distance: 4; within: 8;sid: 2009442; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXECryptor 2.3.9 DLL (minimum protection)] binary file"; flow:established,to_server; content: "|5168|";content: "|872C248BCD5D81E1|"; distance: 4; within: 8;content: "|E9|"; distance: 10; within: 1;content: "|008945F85168|"; distance: 2; within: 6;content: "|5981F1|"; distance: 8; within: 3;content: "|0B0D|"; distance: 5; within: 2;content: "|81E9|"; distance: 4; within: 2;content: "|E9|"; distance: 4; within: 1;content: "|0081C2|"; distance: 2; within: 3;content: "|E8|"; distance: 5; within: 1;content: "|00870C245951648B05300000008B400C8B400CE9|"; distance: 2; within: 20;content: "|00F7D62BD5E9|"; distance: 21; within: 6;content: "|00873C248BCF5F8714241BCAE9|"; distance: 7; within: 13;content: "|0083C40868|"; distance: 14; within: 5;content: "|E9|"; distance: 7; within: 1;content: "|00C3E9|"; distance: 2; within: 3;content: "|00E9|"; distance: 4; within: 2;content: "|00508BC58704248BEC510F88|"; distance: 3; within: 12;content: "|00FF05|"; distance: 13; within: 3;content: "|E9|"; distance: 5; within: 1;content: "|00870C245999030424E9|"; distance: 2; within: 10;content: "|00C381D5|"; distance: 11; within: 4;content: "|9CE9|"; distance: 6; within: 2;content: "|0081FA|"; distance: 3; within: 3;content: "|E9|"; distance: 5; within: 1;content: "|00C1C31581CB|"; distance: 2; within: 6;content: "|81F3|"; distance: 8; within: 2;content: "|81C3|"; distance: 4; within: 2;content: "|87|"; distance: 4; within: 1;sid: 2009443; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXECryptor v1.3.0.45] binary file"; flow:established,to_server; content: "|E8240000008B4C240CC70117000100C781|";content: "|31C089411489411880A1|"; distance: 20; within: 10;sid: 2009444; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXECryptor v1.3.0.45] binary file"; flow:established,to_server; content: "|E824|";content: "|8B4C240CC70117|"; distance: 3; within: 7;content: "|01|"; distance: 7; within: 1;content: "|C781|"; distance: 1; within: 2;content: "|31C089411489411880A1|"; distance: 5; within: 10;sid: 2009445; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXECryptor v1.4.0.1] binary file"; flow:established,to_server; content: "|E8240000008B4C240CC70117000100C781B800000000|";content: "|0031C089411489411880|"; distance: 23; within: 10;sid: 2009446; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXECryptor v1.5.1.x] binary file"; flow:established,to_server; content: "|E824|";content: "|8B4C240CC70117|"; distance: 3; within: 7;content: "|01|"; distance: 7; within: 1;content: "|C781B8|"; distance: 1; within: 3;content: "|31C089411489411880A1C1|"; distance: 6; within: 11;content: "|FEC331C064FF30648920CCC3|"; distance: 12; within: 12;sid: 2009447; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXECryptor V2.1X -> softcomplete.com] binary file"; flow:established,to_server; content: "|E9|";content: "|669C60508D88|"; distance: 3; within: 6;content: "|8D900416|"; distance: 8; within: 4;content: "|8BDC8BE1|"; distance: 5; within: 4;sid: 2009448; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXECryptor vx.x.x.x] binary file"; flow:established,to_server; content: "|E824|";content: "|8B4C240CC70117|"; distance: 3; within: 7;content: "|01|"; distance: 7; within: 1;content: "|C781B8|"; distance: 1; within: 3;content: "|31C08941|"; distance: 6; within: 4;sid: 2009449; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ExeJoiner 1.0 -> Yoda] binary file"; flow:established,to_server; content: "|68001040006804010000E8390300000500104000C6005C680401000068041140006A00E81A0300006A0068800000006A036A006A0168000000806804114000E8EC02000083F8FF0F8483020000A3081240006A0050E8E202000083F8FF0F846D020000A30C1240008BD883EB046A006A0053FF3508124000E8E30200006A00683C1240006A04681E124000FF3508124000E8C402000083EB046A006A0053FF3508124000|";sid: 2009450; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ExeJoiner 1.0 -> Yoda f2f] binary file"; flow:established,to_server; content: "|68001040006804010000E8390300000500104000C6005C680401000068041140006A00E81A0300006A0068800000006A036A006A0168000000806804114000E8EC02000083F8FF0F8483020000A3081240006A0050|";sid: 2009451; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXEJoiner v1.0] binary file"; flow:established,to_server; content: "|68001040006804010000E83903000005001040C6005C68|";content: "|68|"; distance: 25; within: 1;content: "|6A00E8|"; distance: 3; within: 3;sid: 2009452; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ExeJoiner V1.0 -> Yoda f2f] binary file"; flow:established,to_server; content: "|68001040006804010000E8390300000500104000C6005C6804010000|";sid: 2009453; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXELOCK 666 1.5] binary file"; flow:established,to_server; content: "|BA|";content: "|BF|"; distance: 2; within: 1;content: "|EB|"; distance: 2; within: 1;content: "|EA|"; distance: 1; within: 1;content: "|79|"; distance: 3; within: 1;content: "|7F|"; distance: 1; within: 1;content: "|7E|"; distance: 1; within: 1;content: "|1C|"; distance: 1; within: 1;content: "|4878|"; distance: 1; within: 2;content: "|E3|"; distance: 2; within: 1;content: "|4514|"; distance: 1; within: 2;content: "|5AE9|"; distance: 2; within: 2;sid: 2009454; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ExeLock v1.00] binary file"; flow:established,to_server; content: "|068CC88EC0BE|";content: "|26|"; distance: 7; within: 1;content: "|34|"; distance: 2; within: 1;content: "|26|"; distance: 1; within: 1;content: "|4681|"; distance: 2; within: 2;content: "|75|"; distance: 3; within: 1;content: "|40B3|"; distance: 1; within: 2;content: "|B3|"; distance: 2; within: 1;content: "|F3|"; distance: 1; within: 1;sid: 2009455; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXEPACK (LINK) v3.60, v3.64, v3.65 or 5.01.21] binary file"; flow:established,to_server; content: "|8CC005|";content: "|0E1FA3|"; distance: 4; within: 3;content: "|03|"; distance: 4; within: 1;content: "|8EC08B|"; distance: 2; within: 3;content: "|8B|"; distance: 4; within: 1;content: "|4F8BF7FDF3A450B8|"; distance: 1; within: 8;content: "|50CB|"; distance: 9; within: 2;sid: 2009456; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXEPACK v4.05, v4.06] binary file"; flow:established,to_server; content: "|8CC005|";content: "|0E1FA3|"; distance: 4; within: 3;content: "|0306|"; distance: 4; within: 2;content: "|8EC08B0E|"; distance: 3; within: 4;content: "|8BF94F8BF7FDF3A4|"; distance: 5; within: 8;sid: 2009457; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXERefactor V0.1 -> random] binary file"; flow:established,to_server; content: "|558BEC81EC900B0000535657E9588C01005553434154494F4E|";sid: 2009458; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ExeShield 3.6 -> www.exeshield.com] binary file"; flow:established,to_server; content: "|B8|";content: "|005064FF35000000006489250000000033C089085045436F6D706163743200CE1E42AFF8D6CCE9FBC84F1B227CB4C80DBD71A9C81F5FB1298F11738F00D18887A93F4D006C3CBFC080F7AD3523EB84826F|"; distance: 2; within: 81;sid: 2009459; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ExeShield Cryptor 1.3RC -> Tom Commander] binary file"; flow:established,to_server; content: "|558BEC53565760E8000000005D81ED8C214000B9512D400081E9E62140008BD581C2E62140008D3A8BF733C0EB0490EB01C2AC|";sid: 2009460; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ExeShield Protector V3.6 -> www.exeshield.com] binary file"; flow:established,to_server; content: "|B8|";content: "|005064FF35000000006489250000000033C089085045436F6D706163743200CE1E42AFF8D6CC|"; distance: 2; within: 38;sid: 2009461; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ExeSmasher vx.x] binary file"; flow:established,to_server; content: "|9CFE03|";content: "|60BE|"; distance: 3; within: 2;content: "|41|"; distance: 3; within: 1;content: "|8DBE|"; distance: 1; within: 2;content: "|10FFFF5783CDFFEB10|"; distance: 2; within: 9;sid: 2009462; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ExeSplitter 1.3 (Split Method) -> Bill Prisoner / TPOC] binary file"; flow:established,to_server; content: "|E9FE010000|";content: "|000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073766345723031312E746D7000000000000000000064A1300000008B400C8B400C8B0085C00F845F0200008B483080396B740780394B7402EBE780790C337402EBDF8B4018C3|"; distance: 8; within: 159;sid: 2009463; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ExeSplitter 1.3 (Split+Crypt Method) -> Bill Prisoner / TPOC] binary file"; flow:established,to_server; content: "|E8000000005D81ED05104000B9|";content: "|8D851D10400080306640E2FA8F98676666|"; distance: 15; within: 17;content: "|66|"; distance: 20; within: 1;sid: 2009464; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EXEStealth 2.75 -> WebtoolMaster] binary file"; flow:established,to_server; content: "|906090E8000000005D81EDD1274000B915000000|";sid: 2009465; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ExeTools COM2EXE] binary file"; flow:established,to_server; content: "|E8|";content: "|5D83ED|"; distance: 2; within: 3;content: "|8CDA2E8996|"; distance: 3; within: 5;content: "|83C2|"; distance: 6; within: 2;content: "|8EDA8EC22E0196|"; distance: 2; within: 7;content: "|60|"; distance: 8; within: 1;sid: 2009466; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ExeTools v2.1 Encruptor by DISMEMBER] binary file"; flow:established,to_server; content: "|E8|";content: "|5D83|"; distance: 2; within: 2;content: "|1E8CDA83|"; distance: 3; within: 4;content: "|8EDA8EC2BB|"; distance: 5; within: 5;content: "|BA|"; distance: 6; within: 1;content: "|85D274|"; distance: 2; within: 3;sid: 2009467; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[eXPressor 1.1 -> CGSoftLabs] binary file"; flow:established,to_server; content: "|E9|";content: "|0000E9|"; distance: 2; within: 3;content: "|0000E9|"; distance: 4; within: 3;content: "|120000E9|"; distance: 3; within: 4;content: "|0C0000E9|"; distance: 4; within: 4;content: "|0000E9|"; distance: 5; within: 3;content: "|0000E9|"; distance: 4; within: 3;content: "|0000|"; distance: 4; within: 2;sid: 2009468; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[eXPressor 1.2 -> CGSoftLabs] binary file"; flow:established,to_server; content: "|558BEC81ECD4010000535657EB0C457850722D762E312E322E2E|";sid: 2009469; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[eXPressor 1.2.0 Beta PE Packer] binary file"; flow:established,to_server; content: "|558BEC81EC|";content: "|535657EB|"; distance: 7; within: 4;content: "|457850722D762E312E322E2E|"; distance: 4; within: 12;sid: 2009470; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[eXPressor V1.0 -> CGSoftLabs] binary file"; flow:established,to_server; content: "|E935140000E931130000E998120000E9EF0C0000E942130000E9E9020000E9EF0B0000E91B0D0000|";sid: 2009471; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[eXpressor v1.1 -> CGSoftLabs] binary file"; flow:established,to_server; content: "|E915130000E9F0120000E958120000E9AF0C0000E9AE020000E9B40B0000E9E00C0000|";sid: 2009472; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[eXpressor v1.2 -> CGSoftLabs] binary file"; flow:established,to_server; content: "|558BEC81ECD4010000535657EB0C457850722D76|";sid: 2009473; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[eXPressor v1.2 -> CGSoftLabs] binary file"; flow:established,to_server; content: "|558BEC81ECD4010000535657EB0C457850722D762E312E322E2EB8|";content: "|2B0584|"; distance: 29; within: 3;content: "|A3|"; distance: 4; within: 1;content: "|833D|"; distance: 3; within: 2;content: "|007416A1|"; distance: 4; within: 4;content: "|030580|"; distance: 6; within: 3;content: "|898554FEFFFFE9|"; distance: 4; within: 7;content: "|070000C705|"; distance: 7; within: 5;content: "|010000006804|"; distance: 7; within: 6;sid: 2009474; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[eXPressor v1.2 -> CGSoftLabs] binary file"; flow:established,to_server; content: "|558BEC81ECD4010000535657EB0C457850722D762E312E322E2EB8|";content: "|2B0584|"; distance: 29; within: 3;content: "|A3|"; distance: 4; within: 1;content: "|833D|"; distance: 3; within: 2;content: "|007416A1|"; distance: 4; within: 4;content: "|030580|"; distance: 6; within: 3;content: "|898554FEFFFFE9|"; distance: 4; within: 7;content: "|070000C705|"; distance: 7; within: 5;content: "|0100000068040100008D85F0FEFFFF506A00FF15|"; distance: 7; within: 20;sid: 2009475; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[eXPressor V1.3 -> CGSoftLabs] binary file"; flow:established,to_server; content: "|558BEC83EC|";content: "|535657EB0C45|"; distance: 5; within: 6;sid: 2009476; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[eXPressor v1.3 -> CGSoftLabs] binary file"; flow:established,to_server; content: "|558BEC83EC|";content: "|535657EB0C457850722D762E312E332E2EB8|"; distance: 5; within: 18;content: "|2B05|"; distance: 20; within: 2;content: "|A3|"; distance: 4; within: 1;content: "|833D|"; distance: 3; within: 2;content: "|007413A1|"; distance: 4; within: 4;content: "|0305|"; distance: 6; within: 2;content: "|89|"; distance: 4; within: 1;content: "|E9|"; distance: 2; within: 1;content: "|0000C705|"; distance: 2; within: 4;sid: 2009477; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[eXPressor v1.4 -> CGSoftLabs] binary file"; flow:established,to_server; content: "|558BEC83EC|";content: "|535657EB0C457850722D762E312E342E2EB8|"; distance: 5; within: 18;sid: 2009478; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[eXpressor v1.4.5 -> CGSoftLabs] binary file"; flow:established,to_server; content: "|558BEC83EC585356578365DC00F3EB0C|";sid: 2009479; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[eXPressor V1.4.5.1 -> CGSoftLabs] binary file"; flow:established,to_server; content: "|558BEC83EC585356578365DC00F3EB0C655850722D762E312E342E00A100|";content: "|000500|"; distance: 31; within: 3;content: "|00A308|"; distance: 4; within: 3;content: "|00A108|"; distance: 4; within: 3;content: "|00B981|"; distance: 4; within: 3;content: "|002B4818890D0C|"; distance: 4; within: 7;content: "|00833D|"; distance: 8; within: 3;sid: 2009480; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[eXPressor v1.4.5.1 -> CGSoftLabs] binary file"; flow:established,to_server; content: "|558BEC83EC585356578365DC00F3EB0C655850722D762E312E342E00A100|";content: "|0500|"; distance: 31; within: 2;content: "|A308|"; distance: 3; within: 2;content: "|A108|"; distance: 3; within: 2;content: "|B981|"; distance: 3; within: 2;content: "|2B4818890D0C|"; distance: 3; within: 6;content: "|833D10|"; distance: 7; within: 3;content: "|007416A108|"; distance: 4; within: 5;content: "|8B0D0C|"; distance: 6; within: 3;content: "|034814|"; distance: 4; within: 3;sid: 2009481; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[eXPressor v1.4.5.1 -> CGSoftLabs] binary file"; flow:established,to_server; content: "|558BEC83EC585356578365DC00F3EB0C655850722D762E312E342E00A100|";content: "|0500|"; distance: 31; within: 2;content: "|A308|"; distance: 3; within: 2;content: "|A108|"; distance: 3; within: 2;content: "|B981|"; distance: 3; within: 2;content: "|2B4818890D0C|"; distance: 3; within: 6;content: "|833D10|"; distance: 7; within: 3;content: "|007416A108|"; distance: 4; within: 5;content: "|8B0D0C|"; distance: 6; within: 3;content: "|034814894DCC|"; distance: 4; within: 6;sid: 2009482; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[eXPressor.PacK 1.5.0.X -> CGSoftLabs] binary file"; flow:established,to_server; content: "|558BEC81EC|";content: "|53565783A5|"; distance: 7; within: 5;content: "|F3EB0C655850722D762E312E352E00837D0C|"; distance: 7; within: 18;content: "|75238B4508A3|"; distance: 18; within: 6;content: "|6A04680010000068200300006A00FF15|"; distance: 8; within: 16;content: "|A3|"; distance: 18; within: 1;content: "|EB04|"; distance: 3; within: 2;sid: 2009483; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[EZIP v1.0] binary file"; flow:established,to_server; content: "|E919320000E97C2A0000E919240000E9FF230000E91E2E0000E9882E0000E92C|";sid: 2009484; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FACRYPT v1.0] binary file"; flow:established,to_server; content: "|B9|";content: "|B3|"; distance: 2; within: 1;content: "|33D2BE|"; distance: 1; within: 3;content: "|8BFEAC32C3AA494332E403D0E3|"; distance: 4; within: 13;sid: 2009485; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Feokt] binary file"; flow:established,to_server; content: "|8925A8114000BF|";content: "|0031C0B9|"; distance: 8; within: 4;content: "|0029F9FCF3AA|"; distance: 5; within: 6;content: "|E8|"; distance: 36; within: 1;sid: 2009486; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FileShield] binary file"; flow:established,to_server; content: "|501EEB|";content: "|9000008BD8|"; distance: 3; within: 5;sid: 2009487; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Fish PE Shield 1.01 -> HellFish] binary file"; flow:established,to_server; content: "|60E812FEFFFFC390090000002C000000|";content: "|C4030000BCA0000000400100|"; distance: 18; within: 12;content: "|0000000000000000000000000000000099000000008A0000001000002888000040|"; distance: 14; within: 33;content: "|4B00000002000000A000001801000040|"; distance: 33; within: 16;content: "|4C0000000C000000B00000380A000040|"; distance: 16; within: 16;content: "|4E00000000000000C000004039000040|"; distance: 16; within: 16;content: "|4E00000008000000000100C806000040|"; distance: 16; within: 16;sid: 2009488; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Fish PE Shield 1.12/1.16 -> HellFish] binary file"; flow:established,to_server; content: "|60E8EAFDFFFFFFD0C38D4000|";content: "|0000002C000000|"; distance: 12; within: 7;content: "|00|"; distance: 8; within: 1;content: "|0000|"; distance: 2; within: 2;content: "|0000|"; distance: 3; within: 2;content: "|00|"; distance: 3; within: 1;content: "|00|"; distance: 2; within: 1;content: "|00|"; distance: 2; within: 1;content: "|00000000|"; distance: 1; within: 4;content: "|00|"; distance: 5; within: 1;content: "|0000|"; distance: 2; within: 2;content: "|00000000|"; distance: 2; within: 4;content: "|0000100000|"; distance: 5; within: 5;content: "|0040|"; distance: 6; within: 2;content: "|0000|"; distance: 3; within: 2;content: "|0000|"; distance: 3; within: 2;content: "|00|"; distance: 3; within: 1;content: "|0040|"; distance: 2; within: 2;content: "|0000|"; distance: 3; within: 2;content: "|000000|"; distance: 2; within: 3;content: "|00|"; distance: 4; within: 1;content: "|000040|"; distance: 2; within: 3;sid: 2009489; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FishPE V1.0X -> hellfish] binary file"; flow:established,to_server; content: "|60E8|";content: "|C390090000002C000000|"; distance: 4; within: 10;content: "|C4030000BCA0000000400100|"; distance: 12; within: 12;content: "|0000000000000000000000000000000099000000008A000000100000|"; distance: 14; within: 28;content: "|0000|"; distance: 29; within: 2;content: "|000002000000A0000018010000|"; distance: 4; within: 13;content: "|00000C000000B00000380A0000|"; distance: 15; within: 13;content: "|000000000000C0000040390000|"; distance: 15; within: 13;content: "|000008000000000100C8060000|"; distance: 15; within: 13;sid: 2009490; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FixupPak v1.20] binary file"; flow:established,to_server; content: "|55E8000000005D81ED|";content: "|0000BE00|"; distance: 10; within: 4;content: "|000003F5BA0000|"; distance: 4; within: 7;content: "|2BD58BDD33C0AC3C00743D3C01740E3C02740E3C03740D03D82913EBE766ADEBF6ADEBF3AC0FB6C83C0074063C017409EB0A66AD0FB7C8EB03AD8BC8|"; distance: 8; within: 60;sid: 2009491; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Fly-Crypter 1.0 -> ut1lz] binary file"; flow:established,to_server; content: "|558BEC83C4F053B818224444E87FF7FFFFE80AF1FFFFB809000000E85CF1FFFF8BD885DB7505E885FDFFFF83FB017505E87BFDFFFF83FB027505E8D1FDFFFF83FB037505E887FEFFFF83FB047505E85DFDFFFF83FB057505E8B3FDFFFF83FB067505E869FEFFFF83FB077505E85FFEFFFF83FB087505E895FDFFFF83FB097505E84BFEFFFF5BE89DF2FFFF90|";sid: 2009492; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FreeBASIC 0.16b] binary file"; flow:established,to_server; content: "|5589E583EC08C7042401000000FF15|";content: "|00E888FFFFFF89EC31C05DC389F65589E583EC08C7042402000000FF15|"; distance: 16; within: 29;content: "|00E868FFFFFF89EC31C05DC389F65589E583EC088B4508890424FF15|"; distance: 30; within: 28;content: "|0089EC5DC38D76008DBC27000000005589E583EC088B4508890424FF15|"; distance: 29; within: 29;content: "|0089EC5DC390909090909090909090|"; distance: 30; within: 15;sid: 2009493; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FreeJoiner 1.5.1 -> GlOFF] binary file"; flow:established,to_server; content: "|9087FF9090B92B000000BA0710400083C2039087FF9090B9040000009087FF9033C9C7050930400000000000680001000068213040006A00E8B70200006A0068800000006A036A006A0068000000806821304000E88F020000A3193040009087FF908B150930400081C204010000F7DA6A026A0052|";sid: 2009494; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FreeJoiner 1.5.2 (Stub engine 1.6) -> GlOFF] binary file"; flow:established,to_server; content: "|E846FDFFFF50E80C000000FF2508204000FF250C204000FF2510204000FF2514204000FF2518204000FF251C204000FF2520204000FF2524204000FF2528204000FF2500204000|";sid: 2009495; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FreeJoiner 1.5.3 (Stub engine 1.7) -> GlOFF] binary file"; flow:established,to_server; content: "|E833FDFFFF50E80D000000CCFF2508204000FF250C204000FF2510204000FF2514204000FF2518204000FF251C204000FF2520204000FF2524204000FF2528204000FF2500204000|";sid: 2009496; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FreeJoiner 1.5.3 (Stub engine 1.7.1) -> GlOFF] binary file"; flow:established,to_server; content: "|E802FDFFFF6A00E80D000000CCFF2580104000FF2584104000FF2588104000FF258C104000FF2590104000FF2594104000FF2598104000FF259C104000FF25A0104000FF25A8104000|";sid: 2009497; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FreeJoiner Small (build 014-021/024-027) -> GlOFF] binary file"; flow:established,to_server; content: "|E8|";content: "|FFFF6A00E80D000000CCFF2578104000FF257C104000FF2580104000FF2584104000FF2588104000FF258C104000FF2590104000FF2594104000FF2598104000FF259C104000FF25A0104000FF25A4104000FF25AC104000|"; distance: 2; within: 88;sid: 2009498; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FreeJoiner Small (build 023) -> GlOFF] binary file"; flow:established,to_server; content: "|E8E1FDFFFF6A00E80C000000FF2578104000FF257C104000FF2580104000FF2584104000FF2588104000FF258C104000FF2590104000FF2594104000FF2598104000FF259C104000FF25A0104000FF25A4104000FF25AC104000|";sid: 2009499; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FreeJoiner Small (build 029) -> GlOFF] binary file"; flow:established,to_server; content: "|5032C48AC358E8DEFDFFFF6A00E80D000000CCFF2578104000FF257C104000FF2580104000FF2584104000FF2588104000FF258C104000FF2590104000FF2594104000FF2598104000FF259C104000FF25A0104000FF25A4104000FF25AC104000|";sid: 2009500; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FreeJoiner Small (build 031/032) -> GlOFF] binary file"; flow:established,to_server; content: "|5032|";content: "|668BC358E8|"; distance: 2; within: 5;content: "|FDFFFF6A00E80D000000CCFF2578104000FF257C104000FF2580104000FF2584104000FF2588104000FF258C104000FF2590104000FF2594104000FF2598104000FF259C104000FF25A0104000FF25A4104000FF25AC104000|"; distance: 5; within: 89;sid: 2009501; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FreeJoiner Small (build 033) -> GlOFF] binary file"; flow:established,to_server; content: "|506633C3668BC158E8ACFDFFFF6A00E80D000000CCFF2578104000FF257C104000FF2580104000FF2584104000FF2588104000FF258C104000FF2590104000FF2594104000FF2598104000FF259C104000FF25A0104000FF25A4104000FF25AC104000|";sid: 2009502; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FreeJoiner Small (build 035) -> GlOFF] binary file"; flow:established,to_server; content: "|5133CB86C959E89EFDFFFF6687DB6A00E80C000000FF2578104000FF257C104000FF2580104000FF2584104000FF2588104000FF258C104000FF2590104000FF2594104000FF2598104000FF259C104000FF25A0104000FF25A4104000FF25AC104000|";sid: 2009503; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Freshbind v2.0 -> gFresh] binary file"; flow:established,to_server; content: "|64A1000000005589E56AFF681CA04100|";sid: 2009504; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Frusion -> biff] binary file"; flow:established,to_server; content: "|83EC0C535556576804010000C7442414|";sid: 2009505; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG 1.31 -> dulek/xt] binary file"; flow:established,to_server; content: "|BE|";content: "|00BF|"; distance: 2; within: 2;content: "|00BB|"; distance: 3; within: 2;content: "|0053BB|"; distance: 3; within: 3;content: "|00B280|"; distance: 4; within: 3;sid: 2009506; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.0] binary file"; flow:established,to_server; content: "|BBD0014000BF00104000BE|";content: "|53E80A00000002D275058A164612D2C3FCB280A46A025B|"; distance: 13; within: 23;sid: 2009507; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.00 (Eng) -> dulek/xt] binary file"; flow:established,to_server; content: "|BBD0014000BF00104000BE|";content: "|0053E80A00000002D275058A164612D2C3FCB280A46A025BFF142473F733C9FF1424731833C0FF14247321B30241B010FF142412C073F9753FAAEBDCE8430000002BCB7510E838|"; distance: 12; within: 71;sid: 2009508; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.1] binary file"; flow:established,to_server; content: "|BBD00140|";content: "|BF|"; distance: 4; within: 1;content: "|1040|"; distance: 1; within: 2;content: "|BE|"; distance: 2; within: 1;content: "|FCB2808A064688074702D275058A16|"; distance: 3; within: 15;sid: 2009509; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> bart/xt] binary file"; flow:established,to_server; content: "|BBD0014000BF00104000BE|";content: "|0053E80A00000002D275058A164612D2C3B280A46A025BFF142473F733C9FF1424731833C0FF14247321B30241B010FF142412C073F9753FAAEBDCE8430000002BCB7510E83800|"; distance: 12; within: 71;sid: 2009510; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> bart/xt -> (Watcom C/C++ EXE)] binary file"; flow:established,to_server; content: "|EB02CD2003|";content: "|8D|"; distance: 5; within: 1;content: "|80|"; distance: 1; within: 1;content: "|00|"; distance: 2; within: 1;content: "|EB02|"; distance: 5; within: 2;sid: 2009511; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> bart/xt -> WinRAR-SFX] binary file"; flow:established,to_server; content: "|80E9A1C1C11368E4167546C1C1055EEB019D6864863746EB028CE05FF7D0|";sid: 2009512; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> bart/xt -> WinRAR-SFX] binary file"; flow:established,to_server; content: "|EB0102EB02CD20B880|";content: "|4200EB0155BEF400000013DF13D80FB638D1F3F7|"; distance: 9; within: 20;sid: 2009513; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt] binary file"; flow:established,to_server; content: "|BBD00140|";content: "|BF|"; distance: 4; within: 1;content: "|1040|"; distance: 1; within: 2;content: "|BE|"; distance: 2; within: 1;sid: 2009514; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt] binary file"; flow:established,to_server; content: "|E801000000|";content: "|E8|"; distance: 6; within: 1;content: "|000000|"; distance: 1; within: 3;sid: 2009515; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt] binary file"; flow:established,to_server; content: "|EB01|";content: "|EB02|"; distance: 2; within: 2;content: "|80|"; distance: 3; within: 1;content: "|00|"; distance: 2; within: 1;sid: 2009516; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Borland C++ 1999)] binary file"; flow:established,to_server; content: "|EB02CD202BC86880|";content: "|00EB021EBB5EEB02CD2068B12B6E37405B0FB6C9|"; distance: 9; within: 20;sid: 2009517; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Borland C++)] binary file"; flow:established,to_server; content: "|23CAEB025A0DE8020000006A3558C1C910BE80|";content: "|000FB6C9EB02CD20BB|"; distance: 20; within: 9;sid: 2009518; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Borland C++)] binary file"; flow:established,to_server; content: "|23CAEB025A0DE8020000006A3558C1C910BE80|";content: "|000FB6C9EB02CD20BBF4000000EB0204FAEB01FAEB015FEB02CD208A16EB02113180E931EB023011C1E91180EA04EB02F0EA33CB81EAABAB190804D503C280EA|"; distance: 20; within: 64;sid: 2009519; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)] binary file"; flow:established,to_server; content: "|2BC2E802000000954A598D3D52F12AE8C1C81CBE2E|";content: "|18EB02ABA003F7|"; distance: 22; within: 7;sid: 2009520; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)] binary file"; flow:established,to_server; content: "|2BC2E802000000954A598D3D52F12AE8C1C81CBE2E|";content: "|18EB02ABA003F7EB02CD2068F40000000BC75B03CB8A068A16E8020000008D4659EB01A402D3EB02CD2002D3E80200000057AB5881C2AA87ACB90FBEC980|"; distance: 22; within: 62;sid: 2009521; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)] binary file"; flow:established,to_server; content: "|EB012EEB02A555BB80|";content: "|0087FE8D05AACEE063EB0175BA5ECEE063EB02|"; distance: 10; within: 19;sid: 2009522; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++ / ASM)] binary file"; flow:established,to_server; content: "|EB02CD20EB02CD20EB02CD20C1E618BB80|";content: "|00EB0282B8EB01108D05F4|"; distance: 18; within: 11;sid: 2009523; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)] binary file"; flow:established,to_server; content: "|1BDBE8020000001A0D5B6880|";content: "|00E801000000EA5A58EB02CD2068F4000000EB02CD205E0FB6D080CA5C8B38EB0135EB02DC9781EFF7651743E80200000097CB5B81C7B28BA10C8BD183EF17EB020C6583EF4313|"; distance: 13; within: 71;sid: 2009524; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)] binary file"; flow:established,to_server; content: "|C1C810EB010FBF03746677C1E91D6883|";content: "|77EB02CD205EEB02CD202BF7|"; distance: 17; within: 12;sid: 2009525; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)x] binary file"; flow:established,to_server; content: "|1BDBE8020000001A0D5B6880|";content: "|00E801000000EA5A58EB02CD2068F400|"; distance: 13; within: 16;sid: 2009526; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi 2.0)] binary file"; flow:established,to_server; content: "|EB0156E802000000B2D9596880|";content: "|4100E8020000006532595EEB02CD20BB|"; distance: 13; within: 16;sid: 2009527; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32 / Microsoft Visual Basic)] binary file"; flow:established,to_server; content: "|F7D80FBEC2BE80|";content: "|000FBEC9BF083B6507EB02D829BBECC59AF8EB0194|"; distance: 8; within: 21;sid: 2009528; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)] binary file"; flow:established,to_server; content: "|03F723FE33FBEB02CD20BB80|";content: "|4000EB0186EB0190B8F400000083EE052B|"; distance: 12; within: 17;sid: 2009529; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)] binary file"; flow:established,to_server; content: "|03F723FE33FBEB02CD20BB80|";content: "|4000EB0186EB0190B8F400000083EE052BF281F6EE000000EB02CD208A0BE802000000A9545EC1EE07F7D7EB01DE81E9B796A0C4EB016BEB02CD2080E94BC1CF08EB017180E91CEB|"; distance: 12; within: 72;sid: 2009530; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (MASM32)] binary file"; flow:established,to_server; content: "|EB01DBE80200000086435E8D1DD075CF83C1EE1D6850|";content: "|8F83EB023D0F5A|"; distance: 22; within: 7;sid: 2009531; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual Basic / MASM32)] binary file"; flow:established,to_server; content: "|EB0209940FB7FF6880|";content: "|0081F68E0000005BEB0211C28D05F400000047|"; distance: 10; within: 19;sid: 2009532; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual Basic 5.0 / 6.0)] binary file"; flow:established,to_server; content: "|C1CB10EB010FB90374F6EE0FB6D38D0583|";content: "|EF80F3F62BC1EB01DE6877|"; distance: 18; within: 11;sid: 2009533; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 4.x / LCC Win32 1.x)] binary file"; flow:established,to_server; content: "|2C711BCAEB012AEB01658D3580|";content: "|0080C98480C968BBF4000000EB01EB|"; distance: 14; within: 15;sid: 2009534; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 5.0 / 6.0)] binary file"; flow:established,to_server; content: "|33D20FBED2EB01C7EB01D88D0580|";content: "|EB02CD20EB01F8BEF4000000EB|"; distance: 15; within: 13;sid: 2009535; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0 / ASM)] binary file"; flow:established,to_server; content: "|E8010000005A5EE802000000BADD5E03F2EB0164BB80|";content: "|008BFAEB01A8|"; distance: 23; within: 6;sid: 2009536; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)] binary file"; flow:established,to_server; content: "|0BD08BDAE80200000040A05AEB019DB880|";content: "|00EB02CD2003D38D35F4000000EB0135EB018880CA7C80F3748B38EB02ACBA03DBE801000000A55BC1C20B81C7DA100A4EEB01082BD183EF14EB02CD2033D383EF27|"; distance: 18; within: 66;sid: 2009537; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)] binary file"; flow:established,to_server; content: "|0BD08BDAE80200000040A05AEB019DB880|";content: "|EB02CD2003D38D35F400|"; distance: 18; within: 10;sid: 2009538; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)] binary file"; flow:established,to_server; content: "|87FEE80200000098CC5FBB80|";content: "|00EB02CD2068F4000000E801000000E3|"; distance: 13; within: 16;sid: 2009539; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)] binary file"; flow:established,to_server; content: "|F7D84049EB02E00A8D3580|";content: "|0FB6C2EB019C8D1DF4000000EB013C80|"; distance: 12; within: 16;sid: 2009540; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)] binary file"; flow:established,to_server; content: "|F7DB80EABFB92F4067BAEB010168AF|";content: "|A7BA80EA9D58C1C2092BC18BD768|"; distance: 15; within: 14;sid: 2009541; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / ASM)] binary file"; flow:established,to_server; content: "|F7D0EB02CD20BEBB741CFBEB02CD20BF3B|";content: "|FBC1C10333F7EB02CD2068|"; distance: 18; within: 11;sid: 2009542; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)] binary file"; flow:established,to_server; content: "|03DEEB01F8B880|";content: "|4200EB02CD206817A0B3ABEB01E8590FB6DB680BA1B3|"; distance: 7; within: 22;sid: 2009543; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)] binary file"; flow:established,to_server; content: "|03DEEB01F8B880|";content: "|4200EB02CD206817A0B3ABEB01E8590FB6DB680BA1B3ABEB02CD205E80CBAA2BF1EB02CD20430FBE3813D680C3472BFEEB01F403FEEB024F4E81EF93537C3C80C32981F78A8F678B80C3C72BFE|"; distance: 7; within: 77;sid: 2009544; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)] binary file"; flow:established,to_server; content: "|91EB02CD20BF50BC046F91BED0|";content: "|6FEB02CD202BF7EB02F0468D1DF400|"; distance: 14; within: 15;sid: 2009545; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)] binary file"; flow:established,to_server; content: "|C1CE10C1F60F6800|";content: "|002BFA5B23F98D1580|"; distance: 9; within: 9;content: "|00E801000000B65E0B|"; distance: 10; within: 9;sid: 2009546; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)] binary file"; flow:established,to_server; content: "|D1E903C06880|";content: "|00EB02CD205E40BBF400000033CA2BC70FB616EB013E|"; distance: 7; within: 22;sid: 2009547; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)] binary file"; flow:established,to_server; content: "|E8010000000E59E8010000005858BE80|";content: "|00EB0261E968F4000000C1C8|"; distance: 17; within: 12;sid: 2009548; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)] binary file"; flow:established,to_server; content: "|EB014D83F64C6880|";content: "|00EB02CD205BEB012368481C2B3AE80200000038|"; distance: 9; within: 20;sid: 2009549; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)] binary file"; flow:established,to_server; content: "|EB02AB35EB02B5C68D0580|";content: "|00C1C211BEF4000000F7DBF7DB0FBE38E8|"; distance: 12; within: 17;sid: 2009550; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)] binary file"; flow:established,to_server; content: "|EB02CD20|";content: "|CF|"; distance: 4; within: 1;content: "|80|"; distance: 2; within: 1;content: "|00|"; distance: 2; within: 1;content: "|00|"; distance: 5; within: 1;sid: 2009551; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)] binary file"; flow:established,to_server; content: "|F7DB80EABFB92F4067BAEB010168AF|";content: "|BA80EA9D58C1C2092BC18BD768|"; distance: 16; within: 13;sid: 2009552; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.2] binary file"; flow:established,to_server; content: "|4B45524E454C33322E646C6C00004C6F61644C69627261727941000047657450726F634164647265737300|";content: "|0000000000|"; distance: 43; within: 5;sid: 2009553; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.20 (Eng) -> dulek/xt -> (Borland C++)] binary file"; flow:established,to_server; content: "|C1F007EB02CD20BE80|";content: "|001BC68D1DF40000000FB606EB02CD208A160FB6C3E801000000DC5980EA37EB02CD202AD3EB02CD2080EA731BCF32D3C1C80E80EA230FB6C902D3EB01B502D3EB02DB5B81C2F6567BF6|"; distance: 10; within: 74;sid: 2009554; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)] binary file"; flow:established,to_server; content: "|0FBEC1EB010E8D35C3BEB622F7D16843|";content: "|22EB02B5155FC1F11533F780E9F9BBF4000000EB028FD0EB0208AD8A162BC71BC780C27A4180EA10EB013C81EACFAEF1AAEB01EC81EABBC6ABEE2CE332D30BCB81EAAB|"; distance: 17; within: 67;sid: 2009555; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)] binary file"; flow:established,to_server; content: "|0FB6D0E8010000000C5AB880|";content: "|00EB0200DE8D35F4000000F7D2EB020EEA8B38EB01A0C1F31181EF8488F44CEB02CD2083F72287D333FEC1C31983F726E802000000BCDE5A81EFF7EF6F18EB02CD2083EF7FEB01|"; distance: 13; within: 71;sid: 2009556; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.20 (Eng) -> dulek/xt -> (MASM32 / TASM32)] binary file"; flow:established,to_server; content: "|33C22CFB8D3D7E45B480E8020000008A45586802|";content: "|8C7FEB02CD205E80C91603F7EB0240B068F400000080F12C5BC1E9050FB6C98A160FB6C90FBFC72AD3E802000000994C5880EA53C1C9162AD3E8020000009DCE|"; distance: 20; within: 64;sid: 2009557; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)] binary file"; flow:established,to_server; content: "|EB02CD20EB01918D3580|";content: "|0033C26883937E7D0CA45B23C36877937E7DEB01FA5FE802000000F7FB5833DFEB013FE8020000001188580FB616EB02CD20EB02862F2AD3EB02CD2080EA2FEB015232D380E9CD80EA|"; distance: 11; within: 73;sid: 2009558; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)] binary file"; flow:established,to_server; content: "|C1E006EB02CD20EB0127EB0124BE80|";content: "|420049EB01998D1DF4000000EB015CF7D81BCAEB01318A1680E941EB01C2C1E00AEB01A181EAA88C18A13446E801000000625932D3C1C902EB016880F21A0FBEC9F7D12AD3|"; distance: 15; within: 69;sid: 2009559; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.3] binary file"; flow:established,to_server; content: "|BBD0014000BF00104000BE|";content: "|53E80A00000002D275058A164612D2C3B280A46A025BFF142473F733C9FF1424731833C0FF14247321B30241B010FF142412C073F9753FAAEBDCE8430000002BCB7510E83800|"; distance: 13; within: 70;sid: 2009560; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.31] binary file"; flow:established,to_server; content: "|BBD0014000BF00104000BE|";content: "|53BB|"; distance: 13; within: 2;content: "|B280A4B680FFD373F933C9|"; distance: 4; within: 11;sid: 2009561; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.31 (Eng) -> dulek/xt] binary file"; flow:established,to_server; content: "|BBD0014000BF00104000BE|";content: "|0053BB|"; distance: 12; within: 3;content: "|00B280A4B680FFD373F933C9FFD3731633C0FFD37323B68041B010FFD312C073FA7542AAEBE0E84600000002F683D9017510E838000000EB28ACD1E8744813C9EB|"; distance: 4; within: 65;sid: 2009562; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.33] binary file"; flow:established,to_server; content: "|BEA4014000AD93AD97AD5696B280A4B680FF1373|";sid: 2009563; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.33 (Eng) -> dulek/xt] binary file"; flow:established,to_server; content: "|BEA4014000AD93AD97AD5696B280A4B680FF1373F933C9FF13731633C0FF|";sid: 2009564; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v1.33 (Eng) -> dulek/xt] binary file"; flow:established,to_server; content: "|BEA4014000AD93AD97AD5696B280A4B680FF1373F933C9FF13731633C0FF13731FB68041B010FF1312C073FA753CAAEBE0FF530802F683D901750EFF5304EB26ACD1E8742F13C9EB1A9148C1E008ACFF53043D007D|";sid: 2009565; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[FSG v2.0 -> bart/xt] binary file"; flow:established,to_server; content: "|8725|";content: "|00619455A4B680FF13|"; distance: 3; within: 9;sid: 2009566; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Fuck'n'Joy v1.0c -> UsAr] binary file"; flow:established,to_server; content: "|60E8000000005D81EDD8054000FF742420E88C0200000BC00F842C01000089856C0840008D852F08400050FFB56C084000E8EF0200000BC00F840C01000089853B0840008D853F08400050FFB56C084000E8CF0200|";sid: 2009567; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Fuck'n'Joy v1.0c -> UsAr] binary file"; flow:established,to_server; content: "|60E8000000005D81EDD8054000FF742420E88C0200000BC00F842C01000089856C0840008D852F08400050FFB56C084000E8EF0200000BC00F840C01000089853B0840008D853F08400050FFB56C084000E8CF0200000BC00F84EC00000089854D0840008D855108400050FFB56C084000E8AF0200000BC00F84CC00000089855C0840008D8567074000E87B0200008DB5C4074000566A64FF957407400046803E0075FAC706746D702E83C604C706657865008D8536074000E84C02000033DB53536A02535368000000408D85C407400050FF95740740008985780740008D8551074000E8210200006A008D857C074000506800|";content: "|008D85F209400050FF|"; distance: 245; within: 9;sid: 2009568; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Fusion 1.0 -> jaNooNi] binary file"; flow:established,to_server; content: "|68043040006804304000E8090300006804304000E8C7020000|";sid: 2009569; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[GameGuard - nProtect] binary file"; flow:established,to_server; content: "|31FF740661E94A4D50305ABA7D000000807C240801E90000000060BE|";content: "|31FF740661E94A4D50308DBE|"; distance: 30; within: 12;content: "|31C9740661E94A4D5030B87D00000039C2B84C000000F7D0753F64A13000000085C078238B400C8B400CC740200010000064A1180000008B40300FB6400285C07516E91200000031C064A02000000085C07505E901000000615783CDFFEB0B908A064688074701DB75078B1E83EEFC11DB72EDB80100000001DB7507|"; distance: 14; within: 124;sid: 2009570; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[GameGuard v2006.5.x.x (*.dll) -> sign by hot_UNP] binary file"; flow:established,to_server; content: "|31FF740661E94A4D5030BA4C000000807C2408010F85|";content: "|01000060BE00|"; distance: 22; within: 6;sid: 2009571; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[GameGuard v2006.5.x.x (*.exe) -> sign by hot_UNP] binary file"; flow:established,to_server; content: "|31FF740661E94A4D50305ABA7D000000807C240801E90000000060BE00|";sid: 2009572; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Gamehouse Media Protector Version Unknown] binary file"; flow:established,to_server; content: "|68|";content: "|6A00FF15|"; distance: 3; within: 4;content: "|50FF15|"; distance: 6; within: 3;content: "|0000000000000000|"; distance: 4; within: 8;sid: 2009573; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Gardian Angel 1.0] binary file"; flow:established,to_server; content: "|068CC88ED88EC0FCBF|";content: "|EB|"; distance: 10; within: 1;sid: 2009574; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[GHF Protector (pack only) --> GPcH] binary file"; flow:established,to_server; content: "|6068|";content: "|B8|"; distance: 4; within: 1;content: "|FF1068|"; distance: 3; within: 3;content: "|50B8|"; distance: 5; within: 2;content: "|FF1068000000006A40FFD08905|"; distance: 4; within: 13;content: "|89C7BE|"; distance: 15; within: 3;content: "|60FCB28031DBA4B302E86D00000073F631C9E864000000731C31C0E85B0000007323B30241B010E84F00000010C073F7753FAAEBD4E84D00000029D97510E842000000EB28ACD1E8744D11C9EB1C9148C1E008ACE82C0000003D007D0000730A80FC05730683F87F770241419589E8B3015689FE29C6F3A45EEB8E00D275058A164610D2C331C941E8EEFFFFFF11C9E8E7FFFFFF72F2C361B9FCFFFFFF8B1C088999|"; distance: 5; within: 162;content: "|E2F59090BA|"; distance: 164; within: 5;content: "|BE|"; distance: 7; within: 1;content: "|01D68B460C85C00F848700000001D089C350B8|"; distance: 3; within: 19;content: "|FF1085C0750853B8|"; distance: 21; within: 8;content: "|FF108905|"; distance: 10; within: 4;content: "|C705|"; distance: 6; within: 2;content: "|00000000BA|"; distance: 4; within: 5;content: "|8B0685C075038B461001D00305|"; distance: 7; within: 13;content: "|8B188B7E1001D7033D|"; distance: 15; within: 9;content: "|85DB742BF7C300000080750401D3434381E3FFFFFF0F53FF35|"; distance: 11; within: 25;content: "|B8|"; distance: 27; within: 1;content: "|FF1089078305|"; distance: 3; within: 6;content: "|04EBAE83C614BA|"; distance: 8; within: 7;content: "|E96EFFFFFF68|"; distance: 9; within: 6;content: "|B8|"; distance: 8; within: 1;content: "|FF1068|"; distance: 3; within: 3;content: "|50B8|"; distance: 5; within: 2;content: "|FF108B15|"; distance: 4; within: 4;content: "|52FFD061BA|"; distance: 6; within: 5;content: "|FFE290C3|"; distance: 7; within: 4;sid: 2009575; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Goats Mutilator V1.6 -> Goat/_e0f] binary file"; flow:established,to_server; content: "|E8EA0B0000|";content: "|8B1C79F663D88D22B0BFF64908C302BD3B6C294613285D|"; distance: 6; within: 23;sid: 2009576; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[HACKSTOP v1.00] binary file"; flow:established,to_server; content: "|FABD|";content: "|FFE56A49480C|"; distance: 3; within: 6;content: "|E4|"; distance: 6; within: 1;content: "|3F983F|"; distance: 1; within: 3;sid: 2009577; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[HACKSTOP v1.10, v1.11] binary file"; flow:established,to_server; content: "|B430CD2186E03D|";content: "|73|"; distance: 8; within: 1;content: "|B42FCD21B0|"; distance: 1; within: 5;content: "|B44CCD2150B8|"; distance: 5; within: 6;content: "|58EB|"; distance: 7; within: 2;sid: 2009578; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[HACKSTOP v1.10p1] binary file"; flow:established,to_server; content: "|B430CD2186E03D000373|";content: "|B42FCD21B42ACD21B42CCD21B0FFB44CCD2150B8|"; distance: 10; within: 20;content: "|58EB|"; distance: 21; within: 2;sid: 2009579; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[HACKSTOP v1.11c] binary file"; flow:established,to_server; content: "|B430CD2186E03D|";content: "|73|"; distance: 8; within: 1;content: "|B4|"; distance: 1; within: 1;content: "|CD21B0|"; distance: 1; within: 3;content: "|B44CCD2153BB|"; distance: 3; within: 6;content: "|5BEB|"; distance: 7; within: 2;sid: 2009580; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[HACKSTOP v1.13] binary file"; flow:established,to_server; content: "|52B8|";content: "|1ECD2186E03D|"; distance: 3; within: 6;content: "|73|"; distance: 7; within: 1;content: "|CD200E1FB409E8|"; distance: 1; within: 7;content: "|24|"; distance: 8; within: 1;content: "|EA|"; distance: 1; within: 1;sid: 2009581; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[HACKSTOP v1.18] binary file"; flow:established,to_server; content: "|52BA|";content: "|5AEB|"; distance: 3; within: 2;content: "|9A|"; distance: 2; within: 1;content: "|30CD21|"; distance: 3; within: 3;content: "|FD02|"; distance: 4; within: 2;content: "|CD200E1F52BA|"; distance: 3; within: 6;content: "|5AEB|"; distance: 7; within: 2;sid: 2009582; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[HACKSTOP v1.19] binary file"; flow:established,to_server; content: "|52BA|";content: "|5AEB|"; distance: 3; within: 2;content: "|9A|"; distance: 2; within: 1;content: "|30CD21|"; distance: 3; within: 3;content: "|D602|"; distance: 4; within: 2;content: "|CD200E1F52BA|"; distance: 3; within: 6;content: "|5AEB|"; distance: 7; within: 2;sid: 2009583; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Hardlock dongle (Alladin)] binary file"; flow:established,to_server; content: "|5C5C2E5C484152444C4F434B2E565844000000005C5C2E5C46456E7465446576|";sid: 2009584; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Hasp dongle (Alladin)] binary file"; flow:established,to_server; content: "|5053515257568B751C8B3E|";content: "|8B5D088AFB|"; distance: 13; within: 5;content: "|035D108B450C8B4D148B551880FF32|"; distance: 6; within: 15;sid: 2009585; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[HASP HL Protection V1.X -> Aladdin] binary file"; flow:established,to_server; content: "|558BEC535657608BC4A3|";content: "|B8|"; distance: 12; within: 1;content: "|2B05|"; distance: 3; within: 2;content: "|A3|"; distance: 4; within: 1;content: "|833D|"; distance: 3; within: 2;content: "|0074158B0D|"; distance: 4; within: 5;content: "|51FF15|"; distance: 7; within: 3;content: "|83C404E9A500000068|"; distance: 5; within: 9;content: "|FF15|"; distance: 11; within: 2;content: "|A3|"; distance: 4; within: 1;content: "|68|"; distance: 3; within: 1;content: "|FF15|"; distance: 3; within: 2;sid: 2009586; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[HASP HL Protection V1.X -> Aladdin] binary file"; flow:established,to_server; content: "|558BEC535657608BC4A3|";content: "|B8|"; distance: 12; within: 1;content: "|2B05|"; distance: 3; within: 2;content: "|A3|"; distance: 4; within: 1;content: "|833D|"; distance: 3; within: 2;content: "|0074158B0D|"; distance: 4; within: 5;content: "|51FF15|"; distance: 7; within: 3;content: "|83C404E9A500000068|"; distance: 5; within: 9;content: "|FF15|"; distance: 11; within: 2;content: "|A3|"; distance: 4; within: 1;content: "|68|"; distance: 3; within: 1;content: "|FF15|"; distance: 3; within: 2;content: "|A3|"; distance: 4; within: 1;content: "|8B15|"; distance: 3; within: 2;sid: 2009587; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[HEALTH v.5.1 by Muslim M.Polyak] binary file"; flow:established,to_server; content: "|1EE8|";content: "|2E8C06|"; distance: 3; within: 3;content: "|2E893E|"; distance: 4; within: 3;content: "|8BD7B8|"; distance: 4; within: 3;content: "|CD218BD80E1FE8|"; distance: 4; within: 7;content: "|0657A1|"; distance: 8; within: 3;content: "|26|"; distance: 4; within: 1;sid: 2009588; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Hide PE 1.01 -> BGCorp] binary file"; flow:established,to_server; content: "|BA|";content: "|00B8|"; distance: 2; within: 2;content: "|890283C204B8|"; distance: 4; within: 6;content: "|890283C204B8|"; distance: 8; within: 6;content: "|890283C2F8FFE20D0A2D3D5B20486964655045206279204247436F7270205D3D2D|"; distance: 8; within: 33;sid: 2009589; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[hmimys Protect v1.0] binary file"; flow:established,to_server; content: "|E8BA000000|";content: "|00000000|"; distance: 5; within: 4;content: "|0000104000|"; distance: 5; within: 5;content: "|00|"; distance: 6; within: 1;content: "|0000|"; distance: 2; within: 2;content: "|00|"; distance: 3; within: 1;content: "|00|"; distance: 2; within: 1;content: "|00|"; distance: 2; within: 1;content: "|00|"; distance: 2; within: 1;content: "|00|"; distance: 2; within: 1;content: "|00|"; distance: 2; within: 1;content: "|00000000000000|"; distance: 1; within: 7;content: "|000000000000000000|"; distance: 8; within: 9;content: "|00|"; distance: 10; within: 1;content: "|000000000000000000000000000000000000000000|"; distance: 2; within: 21;content: "|00|"; distance: 22; within: 1;content: "|00|"; distance: 2; within: 1;content: "|00|"; distance: 2; within: 1;content: "|00000000004B65726E656C33322E646C6C0000004C6F61644C6962726172794100000047657450726F63416464726573730000005669727475616C467265650000005669727475616C416C6C6F63005E83C664AD50AD5083EE6CAD50AD50AD50AD50AD50E8E7070000AD8BDE8BF083C344AD85C074328BF856FF138BE8AC84C075FBAC84C074EA4EADA9|"; distance: 2; within: 138;sid: 2009590; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[hmimys's PE-Pack 0.1 -> hmimys] binary file"; flow:established,to_server; content: "|E8000000005D83ED056A00FF95E10E00008985850E00008B583C03D881C3F800000080AD890E000001899D630F00008B4B0C038D850E00008B530880BD890E000000750C038D910E00002B95910E0000898D570F000089955B0F00008B5B10899D5F0F00008B9D5F0F00008B85570F00005350E8B70B00008985730F00006A046800100000506A00FF95E90E000089856B0F00006A04680010000068D87C00006A00FF95E90E000089856F0F00008D85670F00008B9D730F00008B8D6B0F00008B955B0F000083EA0E8BB5570F000083C60E8BBD6F0F0000505351525668D87C000057E8010100008B9D570F00008B033C0175|";sid: 2009591; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[hmimys-Packer V1.2 -> hmimys] binary file"; flow:established,to_server; content: "|E895000000|";content: "|5EAD50AD5097AD50AD50AD50E8C0010000AD50AD9387DEB9|"; distance: 79; within: 24;content: "|E31D8A074704|"; distance: 26; within: 6;content: "|3C|"; distance: 6; within: 1;content: "|73F78B073C|"; distance: 1; within: 5;content: "|75F3B0000FC805|"; distance: 5; within: 7;content: "|2BC7ABE2E3AD85C0742B9756FF138BE8AC84C075FB66AD6685C074E9AC83EE0384C074085655FF5304ABEBE4AD5055FF5304ABEBE0C38B0A3B4A04750AC74210010000000CFFC3|"; distance: 9; within: 71;sid: 2009592; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[HPA] binary file"; flow:established,to_server; content: "|E8|";content: "|5E8BD683|"; distance: 2; within: 4;content: "|83|"; distance: 5; within: 1;content: "|060E1E0E1F33FF8CD3|"; distance: 2; within: 9;sid: 2009593; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[hying's PEArmor V0.76 -> hying] binary file"; flow:established,to_server; content: "|E90000000060E8140000005D81ED000000006A|";content: "|E8A3000000|"; distance: 19; within: 5;sid: 2009594; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ICrypt 1.0 - by BuGGz] binary file"; flow:established,to_server; content: "|558BEC83C4EC53565733C08945ECB8703B0010E83CFAFFFF33C055686C3C001064FF306489206A0A687C3C0010A15056001050E8D8FAFFFF8BD853A15056001050E80AFBFFFF8BF853A15056001050E8D4FAFFFF8BD853E8D4FAFFFF8BF085F674268BD74AB864560010E825F6FFFFB864560010E813F6FFFF8BCF8BD6E8E6FAFFFF53E890FAFFFF8D4DECBA8C3C0010A164560010E816FBFFFF8B55ECB864560010E8C5F4FFFFB864560010E8DBF5FFFFE856FCFFFF33C05A595964891068733C00108D45ECE84DF4FFFFC3E9E3EEFFFFEBF05F5E5BE84DF3FFFF00534554|";content: "|00FFFFFFFF08000000766F747265636C65|"; distance: 225; within: 17;sid: 2009595; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ID Application Protector 1.2 -> ID Security Suite] binary file"; flow:established,to_server; content: "|60E8000000005D81EDF20B4700B91922470081E9EA0E470089EA81C2EA0E47008D3A89FE31C0E9D3020000CCCCCCCCE9CA020000433A5C57696E646F77735C536F66745761726550726F746563746F725C|";sid: 2009596; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ILUCRYPT v4.015 [exe]] binary file"; flow:established,to_server; content: "|8BECFAC746F7|";content: "|4281FA|"; distance: 7; within: 3;content: "|75F9FF66F7|"; distance: 4; within: 5;sid: 2009597; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[iLUCRYPT v4.018 [exe]] binary file"; flow:established,to_server; content: "|8BECFAC7|";content: "|4C4CC3FBBF|"; distance: 6; within: 5;content: "|B8|"; distance: 6; within: 1;content: "|2E|"; distance: 2; within: 1;content: "|D1C84F81|"; distance: 2; within: 4;sid: 2009598; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Imploder v1.04 --> BoB / BobSoft] binary file"; flow:established,to_server; content: "|60E8A000000000000000000000000000000036|";content: "|2E|"; distance: 20; within: 1;content: "|000000000000000000000000000000000000000001000080000000004B65726E656C33322E44|"; distance: 2; within: 38;sid: 2009599; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[IMPostor Pack 1.0 -> Mahdi Hezavehi] binary file"; flow:established,to_server; content: "|BE|";content: "|0083C601FFE600000000|"; distance: 2; within: 10;content: "|000000000000000000|"; distance: 11; within: 9;content: "|00|"; distance: 10; within: 1;content: "|02|"; distance: 1; within: 1;content: "|00100000000200|"; distance: 2; within: 7;sid: 2009600; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Inbuild v1.0 [hard]] binary file"; flow:established,to_server; content: "|B9|";content: "|BB|"; distance: 2; within: 1;content: "|2E|"; distance: 2; within: 1;content: "|2E|"; distance: 2; within: 1;content: "|43E2|"; distance: 2; within: 2;sid: 2009601; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Inno Setup Module] binary file"; flow:established,to_server; content: "|496E6E6F53657475704C647257696E646F770000535441544943|";sid: 2009602; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Inno Setup Module v1.09a] binary file"; flow:established,to_server; content: "|558BEC83C4C053565733C08945F08945C48945C0E8A77FFFFFE8FA92FFFFE8F1B3FFFF33C0|";sid: 2009603; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Inno Setup Module v1.2.9] binary file"; flow:established,to_server; content: "|558BEC83C4C053565733C08945F08945EC8945C0E85B73FFFFE8D687FFFFE8C5A9FFFFE8E0|";sid: 2009604; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Install Stub 32-bit] binary file"; flow:established,to_server; content: "|558BEC81EC14|";content: "|00005356576A00FF15|"; distance: 6; within: 9;content: "|68|"; distance: 11; within: 1;content: "|FF15|"; distance: 3; within: 2;content: "|85C07429|"; distance: 4; within: 4;sid: 2009605; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[InstallAnywhere 6.1 -> Zero G Software Inc] binary file"; flow:established,to_server; content: "|60BE00A042008DBE0070FDFF5783CDFFEB109090909090908A064688074701DB75078B1E83EEFC11DB72EDB80100000001DB75078B1E83EEFC11DB11C001DB73EF75098B1E83EEFC11DB73E431C983E803720DC1E0|";sid: 2009606; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[InstallAnywhere 6.1 ->Zero G Software Inc] binary file"; flow:established,to_server; content: "|60BE00A042008DBE0070FDFF5783CDFFEB109090909090908A064688074701DB75078B1E83EEFC11DB72EDB80100000001DB7507|";sid: 2009607; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[InstallShield 2000] binary file"; flow:established,to_server; content: "|558BEC6AFF68|";content: "|68|"; distance: 8; within: 1;content: "|64A1|"; distance: 3; within: 2;content: "|50648925|"; distance: 4; within: 4;content: "|83C4|"; distance: 6; within: 2;content: "|535657|"; distance: 2; within: 3;sid: 2009608; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[InstallShield Custom] binary file"; flow:established,to_server; content: "|558BEC83EC4456FF15|";content: "|41008BF085F675086AFFFF15|"; distance: 10; within: 12;content: "|41008A06578B3D|"; distance: 13; within: 7;content: "|41003C22751B56FFD78BF08A063C22740484C075F1803E22751556FFD78B|"; distance: 8; within: 30;sid: 2009609; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Ionic Wind Software] binary file"; flow:established,to_server; content: "|9BDBE39BDBE2D92D00|";content: "|005589E5E8|"; distance: 10; within: 5;sid: 2009610; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[iPB Protect 0.1.3 - 0.1.7 -> forgot] binary file"; flow:established,to_server; content: "|558BEC6AFF684B435546685449485364A100000000|";sid: 2009611; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[IProtect 1.0 (Fxlib.dll mode) - by FuXdas] binary file"; flow:established,to_server; content: "|EB332E4655584C6F61644C696272617279410046784C69622E646C6C000000000000000000000000000000000000000000|";content: "|0060E8000000005D81ED71104000FF742420E8400000000BC0742F8985631040008D853C10400050FFB563104000E8920000000BC0741389855F1040008D854910400050FF955F1040008B85671040008944241C61FFE08B7C24048D85001040005064FF35000000008D855310400089208968048D9D0A1140008958086489250000000081E70000FFFF66813F4D5A750F8BF703763C813E504500007502EB1781EF0000010081FF000000707307BF0000F7BFEB02EBD397648F050000000083C404C204008D85001040005064FF35000000008D855310400089208968048D9D0A114000895808648925000000008B74240C66813E4D5A7405E98A00000003763C813E504500007402EB7D8B7C2410B99600000032C0F2AE8BCF2B4C24108B56780354240C8B5A20035C240C33C08B3B037C240C8B74241051F3A6750583C404EB0A5983C304403B421875E23B42187502EB358B72240374240C52BB0200000033D2F7E35A03C633C9668B088B7A1C33D2BB040000008BC1F7E30344240C03C78B000344240CEB0233C0648F050000000083C404C20800E8FAFDFFFF|"; distance: 50; within: 412;sid: 2009612; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[IProtect 1.0 (FxSub.dll mode) - by FuXdas] binary file"; flow:established,to_server; content: "|EB332E4655584C6F61644C696272617279410046785375622E646C6C000000000000000000000000000000000000000000|";content: "|0060E8000000005D81EDB6134000FF742420E8400000000BC0742F8985A81340008D858113400050FFB5A8134000E8920000000BC074138985A41340008D858E13400050FF95A41340008B85AC1340008944241C61FFE08B7C24048D85001040005064FF35000000008D859813400089208968048D9D4F1440008958086489250000000081E70000FFFF66813F4D5A750F8BF703763C813E504500007502EB1781EF0000010081FF000000707307BF0000F7BFEB02EBD397648F050000000083C404C204008D85001040005064FF35000000008D859813400089208968048D9D4F144000895808648925000000008B74240C66813E4D5A7405E98A00000003763C813E504500007402EB7D8B7C2410B99600000032C0F2AE8BCF2B4C24108B56780354240C8B5A20035C240C33C08B3B037C240C8B74241051F3A6750583C404EB0A5983C304403B421875E23B42187502EB358B72240374240C52BB0200000033D2F7E35A03C633C9668B088B7A1C33D2BB040000008BC1F7E30344240C03C78B000344240CEB0233C0648F050000000083C404C20800E8B5FAFFFF|"; distance: 50; within: 412;sid: 2009613; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[JAM v2.11] binary file"; flow:established,to_server; content: "|50061607BE|";content: "|8BFEB9|"; distance: 6; within: 3;content: "|FDFAF32EA5FB06BD|"; distance: 4; within: 8;content: "|55CB|"; distance: 9; within: 2;sid: 2009614; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[JDPack] binary file"; flow:established,to_server; content: "|60E8|";content: "|5D8BD581ED|"; distance: 4; within: 5;content: "|2B95|"; distance: 7; within: 2;content: "|81EA06|"; distance: 4; within: 3;content: "|8995|"; distance: 4; within: 2;content: "|83BD45|"; distance: 4; within: 3;sid: 2009615; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[JDPack 2.x -> JDPack] binary file"; flow:established,to_server; content: "|558BEC6AFF6868514000680425400064A100000000|";sid: 2009616; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[JDPack V2.00 -> JDPack] binary file"; flow:established,to_server; content: "|558BEC6AFF68|";content: "|68|"; distance: 8; within: 1;content: "|64A1000000005064892500000000|"; distance: 3; within: 14;content: "|E801000000|"; distance: 15; within: 5;content: "|050000000083C40C5D60E8000000005D8BD564FF3500000000EB|"; distance: 8; within: 26;sid: 2009617; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[JExeCompressor 1.0 - by Arash Veyskarami] binary file"; flow:established,to_server; content: "|8D2DD34AE5140FBBF70FBAE5730FAFD58D0D0C9FE611C0F8EFF6DE80DC5BF6DA0FA5C10FC1F11CF34A81E18C1F66910FBEC611EE0FC0E733D964F2C0DC730FC0D5558BECBAC01F41008BC2B99700000080327950B802000000500314245858512BC9B90100000083EA01E2FB59E2E1FFE0|";sid: 2009618; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Joiner (sign from pinch 25.03.2007 20:10)] binary file"; flow:established,to_server; content: "|81EC040100008BF46804010000566A00E87C01000033C06A0068800000006A036A006A00680000008056E8500100008BD86A006A006A006A026A0053E84401|";sid: 2009619; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[KByS V0.22 -> shoooo] binary file"; flow:established,to_server; content: "|68|";content: "|E801000000C3C31155078BECB8|"; distance: 3; within: 13;content: "|E8|"; distance: 15; within: 1;sid: 2009620; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[KByS V0.28 -> shoooo] binary file"; flow:established,to_server; content: "|68|";content: "|E801000000C3C3608B7424248B7C2428FCB28033DBA4|"; distance: 3; within: 22;sid: 2009621; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[KByS V0.28 DLL -> shoooo] binary file"; flow:established,to_server; content: "|B8|";content: "|BA|"; distance: 3; within: 1;content: "|03C2FFE0|"; distance: 3; within: 4;content: "|60E800000000|"; distance: 6; within: 6;sid: 2009622; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[KGB SFX] binary file"; flow:established,to_server; content: "|60BE00A046008DBE0070F9FF5783CDFFEB109090909090908A064688074701DB75078B1E83EEFC11DB72EDB80100000001DB75078B1E83EEFC11DB11C001DB73|";sid: 2009623; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[KGCrypt vx.x] binary file"; flow:established,to_server; content: "|E8|";content: "|5D81ED|"; distance: 3; within: 3;content: "|64A130|"; distance: 5; within: 3;content: "|84C074|"; distance: 4; within: 3;content: "|64A120|"; distance: 3; within: 3;content: "|0BC074|"; distance: 4; within: 3;sid: 2009624; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[kkrunchy -> Ryd] binary file"; flow:established,to_server; content: "|BD08|";content: "|00C74500|"; distance: 3; within: 4;content: "|00FF4D08C6450C058D7D1431C0B40489C1F3ABBF|"; distance: 5; within: 20;content: "|0057BE|"; distance: 21; within: 3;content: "|0031C941FF4D0C8D9C8DA0000000FFD610C973F3FF450C91AA83C9FF8D5C8D18FFD674DDE3178D5D1CFFD67410|"; distance: 4; within: 45;sid: 2009625; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[kkrunchy 0.23 alpha -> Ryd] binary file"; flow:established,to_server; content: "|BD08|";content: "|00C74500|"; distance: 3; within: 4;content: "|00FF4D08C6450C058D7D1431C0B40489C1F3ABBF|"; distance: 5; within: 20;content: "|0057BE|"; distance: 21; within: 3;content: "|0031C941FF4D0C8D9C8DA0000000FFD610C973F3FF450C91AA83C9FF8D5C8D18FFD674DDE3178D5D1CFFD674108D9DA0080000E8|"; distance: 4; within: 52;content: "|0000008B4510EB428D9DA0040000E8|"; distance: 52; within: 15;content: "|000000494978408D5D20740383C34031D242E8|"; distance: 15; within: 19;content: "|0000008D0C48F6C21074F341918D9DA0080000E8|"; distance: 19; within: 20;content: "|0000003D0008000083D9FF83F86083D9FF8945105689FE29C6F3A45EEB90BE|"; distance: 20; within: 31;content: "|00BB|"; distance: 32; within: 2;content: "|005546AD85C074|"; distance: 3; within: 7;content: "|9756FF1385C0741695AC84C075FB380674E878|"; distance: 7; within: 19;content: "|5655FF5304AB85C0|"; distance: 19; within: 8;sid: 2009626; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[kkrunchy 0.23 alpha 2 -> Ryd] binary file"; flow:established,to_server; content: "|BD|";content: "|C74500|"; distance: 3; within: 3;content: "|00B8|"; distance: 4; within: 2;content: "|0089450489455450C74510|"; distance: 3; within: 11;content: "|00FF4D0CFF4514FF4558C6451C08B8000800008D7D30ABABABABBB0000D800BF|"; distance: 12; within: 32;sid: 2009627; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[kkrunchy 0.23 alpha 2 -> Ryd] binary file"; flow:established,to_server; content: "|BD|";content: "|C74500|"; distance: 3; within: 3;content: "|00B8|"; distance: 4; within: 2;content: "|0089450489455450C74510|"; distance: 3; within: 11;content: "|00FF4D0CFF4514FF4558C6451C08B8000800008D7D30ABABABABBB0000D800BF|"; distance: 12; within: 32;content: "|0131C9418D740901B8CA8E2A2E99F7F601C389D8C1E815ABFEC175E8BE|"; distance: 33; within: 29;sid: 2009628; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[kkrunchy V0.2X -> Ryd] binary file"; flow:established,to_server; content: "|BD|";content: "|C745|"; distance: 3; within: 2;content: "|FF4D08C6450C058D7D1431C0B40489C1F3ABBF|"; distance: 4; within: 19;content: "|57BE|"; distance: 21; within: 2;content: "|31C941FF4D0C8D9C8DA0000000FFD6|"; distance: 4; within: 15;sid: 2009629; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Krypton v0.2] binary file"; flow:established,to_server; content: "|8B0C24E90A7C01|";content: "|AD4240BDBE9D7A04|"; distance: 7; within: 8;sid: 2009630; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Krypton v0.3] binary file"; flow:established,to_server; content: "|8B0C24E9C08D01|";content: "|C13A6ECA5D7E796DB3645A71EA|"; distance: 7; within: 13;sid: 2009631; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Krypton v0.4] binary file"; flow:established,to_server; content: "|54E8|";content: "|5D8BC581ED6134|"; distance: 4; within: 7;content: "|2B856037|"; distance: 8; within: 4;content: "|83E806|"; distance: 5; within: 3;sid: 2009632; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Krypton v0.5] binary file"; flow:established,to_server; content: "|54E8|";content: "|5D8BC581ED7144|"; distance: 4; within: 7;content: "|2B856460|"; distance: 8; within: 4;content: "|EB43DF|"; distance: 5; within: 3;sid: 2009633; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[kryptor 5] binary file"; flow:established,to_server; content: "|E803|";content: "|E9EB6C5840FFE0|"; distance: 3; within: 7;sid: 2009634; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[kryptor 6] binary file"; flow:established,to_server; content: "|E803|";content: "|E9EB685833D27402E9E940427502|"; distance: 3; within: 14;sid: 2009635; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[kryptor 9] binary file"; flow:established,to_server; content: "|60E8|";content: "|5EB9|"; distance: 4; within: 2;content: "|2BC002040ED3C04979F8418D7E2C3346|"; distance: 4; within: 16;content: "|66B9|"; distance: 16; within: 2;sid: 2009636; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[LameCrypt -> LaZaRus] binary file"; flow:established,to_server; content: "|60669CBB00|";content: "|0080B300104000904B83FBFF75F3669D61B8|"; distance: 6; within: 18;content: "|4000FFE0|"; distance: 19; within: 4;sid: 2009637; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[LameCrypt v1.0] binary file"; flow:established,to_server; content: "|60669CBB|";content: "|80B300104000904B83FBFF75F3669D61|"; distance: 6; within: 16;sid: 2009638; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[LamerStop v1.0c (c) Stefan Esser] binary file"; flow:established,to_server; content: "|E8|";content: "|05|"; distance: 2; within: 1;content: "|CD2133C08EC026|"; distance: 2; within: 7;content: "|2E|"; distance: 8; within: 1;content: "|26|"; distance: 2; within: 1;content: "|2E|"; distance: 2; within: 1;content: "|BA|"; distance: 2; within: 1;content: "|FA|"; distance: 2; within: 1;sid: 2009639; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[LaunchAnywhere v4.0.0.1] binary file"; flow:established,to_server; content: "|5589E55383EC4855B8FFFFFFFF505068E03E420064FF35000000006489250000000068C0694400E8E480FFFF59E84E290000E8C90D000085C075086AFFE86E2B000059E8A82C0000E8232E0000FF154CC2440089C3|";sid: 2009640; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[LOCK98 V1.00.28 -> keenvim] binary file"; flow:established,to_server; content: "|55E8000000005D81|";content: "|EB05E9|"; distance: 10; within: 3;content: "|EB08|"; distance: 5; within: 2;sid: 2009641; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Lockless Intro Pack] binary file"; flow:established,to_server; content: "|2CE8|";content: "|5D8BC581EDF673|"; distance: 4; within: 7;content: "|2B85|"; distance: 8; within: 2;content: "|83E8068985|"; distance: 4; within: 5;sid: 2009642; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[LTC v1.3] binary file"; flow:established,to_server; content: "|54E8000000005D8BC581EDF67340002B858775400083E806|";sid: 2009643; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Macromedia Windows Flash Projector/Player v3.0] binary file"; flow:established,to_server; content: "|558BEC83EC4456FF15941342008BF0B1228A063AC175138A4601463AC1740484C075F4380E750D46EB0A3C207E06|";sid: 2009644; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Macromedia Windows Flash Projector/Player v4.0] binary file"; flow:established,to_server; content: "|83EC4456FF15244143008BF08A063C22751C8A4601463C22740C84C074088A4601463C2275F4803E22750F46EB0C|";sid: 2009645; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Macromedia Windows Flash Projector/Player v5.0] binary file"; flow:established,to_server; content: "|83EC4456FF15706144008BF08A063C22751C8A4601463C22740C84C074088A4601463C2275F4803E22750F46EB0C3C207E088A4601463C207FF88A0684C0740C3C207F088A46014684C075F48D442404C744243000|";sid: 2009646; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Macromedia Windows Flash Projector/Player v6.0] binary file"; flow:established,to_server; content: "|83EC4456FF15248149008BF08A063C22751C8A4601463C22740C84C074088A4601463C2275F4803E22750F46EB0C|";sid: 2009647; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[MASM32] binary file"; flow:established,to_server; content: "|6A|";content: "|680030400068|"; distance: 1; within: 6;content: "|3040006A00E8070000006A00E806000000FF250820|"; distance: 6; within: 21;sid: 2009648; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Matrix Dongle -> TDi GmbH] binary file"; flow:established,to_server; content: "|E800000000E800000000595A2BCA2BD1E81AFFFFFF|";sid: 2009649; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[MEGALITE v1.20a] binary file"; flow:established,to_server; content: "|B8|";content: "|BA|"; distance: 2; within: 1;content: "|05|"; distance: 2; within: 1;content: "|3B2D73|"; distance: 2; within: 3;content: "|72|"; distance: 3; within: 1;content: "|B409BA|"; distance: 1; within: 3;content: "|CD21CD90|"; distance: 4; within: 4;sid: 2009650; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[MESS v1.20] binary file"; flow:established,to_server; content: "|FAB9|";content: "|F3|"; distance: 3; within: 1;content: "|E3|"; distance: 2; within: 1;content: "|EB|"; distance: 1; within: 1;content: "|EB|"; distance: 1; within: 1;content: "|B6|"; distance: 1; within: 1;sid: 2009651; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Mew 10 exe-coder 1.0  -> Northfox [HCC]] binary file"; flow:established,to_server; content: "|33C0E9|";content: "|FFFF6A|"; distance: 4; within: 3;content: "|70|"; distance: 5; within: 1;sid: 2009652; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Mew 11 SE v1.2 (Eng) -> Northfox] binary file"; flow:established,to_server; content: "|E9|";content: "|FF0C|"; distance: 2; within: 2;content: "|000000000000000000|"; distance: 3; within: 9;content: "|000C|"; distance: 10; within: 2;sid: 2009653; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[MEW 11 SE v1.2 -> Northfox[HCC]] binary file"; flow:established,to_server; content: "|E9|";content: "|FF0C|"; distance: 2; within: 2;content: "|000000000000000000|"; distance: 3; within: 9;content: "|000C|"; distance: 10; within: 2;content: "|00|"; distance: 3; within: 1;sid: 2009654; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[MEW 5 1.0 -> Northfox] binary file"; flow:established,to_server; content: "|BE5B004000AD91AD9353AD96565FACC0C0|";sid: 2009655; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Mew 5.0.1 -> NorthFox / HCC] binary file"; flow:established,to_server; content: "|BE5B004000AD91AD9353AD96565FACC0C0|";content: "|04|"; distance: 17; within: 1;content: "|C0C8|"; distance: 1; within: 2;content: "|AAE2F4C300|"; distance: 2; within: 5;content: "|00|"; distance: 6; within: 1;content: "|00001040004D455720302E31206279204E6F727468666F78004D455720302E31206279204E6F727468666F78004D455720302E31206279204E6F727468666F78004D455720302E31206279204E6F727468666F78004D|"; distance: 2; within: 86;sid: 2009656; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[MicroJoiner 1.1 -> coban2k] binary file"; flow:established,to_server; content: "|BE0C704000BBF811400033ED83EE04392E7411|";sid: 2009657; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[MicroJoiner 1.5 -> coban2k] binary file"; flow:established,to_server; content: "|BF0510400083EC308BECE8C8FFFFFFE8C3FFFFFF|";sid: 2009658; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[MicroJoiner 1.6 -> coban2k] binary file"; flow:established,to_server; content: "|33C0648B38488BC8F2AFAF8B1F6633DB66813B|";sid: 2009659; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[MicroJoiner 1.7 -> coban2k] binary file"; flow:established,to_server; content: "|BF001040008D5F216A0A586A04596057E88E000000|";sid: 2009660; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Microsoft Visual C++ V8.0] binary file"; flow:established,to_server; content: "|6A1468|";content: "|E8|"; distance: 5; within: 1;content: "|BB94000000536A008B|"; distance: 3; within: 9;content: "|FFD750FF|"; distance: 11; within: 4;content: "|8BF085F6750A6A12E8|"; distance: 6; within: 9;content: "|59EB18891E56FF|"; distance: 11; within: 7;content: "|5685C0751450FFD750FF|"; distance: 9; within: 10;content: "|B8|"; distance: 12; within: 1;sid: 2009661; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Microsoft Visual C++ V8.0 (Debug)] binary file"; flow:established,to_server; content: "|E9|";content: "|E9|"; distance: 3; within: 1;content: "|E9|"; distance: 3; within: 1;content: "|E9|"; distance: 3; within: 1;content: "|E9|"; distance: 3; within: 1;content: "|E9|"; distance: 3; within: 1;content: "|E9|"; distance: 3; within: 1;content: "|E9|"; distance: 3; within: 1;content: "|E9|"; distance: 3; within: 1;content: "|E9|"; distance: 3; within: 1;content: "|E9|"; distance: 3; within: 1;content: "|E9|"; distance: 3; within: 1;content: "|E9|"; distance: 3; within: 1;content: "|E9|"; distance: 3; within: 1;content: "|E9|"; distance: 3; within: 1;content: "|E9|"; distance: 3; within: 1;content: "|E9|"; distance: 3; within: 1;content: "|E9|"; distance: 3; within: 1;content: "|E9|"; distance: 3; within: 1;content: "|E9|"; distance: 3; within: 1;content: "|E9|"; distance: 3; within: 1;sid: 2009662; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[MinGW GCC 3.x] binary file"; flow:established,to_server; content: "|5589E583EC08C70424|";content: "|000000FF15|"; distance: 9; within: 5;content: "|E8|"; distance: 7; within: 1;content: "|FFFF|"; distance: 2; within: 2;content: "|55|"; distance: 6; within: 1;sid: 2009663; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Minke 1.0.1 - by Codius] binary file"; flow:established,to_server; content: "|558BEC83C4F053|";content: "|10E87AF6FFFFBE6866001033C05568DB40001064FF30648920E8FAF8FFFFBAEC4000108BC6E8F2FAFFFF8BD8B86C6600108B16E888F2FFFFB86C660010E876F2FFFF8BD08BC38B0EE8E3E4FFFFE82AF9FFFFE8C1F8FFFFB86C6600108B16E86DFAFFFFE814F9FFFFE8ABF8FFFF8B06E8B8E3FFFF8BD8B86C660010E838F2FFFF8BD38B0EE8A7E4FF|"; distance: 9; within: 136;content: "|C4FBFFFFE8E7F8FFFF8BC3E8B0E3FFFFE8DBF8FFFF33C05A595964891068E2400010C3E950EBFFFFEBF85E5BE8BBEFFFFF00000043413138|"; distance: 138; within: 56;sid: 2009664; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[modified HACKSTOP v1.11f] binary file"; flow:established,to_server; content: "|52B430CD2152FA|";content: "|FB3D|"; distance: 7; within: 2;content: "|EB|"; distance: 3; within: 1;content: "|CD200E1FB409E8|"; distance: 1; within: 7;sid: 2009665; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[MoleBox V2.3X -> MoleStudio.com] binary file"; flow:established,to_server; content: "|E80000000060E84F000000|";sid: 2009666; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[mPack 0.0.3 -> DeltaAziz] binary file"; flow:established,to_server; content: "|558BEC83C4F033C08945F0B8A8760010E867C4FFFF33C05568C278001064FF306489208D55F033C0E893C8FFFF8B45F0E887CBFFFFA308A5001033C05568A578001064FF30648920A108A50010E8FAC9FFFF83F8FF750AE888B2FFFFE91B010000C70514A5001032000000A108A500108B1514A50010E8C9C9FFFFBA14A50010A108A50010B904000000E8C5C9FFFF833D14A5001032770AE847B2FFFFE9DA000000A108A500108B1514A50010E892C9FFFFBA18A5|";sid: 2009667; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[MS Visual C++ v.8 DLL (h-small sig1)] binary file"; flow:established,to_server; content: "|8BFF558BEC837D0C017505E8|";content: "|FF5DE9D6FEFFFFCCCCCCCCCC|"; distance: 13; within: 12;sid: 2009668; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[MS Visual C++ v.8 DLL (h-small sig2)] binary file"; flow:established,to_server; content: "|8BFF558BEC538B5D08568B750C85F6578B7D100F84|";content: "|000083FE01|"; distance: 22; within: 5;sid: 2009669; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[mucki's protector I -> mucki] binary file"; flow:established,to_server; content: "|BE|";content: "|B9|"; distance: 3; within: 1;content: "|8A06F6D0880646E2F7E9|"; distance: 3; within: 10;sid: 2009670; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[mucki's protector II -> mucki] binary file"; flow:established,to_server; content: "|E8240000008B4C240CC70117000100C781B80000000000000031C0894114894118806A00E885C07412648B3D180000008B7F300FB6470285C07401C3C70424|";content: "|BE|"; distance: 65; within: 1;content: "|B9|"; distance: 3; within: 1;content: "|8A06F6D0880646E2F7C3|"; distance: 3; within: 10;sid: 2009671; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[MZ0oPE 1.0.6b --> TaskFall] binary file"; flow:established,to_server; content: "|EBCA890383C30487FE32C0AE75FD87FE803EFF75E2465B83C304538B1B803FFF75C98BE56168|";content: "|C3|"; distance: 40; within: 1;sid: 2009672; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[MZ0oPE 1.0.6b -> TaskFall] binary file"; flow:established,to_server; content: "|EBCA890383C30487FE32C0AE75FD87FE803EFF75E2465B83C304538B1B803FFF75C98BE56168|";content: "|C3FCB28033DBA4B302E86D00000073F633C9E864000000731C33C0E85B0000007323B30241B010E84F00000012C073F7753FAAEBD4E84D0000002BCB7510E842000000EB28ACD1E8744C13C9EB1C9148C1E008ACE82C0000003D007D0000730A80FC05730683F87F77024141958BC5B301568BF72BF0F3A45EEB8E02D275058A164612D2C333C941E8EEFFFFFF13C9E8E7FFFFFF72F2C3|"; distance: 40; within: 151;sid: 2009673; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[N-Joiner 0.1 (Asm Version) -> NEX] binary file"; flow:established,to_server; content: "|6A00680014400068001040006A00E8140000006A00E813000000CCFF25AC124000FF25B0124000FF25B4124000FF25B8124000FF25BC124000FF25C0124000FF25C4124000FF25C8124000FF25CC124000FF25D0124000FF25D4124000FF25D8124000FF25DC124000FF25E4124000FF25EC124000|";sid: 2009674; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[N-Joy 1.0 -> NEX] binary file"; flow:established,to_server; content: "|558BEC83C4F0B89C3B4000E88CFCFFFF6A0068E43940006A0A6A00E840FDFFFFE8EFF5FFFF8D4000|";sid: 2009675; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[N-Joy 1.1 -> NEX] binary file"; flow:established,to_server; content: "|558BEC83C4F0B80C3C4000E824FCFFFF6A0068283A40006A0A6A00E8D8FCFFFFE87FF5FFFF8D4000|";sid: 2009676; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[N-Joy 1.2 -> NEX] binary file"; flow:established,to_server; content: "|558BEC83C4F0B8A4324000E8E8F1FFFF6A0068542A40006A0A6A00E8A8F2FFFFE8C7EAFFFF8D4000|";sid: 2009677; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[N-Joy 1.3 -> NEX] binary file"; flow:established,to_server; content: "|558BEC83C4F0B848364000E854EEFFFF6A0068D82B40006A0A6A00E82CEFFFFFE823E7FFFF8D4000|";sid: 2009678; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Nakedbind 1.0 -> nakedcrew] binary file"; flow:established,to_server; content: "|648B38488BC8F2AFAF8B1F6633DB66813B4D5A740881EB0000|";sid: 2009679; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Native UD Packer 1.1 (Modded Poison Ivy Shellcode) -> okkixot] binary file"; flow:established,to_server; content: "|31C031DB31C9EB0E6A006A006A006A00FF1528414000FF159440400089C76888130000FF1598404000FF159440400081C78813000039F87305E9840000006A406800100000FF35043040006A00FF15A440400089C7FF350430400068CA10400050FF15A84040006A406800100000FF35083040006A00FF15A440400089C66800304000FF350430400057FF3508304000506A02FF154E4140006A006A006A00566A006A00FF159C404000506A006A006A1150FF154A414000586AFF50FF15AC4040006A00FF15A040|";sid: 2009680; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[nbuild v1.0 [soft]] binary file"; flow:established,to_server; content: "|B9|";content: "|BB|"; distance: 2; within: 1;content: "|C0|"; distance: 2; within: 1;content: "|80|"; distance: 2; within: 1;content: "|43E2|"; distance: 2; within: 2;sid: 2009681; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[NeoLite v1.0] binary file"; flow:established,to_server; content: "|8B4424048D5424FC2305|";content: "|E8|"; distance: 12; within: 1;content: "|FF35|"; distance: 3; within: 2;content: "|50FF25|"; distance: 4; within: 3;sid: 2009682; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[NeoLite v2.0] binary file"; flow:established,to_server; content: "|E9|";content: "|4E656F4C697465|"; distance: 15; within: 7;sid: 2009683; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[NeoLite v2.00] binary file"; flow:established,to_server; content: "|8B4424042305|";content: "|50E8|"; distance: 8; within: 2;content: "|83C404FE05|"; distance: 4; within: 5;content: "|0BC074|"; distance: 7; within: 3;sid: 2009684; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[NFO v1.0] binary file"; flow:established,to_server; content: "|8D50122BC9B11E8A023477880242E2F7C88C|";sid: 2009685; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Ningishzida 1.0 -> CyberDoom] binary file"; flow:established,to_server; content: "|9C6096E8000000005D81ED03254000B9041B00008DBD4B2540008BF7AC|";content: "|AAE2CC|"; distance: 53; within: 3;sid: 2009686; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[NoodleCrypt v2.0] binary file"; flow:established,to_server; content: "|EB019AE83D000000EB019AE8EB010000EB019AE82C040000EB01|";sid: 2009687; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[NoodleCrypt v2.00 (Eng) -> NoodleSpa] binary file"; flow:established,to_server; content: "|EB019AE876000000EB019AE865000000EB019AE87D000000EB019AE855000000EB019AE843040000EB019AE8E1000000EB019AE83D000000EB019AE8EB010000EB019AE82C040000EB019AE825000000EB019AE802|";sid: 2009688; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Noodlecrypt2 -> r!sc] binary file"; flow:established,to_server; content: "|EB019AE876000000|";sid: 2009689; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[North Star PE Shrinker 1.3 -> Liuxingping] binary file"; flow:established,to_server; content: "|9C60E8000000005DB8B38540002DAC8540002BE88DB5|";sid: 2009690; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[nPack 1.1.150.2006.Beta -> NEOx] binary file"; flow:established,to_server; content: "|833D|";content: "|7505E901000000C3E841000000B8|"; distance: 4; within: 14;content: "|2B05|"; distance: 16; within: 2;content: "|A3|"; distance: 4; within: 1;content: "|E85E000000E8E0010000E8EC060000E8F7050000A1|"; distance: 3; within: 21;content: "|C705|"; distance: 23; within: 2;content: "|0105|"; distance: 6; within: 2;content: "|FF35|"; distance: 4; within: 2;content: "|C3C3565768|"; distance: 4; within: 5;content: "|FF15|"; distance: 7; within: 2;content: "|8B35|"; distance: 4; within: 2;content: "|8BF868|"; distance: 4; within: 3;content: "|57FFD668|"; distance: 5; within: 4;content: "|57A3|"; distance: 6; within: 2;content: "|FFD65FA3|"; distance: 4; within: 4;content: "|5EC3|"; distance: 6; within: 2;sid: 2009691; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[nPack 1.1.300.2006 Beta -> NEOx] binary file"; flow:established,to_server; content: "|833D|";content: "|7505E901000000C3E846000000E873000000B8|"; distance: 4; within: 19;content: "|2B05|"; distance: 21; within: 2;content: "|A3|"; distance: 4; within: 1;content: "|E89C000000E82D020000E8DD060000E82C060000A1|"; distance: 3; within: 21;content: "|C705|"; distance: 23; within: 2;content: "|0105|"; distance: 6; within: 2;content: "|FF35|"; distance: 4; within: 2;content: "|C3C3565768|"; distance: 4; within: 5;content: "|FF15|"; distance: 7; within: 2;content: "|8B35|"; distance: 4; within: 2;content: "|8BF868|"; distance: 4; within: 3;content: "|57FFD668|"; distance: 5; within: 4;content: "|57A3|"; distance: 6; within: 2;content: "|FFD65FA3|"; distance: 4; within: 4;content: "|5EC3|"; distance: 6; within: 2;sid: 2009692; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[nPack v1.1 150-200 Beta -> NEOx] binary file"; flow:established,to_server; content: "|833D40|";content: "|007505E901000000C3E841000000B880|"; distance: 4; within: 16;content: "|2B0508|"; distance: 17; within: 3;content: "|A33C|"; distance: 4; within: 2;content: "|00E85E000000E8E0010000E8EC060000E8F7050000|"; distance: 3; within: 21;sid: 2009693; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[nPack v1.1 250 Beta -> NEOx] binary file"; flow:established,to_server; content: "|833D04|";content: "|007505E901000000C3E846000000E873000000B82E|"; distance: 4; within: 21;content: "|2B0508|"; distance: 22; within: 3;content: "|A300|"; distance: 4; within: 2;content: "|E89C000000E804020000E8FB060000E81B060000A100|"; distance: 3; within: 22;content: "|C70504|"; distance: 23; within: 3;content: "|01000000010500|"; distance: 4; within: 7;content: "|FF3500|"; distance: 8; within: 3;sid: 2009694; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[nPack V1.1.150.2006.Beta -> NEOx/[uinC]] binary file"; flow:established,to_server; content: "|833D40|";content: "|007505E901000000C3E841000000B880|"; distance: 4; within: 16;content: "|2B0508|"; distance: 17; within: 3;content: "|A33C|"; distance: 4; within: 2;content: "|E85E000000E8E0010000E8EC060000E8F7050000A13C|"; distance: 3; within: 22;content: "|C70540|"; distance: 23; within: 3;content: "|01000000010500|"; distance: 4; within: 7;content: "|FF3500|"; distance: 8; within: 3;content: "|C3C3|"; distance: 4; within: 2;sid: 2009695; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[nPack V1.1.200.2006.Beta -> NEOx/[uinC]] binary file"; flow:established,to_server; content: "|833D40|";content: "|007505E901000000C3E841000000B880|"; distance: 4; within: 16;content: "|2B0508|"; distance: 17; within: 3;content: "|A33C|"; distance: 4; within: 2;content: "|E85E000000E8EC010000E8F8060000E803060000A13C|"; distance: 3; within: 22;content: "|C70540|"; distance: 23; within: 3;content: "|01000000010500|"; distance: 4; within: 7;content: "|FF3500|"; distance: 8; within: 3;content: "|C3C3|"; distance: 4; within: 2;sid: 2009696; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[NSIS Installer --> NullSoft] binary file"; flow:established,to_server; content: "|83EC2053555633DB57895C2418C7442410|";content: "|C644241420FF153070400053FF158072400068|"; distance: 19; within: 19;content: "|68|"; distance: 21; within: 1;content: "|A3|"; distance: 3; within: 1;content: "|E8|"; distance: 3; within: 1;content: "|BE|"; distance: 3; within: 1;sid: 2009697; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[NsPack 1.4 -> Liuxingping] binary file"; flow:established,to_server; content: "|9C60E8000000005DB8|";content: "|40002D|"; distance: 10; within: 3;content: "|4000|"; distance: 4; within: 2;sid: 2009698; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[NsPack 2.9 -> North Star] binary file"; flow:established,to_server; content: "|9C60E8000000005DB8070000002BE88DB5|";content: "|FFFF8A063C0074128BF58DB5|"; distance: 18; within: 12;content: "|FFFF8A063C010F8442020000C606018BD52B95|"; distance: 13; within: 19;content: "|FFFF8995|"; distance: 20; within: 4;content: "|FFFF0195|"; distance: 5; within: 4;content: "|FFFF8DB5|"; distance: 5; within: 4;content: "|FFFF0116606A40680010000068001000006A00FF95|"; distance: 5; within: 21;content: "|FFFF85C00F846A0300008985|"; distance: 22; within: 12;content: "|FFFFE8000000005BB96803000003D95053E8B1020000618B368BFD03BD|"; distance: 13; within: 29;content: "|FFFF8BDF833F00750A83C704B900000000EB16B901000000033B83C304833B007436|"; distance: 30; within: 34;sid: 2009699; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[NsPack 3.0 -> North Star] binary file"; flow:established,to_server; content: "|9C60E8000000005DB8070000002BE88DB5|";content: "|FFFF668B066683F80074158BF58DB5|"; distance: 18; within: 15;content: "|FFFF668B066683F8010F8442020000C606018BD52B95|"; distance: 16; within: 22;content: "|FFFF8995|"; distance: 23; within: 4;content: "|FFFF0195|"; distance: 5; within: 4;content: "|FFFF8DB5|"; distance: 5; within: 4;content: "|FFFF0116606A40680010000068001000006A00FF95|"; distance: 5; within: 21;content: "|FFFF85C00F846A0300008985|"; distance: 22; within: 12;content: "|FFFFE8000000005BB96803000003D95053E8B1020000618B368BFD03BD|"; distance: 13; within: 29;content: "|FFFF8BDF833F00750A83C704B900000000EB16B901000000033B83C304833B007436|"; distance: 30; within: 34;sid: 2009700; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[NsPack 3.4 -> North Star] binary file"; flow:established,to_server; content: "|9C60E8000000005D83ED078D85|";content: "|FFFF8038010F8442020000C600018BD52B95|"; distance: 14; within: 18;content: "|FFFF8995|"; distance: 19; within: 4;content: "|FFFF0195|"; distance: 5; within: 4;content: "|FFFF8DB5|"; distance: 5; within: 4;content: "|FFFF0116606A40680010000068001000006A00FF95|"; distance: 5; within: 21;content: "|FFFF85C00F846A0300008985|"; distance: 22; within: 12;content: "|FFFFE8000000005BB96803000003D95053E8B1020000618B368BFD03BD|"; distance: 13; within: 29;content: "|FFFF8BDF833F00750A83C704B900000000EB16B901000000033B83C304833B00743601138B33037B0457515253FFB5|"; distance: 30; within: 47;content: "|FFFFFFB5|"; distance: 48; within: 4;content: "|FFFF8BD68BCF8B85|"; distance: 5; within: 8;content: "|FFFF05AA050000FFD05B5A595F83F900740583C308EBC5|"; distance: 9; within: 23;sid: 2009701; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[NSPack 3.x -> Liu Xing Ping] binary file"; flow:established,to_server; content: "|9C60E8000000005D83ED078D85|";content: "|FFFF|"; distance: 14; within: 2;content: "|38010F84|"; distance: 2; within: 4;content: "|020000|"; distance: 4; within: 3;content: "|0001|"; distance: 3; within: 2;sid: 2009702; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[NsPack V1.1 -> LiuXingPing] binary file"; flow:established,to_server; content: "|9C60E8000000005DB8578440002D50844000|";sid: 2009703; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[NsPack V1.3 -> LiuXingPing] binary file"; flow:established,to_server; content: "|9C60E8000000005DB8B38540002DAC854000|";sid: 2009704; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[NsPack V1.4 -> LiuXingPing] binary file"; flow:established,to_server; content: "|9C60E8000000005DB8B18540002DAA854000|";sid: 2009705; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[NsPacK V3.0 -> LiuXingPing] binary file"; flow:established,to_server; content: "|9C60E8000000005DB8070000002BE88DB5|";content: "|668B066683F80074|"; distance: 19; within: 8;sid: 2009706; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[NsPacK V3.1 -> LiuXingPing] binary file"; flow:established,to_server; content: "|9C60E8000000005D83ED078D9D|";content: "|8A033C0074|"; distance: 15; within: 5;sid: 2009707; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[NsPack v3.1 -> North Star] binary file"; flow:established,to_server; content: "|9C60E8000000005D83ED078D9D|";content: "|FFFF8A033C0074108D9D|"; distance: 14; within: 10;content: "|FFFF8A033C010F8442020000C603018BD52B95|"; distance: 11; within: 19;content: "|FFFF8995|"; distance: 20; within: 4;content: "|FFFF0195|"; distance: 5; within: 4;content: "|FFFF8DB5|"; distance: 5; within: 4;content: "|FFFF0116606A40680010000068001000006A00|"; distance: 5; within: 19;sid: 2009708; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[NsPacK V3.3 -> LiuXingPing] binary file"; flow:established,to_server; content: "|9C60E8000000005D83ED078D85|";content: "|80380074|"; distance: 15; within: 4;sid: 2009709; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[NsPacK V3.4-V3.5 -> LiuXingPing] binary file"; flow:established,to_server; content: "|9C60E8000000005D83ED078D85|";content: "|8038010F84|"; distance: 15; within: 5;sid: 2009710; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[NsPacK V3.6 -> LiuXingPing] binary file"; flow:established,to_server; content: "|9C60E8000000005D83ED078D|";content: "|8338010F8447020000|"; distance: 14; within: 9;sid: 2009711; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[NsPacK V3.7 -> LiuXingPing] binary file"; flow:established,to_server; content: "|9C60E8000000005D83ED078D|";content: "|8039010F|"; distance: 14; within: 4;content: "|0000|"; distance: 5; within: 2;sid: 2009712; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[NTPacker 1.0 -> ErazerZ] binary file"; flow:established,to_server; content: "|558BEC83C4E05333C08945E08945E48945E88945ECB8|";content: "|4000E8|"; distance: 23; within: 3;content: "|FFFF33C05568|"; distance: 4; within: 6;content: "|400064FF306489208D4DECBA|"; distance: 7; within: 12;content: "|4000A1|"; distance: 13; within: 3;content: "|4000E8|"; distance: 4; within: 3;content: "|FCFFFF8B55ECB8|"; distance: 3; within: 7;content: "|4000E8|"; distance: 8; within: 3;content: "|FFFF8D4DE8BA|"; distance: 4; within: 6;content: "|4000A1|"; distance: 7; within: 3;content: "|4000E8|"; distance: 4; within: 3;content: "|FEFFFF8B55E8B8|"; distance: 3; within: 7;content: "|4000E8|"; distance: 8; within: 3;content: "|FFFFB8|"; distance: 4; within: 3;content: "|4000E8|"; distance: 4; within: 3;content: "|FBFFFF8BD8A1|"; distance: 3; within: 6;content: "|4000BA|"; distance: 7; within: 3;content: "|4000E8|"; distance: 4; within: 3;content: "|FFFF75268BD3A1|"; distance: 4; within: 7;content: "|4000E8|"; distance: 8; within: 3;content: "|FFFF84C0752A8D55E433C0E8|"; distance: 4; within: 12;content: "|FFFF8B45E48BD3E8|"; distance: 13; within: 8;content: "|FFFFEB148D55E033C0E8|"; distance: 9; within: 10;content: "|FFFF8B45E08BD3E8|"; distance: 11; within: 8;content: "|FFFF6A00E8|"; distance: 9; within: 5;content: "|FFFF33C05A595964891068|"; distance: 6; within: 11;content: "|40008D45E0BA04000000E8|"; distance: 12; within: 11;content: "|FFFFC3E9|"; distance: 12; within: 4;content: "|FFFFEBEB5BE8|"; distance: 5; within: 6;content: "|FFFF000000FFFFFFFF0100000025000000FFFFFFFF010000005C000000FFFFFFFF060000005345525645520000FFFFFFFF0100000031|"; distance: 7; within: 54;sid: 2009713; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Nullsoft Install System v1.98] binary file"; flow:established,to_server; content: "|83EC0C535657FF152C8140|";sid: 2009714; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Nullsoft Install System v1.xx] binary file"; flow:established,to_server; content: "|558BEC83EC2C535633F657568975DC8975F4BBA49E4000FF1560704000BFC0B2400068040100005750A3ACB24000FF154C70400056566A03566A01680000008057FF159C7040008BF883FFFF897DEC0F84C3000000|";sid: 2009715; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Nullsoft Install System v1.xx] binary file"; flow:established,to_server; content: "|83EC0C535657FF152071400005E8030000BE60FD410089442410B320FF15287040006800040000FF15287140005056FF1508714000803D60FD410022750880C302BE61FD41008A068B3DF071400084C0740F3AC374|";sid: 2009716; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Nullsoft Install System v2.0b2, v2.0b3] binary file"; flow:established,to_server; content: "|83EC0C53555657FF15|";content: "|7040008B35|"; distance: 9; within: 5;content: "|92400005E803000089442414B320FF152C704000BF0004000068|"; distance: 5; within: 26;content: "|0057FF15|"; distance: 27; within: 4;content: "|400057FF15|"; distance: 5; within: 5;sid: 2009717; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Nullsoft PIMP Install System v1.3x] binary file"; flow:established,to_server; content: "|558BEC81EC|";content: "|000056576A|"; distance: 6; within: 5;content: "|BE|"; distance: 5; within: 1;content: "|598DBD|"; distance: 3; within: 3;sid: 2009718; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Nullsoft PIMP Install System v1.x] binary file"; flow:established,to_server; content: "|83EC5C53555657FF15|";content: "|00|"; distance: 10; within: 1;sid: 2009719; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[NX PE Packer v1.0] binary file"; flow:established,to_server; content: "|FF60FFCAFF00BADC0DE040005000600070008000|";sid: 2009720; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium 1.2.0.0 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB02|";content: "|E83F1E0000|"; distance: 3; within: 5;sid: 2009721; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium 1.2.5.8 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB01|";content: "|E829000000EB02|"; distance: 2; within: 7;content: "|EB01|"; distance: 8; within: 2;content: "|8B54240CEB04|"; distance: 2; within: 6;content: "|8382B800000024EB04|"; distance: 8; within: 9;content: "|33C0EB02|"; distance: 11; within: 4;content: "|C3EB02|"; distance: 5; within: 3;content: "|EB03|"; distance: 4; within: 2;content: "|6467FF360000EB01|"; distance: 3; within: 8;content: "|646789260000EB03|"; distance: 8; within: 8;content: "|EB01|"; distance: 9; within: 2;content: "|50EB03|"; distance: 2; within: 3;content: "|33C0EB04|"; distance: 4; within: 4;content: "|8B00EB03|"; distance: 6; within: 4;content: "|C3EB01|"; distance: 5; within: 3;content: "|E9FA000000EB02|"; distance: 3; within: 7;content: "|E8D5FFFFFFEB04|"; distance: 8; within: 7;content: "|EB03|"; distance: 9; within: 2;content: "|EB01|"; distance: 3; within: 2;content: "|58EB01|"; distance: 2; within: 3;content: "|EB02|"; distance: 3; within: 2;content: "|64678F060000EB04|"; distance: 3; within: 8;content: "|83C404EB01|"; distance: 10; within: 5;content: "|E87B210000|"; distance: 5; within: 5;sid: 2009722; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium 1.3.0.0 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB04|";content: "|E829000000EB02|"; distance: 4; within: 7;content: "|EB01|"; distance: 8; within: 2;content: "|8B54240CEB02|"; distance: 2; within: 6;content: "|8382B800000022EB02|"; distance: 7; within: 9;content: "|33C0EB04|"; distance: 10; within: 4;content: "|C3EB04|"; distance: 6; within: 3;content: "|EB04|"; distance: 5; within: 2;content: "|6467FF360000EB04|"; distance: 4; within: 8;content: "|646789260000EB04|"; distance: 10; within: 8;content: "|EB01|"; distance: 10; within: 2;content: "|50EB03|"; distance: 2; within: 3;content: "|33C0EB02|"; distance: 4; within: 4;content: "|8B00EB01|"; distance: 5; within: 4;content: "|C3EB04|"; distance: 4; within: 3;content: "|E9FA000000EB01|"; distance: 5; within: 7;content: "|E8D5FFFFFFEB02|"; distance: 7; within: 7;content: "|EB03|"; distance: 8; within: 2;content: "|58EB04|"; distance: 3; within: 3;content: "|EB01|"; distance: 5; within: 2;content: "|64678F060000EB02|"; distance: 2; within: 8;content: "|83C404EB02|"; distance: 9; within: 5;content: "|E847260000|"; distance: 6; within: 5;sid: 2009723; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium 1.3.0.13 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB01|";content: "|E826000000EB02|"; distance: 2; within: 7;content: "|EB02|"; distance: 8; within: 2;content: "|8B54240CEB01|"; distance: 3; within: 6;content: "|8382B800000021EB04|"; distance: 6; within: 9;content: "|33C0EB02|"; distance: 11; within: 4;content: "|C3EB01|"; distance: 5; within: 3;content: "|EB04|"; distance: 3; within: 2;content: "|6467FF360000EB02|"; distance: 4; within: 8;content: "|646789260000EB01|"; distance: 9; within: 8;content: "|EB03|"; distance: 8; within: 2;content: "|50EB01|"; distance: 3; within: 3;content: "|33C0EB03|"; distance: 3; within: 4;content: "|8B00EB02|"; distance: 5; within: 4;content: "|C3EB02|"; distance: 5; within: 3;content: "|E9FA000000EB01|"; distance: 4; within: 7;content: "|E8D5FFFFFFEB03|"; distance: 7; within: 7;content: "|EB02|"; distance: 8; within: 2;content: "|58EB03|"; distance: 3; within: 3;content: "|EB04|"; distance: 4; within: 2;content: "|64678F060000EB03|"; distance: 4; within: 8;content: "|83C404EB03|"; distance: 9; within: 5;content: "|E813260000|"; distance: 6; within: 5;sid: 2009724; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium 1.3.0.17 -> Obsidium software] binary file"; flow:established,to_server; content: "|EB02|";content: "|E828000000EB04|"; distance: 3; within: 7;content: "|EB01|"; distance: 9; within: 2;content: "|8B54240CEB01|"; distance: 2; within: 6;content: "|8382B800000025EB02|"; distance: 6; within: 9;content: "|33C0EB03|"; distance: 10; within: 4;content: "|C3EB03|"; distance: 5; within: 3;content: "|EB02|"; distance: 4; within: 2;content: "|6467FF360000EB01|"; distance: 3; within: 8;content: "|646789260000EB03|"; distance: 8; within: 8;content: "|EB04|"; distance: 9; within: 2;content: "|50EB04|"; distance: 4; within: 3;sid: 2009725; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium 1.3.0.21 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB03|";content: "|E82E000000EB04|"; distance: 3; within: 7;content: "|EB04|"; distance: 9; within: 2;content: "|8B54240CEB04|"; distance: 4; within: 6;content: "|8382B800000023EB01|"; distance: 8; within: 9;content: "|33C0EB04|"; distance: 9; within: 4;content: "|C3EB03|"; distance: 6; within: 3;content: "|EB02|"; distance: 4; within: 2;content: "|6467FF360000EB01|"; distance: 3; within: 8;content: "|646789260000EB02|"; distance: 8; within: 8;content: "|EB02|"; distance: 9; within: 2;content: "|50EB01|"; distance: 3; within: 3;content: "|33C0EB03|"; distance: 3; within: 4;content: "|8B00EB03|"; distance: 5; within: 4;content: "|C3EB03|"; distance: 5; within: 3;content: "|E9FA000000EB04|"; distance: 4; within: 7;content: "|E8D5FFFFFFEB01|"; distance: 9; within: 7;content: "|EB01|"; distance: 7; within: 2;content: "|58EB04|"; distance: 2; within: 3;content: "|EB04|"; distance: 5; within: 2;content: "|64678F060000EB03|"; distance: 4; within: 8;content: "|83C404EB04|"; distance: 9; within: 5;content: "|E82B260000|"; distance: 7; within: 5;sid: 2009726; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium 1.3.0.37 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB02|";content: "|E826000000EB03|"; distance: 3; within: 7;content: "|EB01|"; distance: 8; within: 2;content: "|8B54240CEB04|"; distance: 2; within: 6;content: "|8382B800000026EB01|"; distance: 8; within: 9;content: "|33C0EB02|"; distance: 9; within: 4;content: "|C3EB01|"; distance: 5; within: 3;content: "|EB04|"; distance: 3; within: 2;content: "|6467FF360000EB01|"; distance: 4; within: 8;content: "|646789260000EB01|"; distance: 8; within: 8;content: "|EB03|"; distance: 8; within: 2;content: "|50EB03|"; distance: 3; within: 3;content: "|33C0EB03|"; distance: 4; within: 4;content: "|8B00EB04|"; distance: 5; within: 4;content: "|C3EB03|"; distance: 6; within: 3;content: "|E9FA000000EB03|"; distance: 4; within: 7;content: "|E8D5FFFFFFEB04|"; distance: 8; within: 7;content: "|EB01|"; distance: 9; within: 2;content: "|58EB02|"; distance: 2; within: 3;content: "|EB03|"; distance: 4; within: 2;content: "|64678F060000EB01|"; distance: 3; within: 8;content: "|83C404EB03|"; distance: 8; within: 5;content: "|E823270000|"; distance: 6; within: 5;sid: 2009727; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium 1.3.1.1 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB02|";content: "|E827000000EB02|"; distance: 3; within: 7;content: "|EB03|"; distance: 8; within: 2;content: "|8B54240CEB01|"; distance: 3; within: 6;content: "|8382B800000022EB04|"; distance: 6; within: 9;content: "|33C0EB01|"; distance: 11; within: 4;content: "|C3EB02|"; distance: 4; within: 3;content: "|EB02|"; distance: 4; within: 2;content: "|6467FF360000EB04|"; distance: 3; within: 8;content: "|646789260000EB01|"; distance: 10; within: 8;content: "|EB03|"; distance: 8; within: 2;content: "|50EB03|"; distance: 3; within: 3;content: "|33C0EB01|"; distance: 4; within: 4;content: "|8B00EB03|"; distance: 4; within: 4;content: "|C3EB01|"; distance: 5; within: 3;content: "|E9FA000000EB03|"; distance: 3; within: 7;content: "|E8D5FFFFFFEB01|"; distance: 8; within: 7;content: "|EB03|"; distance: 7; within: 2;content: "|58EB03|"; distance: 3; within: 3;content: "|EB01|"; distance: 4; within: 2;content: "|64678F060000EB01|"; distance: 2; within: 8;content: "|83C404EB03|"; distance: 8; within: 5;sid: 2009728; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium 1.3.2.2 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB04|";content: "|E82A000000EB03|"; distance: 4; within: 7;content: "|EB04|"; distance: 8; within: 2;content: "|8B54240CEB02|"; distance: 4; within: 6;content: "|8382B800000026EB04|"; distance: 7; within: 9;content: "|33C0EB02|"; distance: 11; within: 4;content: "|C3EB01|"; distance: 5; within: 3;content: "|EB03|"; distance: 3; within: 2;content: "|6467FF360000EB02|"; distance: 3; within: 8;content: "|646789260000EB02|"; distance: 9; within: 8;content: "|EB01|"; distance: 9; within: 2;content: "|50EB04|"; distance: 2; within: 3;content: "|33C0EB04|"; distance: 5; within: 4;content: "|8B00EB02|"; distance: 6; within: 4;content: "|C3EB03|"; distance: 5; within: 3;content: "|E9FA000000EB04|"; distance: 4; within: 7;content: "|E8D5FFFFFFEB02|"; distance: 9; within: 7;content: "|EB04|"; distance: 8; within: 2;content: "|58EB01|"; distance: 4; within: 3;content: "|EB01|"; distance: 3; within: 2;content: "|64678F060000EB01|"; distance: 2; within: 8;content: "|83C404EB04|"; distance: 8; within: 5;sid: 2009729; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium 1.3.3.1 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB01|";content: "|E829000000EB02|"; distance: 2; within: 7;content: "|EB03|"; distance: 8; within: 2;content: "|8B54240CEB02|"; distance: 3; within: 6;content: "|8382B800000024EB04|"; distance: 7; within: 9;content: "|33C0EB02|"; distance: 11; within: 4;content: "|C3EB02|"; distance: 5; within: 3;content: "|EB02|"; distance: 4; within: 2;content: "|6467FF360000EB04|"; distance: 3; within: 8;content: "|646789260000EB01|"; distance: 10; within: 8;content: "|EB02|"; distance: 8; within: 2;content: "|50EB01|"; distance: 3; within: 3;content: "|33C0EB04|"; distance: 3; within: 4;content: "|8B00EB03|"; distance: 6; within: 4;content: "|C3EB03|"; distance: 5; within: 3;content: "|E9FA000000EB02|"; distance: 4; within: 7;content: "|E8D5FFFFFFEB01|"; distance: 8; within: 7;content: "|EB04|"; distance: 7; within: 2;content: "|58EB02|"; distance: 4; within: 3;content: "|EB04|"; distance: 4; within: 2;content: "|64678F060000EB01|"; distance: 4; within: 8;content: "|83C404EB02|"; distance: 8; within: 5;content: "|E85F270000|"; distance: 6; within: 5;sid: 2009730; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium 1.3.3.2 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB01|";content: "|E82B000000EB02|"; distance: 2; within: 7;content: "|EB02|"; distance: 8; within: 2;content: "|8B54240CEB03|"; distance: 3; within: 6;content: "|8382B800000024EB04|"; distance: 7; within: 9;content: "|33C0EB04|"; distance: 11; within: 4;content: "|C3EB02|"; distance: 6; within: 3;content: "|EB01|"; distance: 4; within: 2;content: "|6467FF360000EB03|"; distance: 2; within: 8;content: "|646789260000EB01|"; distance: 9; within: 8;content: "|EB02|"; distance: 8; within: 2;content: "|50EB02|"; distance: 3; within: 3;content: "|33C0EB02|"; distance: 4; within: 4;content: "|8B00EB02|"; distance: 5; within: 4;content: "|C3EB04|"; distance: 5; within: 3;content: "|E9FA000000EB03|"; distance: 5; within: 7;content: "|E8D5FFFFFFEB03|"; distance: 8; within: 7;content: "|EB01|"; distance: 8; within: 2;content: "|58EB01|"; distance: 2; within: 3;content: "|EB02|"; distance: 3; within: 2;content: "|64678F060000EB02|"; distance: 3; within: 8;content: "|83C404EB02|"; distance: 9; within: 5;content: "|E83B270000|"; distance: 6; within: 5;sid: 2009731; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium 1.3.3.3 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB02|";content: "|E829000000EB03|"; distance: 3; within: 7;content: "|EB03|"; distance: 8; within: 2;content: "|8B54240CEB01|"; distance: 3; within: 6;content: "|8382B800000028EB03|"; distance: 6; within: 9;content: "|33C0EB01|"; distance: 10; within: 4;content: "|C3EB04|"; distance: 4; within: 3;content: "|EB02|"; distance: 5; within: 2;content: "|6467FF360000EB04|"; distance: 3; within: 8;content: "|646789260000EB02|"; distance: 10; within: 8;content: "|EB04|"; distance: 9; within: 2;content: "|50EB04|"; distance: 4; within: 3;sid: 2009732; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium 1.3.3.3 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB02|";content: "|E829000000EB03|"; distance: 3; within: 7;content: "|EB03|"; distance: 8; within: 2;content: "|8B54240CEB01|"; distance: 3; within: 6;content: "|8382B800000028EB03|"; distance: 6; within: 9;content: "|33C0EB01|"; distance: 10; within: 4;content: "|C3EB04|"; distance: 4; within: 3;content: "|EB02|"; distance: 5; within: 2;content: "|6467FF360000EB04|"; distance: 3; within: 8;content: "|646789260000EB02|"; distance: 10; within: 8;content: "|EB04|"; distance: 9; within: 2;content: "|50EB04|"; distance: 4; within: 3;content: "|33C0EB01|"; distance: 5; within: 4;content: "|8B00EB03|"; distance: 4; within: 4;content: "|C3EB03|"; distance: 5; within: 3;content: "|E9FA000000EB03|"; distance: 4; within: 7;content: "|E8D5FFFFFFEB04|"; distance: 8; within: 7;content: "|EB04|"; distance: 9; within: 2;content: "|58EB01|"; distance: 4; within: 3;content: "|EB03|"; distance: 3; within: 2;content: "|64678F060000EB04|"; distance: 3; within: 8;content: "|83C404EB04|"; distance: 10; within: 5;content: "|E82B27|"; distance: 7; within: 3;sid: 2009733; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium 1.3.3.4 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB02|";content: "|E829000000EB03|"; distance: 3; within: 7;content: "|EB02|"; distance: 8; within: 2;content: "|8B54240CEB03|"; distance: 3; within: 6;content: "|8382B800000025EB02|"; distance: 7; within: 9;content: "|33C0EB02|"; distance: 10; within: 4;content: "|C3EB03|"; distance: 5; within: 3;content: "|EB01|"; distance: 4; within: 2;content: "|6467FF360000EB02|"; distance: 2; within: 8;content: "|646789260000EB02|"; distance: 9; within: 8;content: "|EB04|"; distance: 9; within: 2;content: "|50EB02|"; distance: 4; within: 3;content: "|33|"; distance: 4; within: 1;sid: 2009734; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium 1.3.3.4 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB02|";content: "|E829000000EB03|"; distance: 3; within: 7;content: "|EB02|"; distance: 8; within: 2;content: "|8B54240CEB03|"; distance: 3; within: 6;content: "|8382B800000025EB02|"; distance: 7; within: 9;content: "|33C0EB02|"; distance: 10; within: 4;content: "|C3EB03|"; distance: 5; within: 3;content: "|EB01|"; distance: 4; within: 2;content: "|6467FF360000EB02|"; distance: 2; within: 8;content: "|646789260000EB02|"; distance: 9; within: 8;content: "|EB04|"; distance: 9; within: 2;content: "|50EB02|"; distance: 4; within: 3;content: "|33C0EB01|"; distance: 4; within: 4;content: "|8B00EB04|"; distance: 4; within: 4;content: "|C3EB03|"; distance: 6; within: 3;content: "|E9FA000000EB02|"; distance: 4; within: 7;content: "|E8D5FFFFFFEB02|"; distance: 8; within: 7;content: "|EB03|"; distance: 8; within: 2;content: "|58EB02|"; distance: 3; within: 3;content: "|EB03|"; distance: 4; within: 2;content: "|64678F060000EB03|"; distance: 3; within: 8;sid: 2009735; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium 1.3.3.7 (2007.06.23) -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB02|";content: "|E827000000EB03|"; distance: 3; within: 7;content: "|EB01|"; distance: 8; within: 2;content: "|8B54240CEB03|"; distance: 2; within: 6;content: "|8382B800000023EB03|"; distance: 7; within: 9;content: "|33C0EB02|"; distance: 10; within: 4;content: "|C3EB01|"; distance: 5; within: 3;content: "|EB03|"; distance: 3; within: 2;content: "|6467FF360000EB04|"; distance: 3; within: 8;content: "|646789260000EB01|"; distance: 10; within: 8;content: "|EB01|"; distance: 8; within: 2;content: "|50EB02|"; distance: 2; within: 3;content: "|33C0EB01|"; distance: 4; within: 4;content: "|8B00EB04|"; distance: 4; within: 4;content: "|C3EB02|"; distance: 6; within: 3;content: "|E9FA000000EB04|"; distance: 4; within: 7;content: "|E8D5FFFFFFEB01|"; distance: 9; within: 7;content: "|EB01|"; distance: 7; within: 2;content: "|58EB04|"; distance: 2; within: 3;content: "|EB01|"; distance: 5; within: 2;content: "|64678F060000EB02|"; distance: 2; within: 8;content: "|83C404EB01|"; distance: 9; within: 5;content: "|E8F7260000|"; distance: 5; within: 5;sid: 2009736; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium 1.3.3.7 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB02|";content: "|E82C000000EB04|"; distance: 3; within: 7;content: "|EB04|"; distance: 9; within: 2;content: "|8B54240CEB02|"; distance: 4; within: 6;content: "|8382B800000027EB04|"; distance: 7; within: 9;content: "|33C0EB02|"; distance: 11; within: 4;content: "|C3EB02|"; distance: 5; within: 3;content: "|EB03|"; distance: 4; within: 2;content: "|6467FF360000EB04|"; distance: 3; within: 8;content: "|646789260000EB03|"; distance: 10; within: 8;content: "|EB01|"; distance: 9; within: 2;content: "|50EB02|"; distance: 2; within: 3;content: "|33C0EB02|"; distance: 4; within: 4;content: "|8B00EB04|"; distance: 5; within: 4;content: "|C3EB02|"; distance: 6; within: 3;content: "|E9FA000000EB04|"; distance: 4; within: 7;content: "|E8D5FFFFFFEB02|"; distance: 9; within: 7;content: "|EB04|"; distance: 8; within: 2;content: "|58EB04|"; distance: 4; within: 3;content: "|EB03|"; distance: 5; within: 2;content: "|64678F060000EB01|"; distance: 3; within: 8;content: "|83C404EB03|"; distance: 8; within: 5;content: "|E823270000|"; distance: 6; within: 5;sid: 2009737; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium 1.3.3.8 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB04|";content: "|E828000000EB01|"; distance: 4; within: 7;content: "|EB01|"; distance: 7; within: 2;content: "|8B54240CEB04|"; distance: 2; within: 6;content: "|8382B8000000|"; distance: 8; within: 6;content: "|EB04|"; distance: 6; within: 2;content: "|33C0EB03|"; distance: 4; within: 4;content: "|C3EB01|"; distance: 5; within: 3;content: "|EB01|"; distance: 3; within: 2;content: "|6467FF360000EB03|"; distance: 2; within: 8;content: "|646789260000EB02|"; distance: 9; within: 8;content: "|EB01|"; distance: 9; within: 2;content: "|50EB04|"; distance: 2; within: 3;content: "|33C0EB02|"; distance: 5; within: 4;content: "|8B00EB03|"; distance: 5; within: 4;content: "|C3EB03|"; distance: 5; within: 3;content: "|E9FA000000EB03|"; distance: 4; within: 7;content: "|E8D5FFFFFFEB02|"; distance: 8; within: 7;content: "|EB04|"; distance: 8; within: 2;content: "|58EB04|"; distance: 4; within: 3;content: "|EB02|"; distance: 5; within: 2;content: "|64678F060000EB04|"; distance: 3; within: 8;content: "|83C404EB04|"; distance: 10; within: 5;content: "|E857270000|"; distance: 7; within: 5;sid: 2009738; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium 1.3.3.9 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB02|";content: "|E829000000EB03|"; distance: 3; within: 7;content: "|EB01|"; distance: 8; within: 2;content: "|8B54240CEB04|"; distance: 2; within: 6;content: "|8382B800000028EB02|"; distance: 8; within: 9;content: "|33C0EB02|"; distance: 10; within: 4;content: "|C3EB03|"; distance: 5; within: 3;content: "|EB04|"; distance: 4; within: 2;content: "|6467FF360000EB03|"; distance: 4; within: 8;content: "|646789260000EB01|"; distance: 9; within: 8;content: "|EB01|"; distance: 8; within: 2;content: "|50EB03|"; distance: 2; within: 3;content: "|33C0EB03|"; distance: 4; within: 4;content: "|8B00EB04|"; distance: 5; within: 4;content: "|C3EB04|"; distance: 6; within: 3;content: "|E9FA000000EB03|"; distance: 5; within: 7;content: "|E8D5FFFFFFEB02|"; distance: 8; within: 7;content: "|EB04|"; distance: 8; within: 2;content: "|58EB03|"; distance: 4; within: 3;content: "|EB04|"; distance: 4; within: 2;content: "|64678F060000EB03|"; distance: 4; within: 8;content: "|83C404EB04|"; distance: 9; within: 5;content: "|E8CF270000|"; distance: 7; within: 5;sid: 2009739; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium 1.3.4.1 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB01|";content: "|E82A000000EB04|"; distance: 2; within: 7;content: "|EB02|"; distance: 9; within: 2;content: "|8B54240CEB03|"; distance: 3; within: 6;content: "|8382B800000021EB02|"; distance: 7; within: 9;content: "|33C0EB03|"; distance: 10; within: 4;content: "|C3EB02|"; distance: 5; within: 3;content: "|EB01|"; distance: 4; within: 2;content: "|6467FF360000EB01|"; distance: 2; within: 8;content: "|646789260000EB02|"; distance: 8; within: 8;content: "|EB03|"; distance: 9; within: 2;content: "|50EB04|"; distance: 3; within: 3;content: "|33C0EB02|"; distance: 5; within: 4;content: "|8B00EB04|"; distance: 5; within: 4;content: "|C3EB02|"; distance: 6; within: 3;content: "|E9FA000000EB02|"; distance: 4; within: 7;content: "|E8D5FFFFFFEB01|"; distance: 8; within: 7;content: "|EB01|"; distance: 7; within: 2;content: "|58EB03|"; distance: 2; within: 3;content: "|EB04|"; distance: 4; within: 2;content: "|64678F060000EB04|"; distance: 4; within: 8;content: "|83C404EB02|"; distance: 10; within: 5;content: "|E8C3270000|"; distance: 6; within: 5;sid: 2009740; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium v1.1.1.1] binary file"; flow:established,to_server; content: "|EB02|";content: "|E8E71C0000|"; distance: 3; within: 5;sid: 2009741; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium V1.2 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB02|";content: "|E8771E0000|"; distance: 3; within: 5;sid: 2009742; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium v1.2.5.0 -> Obsidium Software] binary file"; flow:established,to_server; content: "|E80E0000008B54240C8382B80000000D33C0C36467FF3600006467892600005033C08B00C3E9FA000000E8D5FFFFFF5864678F06000083C404E82B130000|";sid: 2009743; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium V1.2.5.8 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB01|";content: "|E8|"; distance: 2; within: 1;content: "|000000|"; distance: 1; within: 3;sid: 2009744; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium V1.2.5.8-V1.3.3.X -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB01|";content: "|E8|"; distance: 2; within: 1;content: "|000000EB02|"; distance: 1; within: 5;content: "|EB|"; distance: 6; within: 1;sid: 2009745; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium V1.2.X -> Obsidium Software] binary file"; flow:established,to_server; content: "|E80E00000033C08B54240C8382B80000000DC36467FF3600006467892600005033C08B00C3E9FA000000E8D5FFFFFF5864678F06000083C404E82B130000|";sid: 2009746; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium V1.25 -> Obsidium Software] binary file"; flow:established,to_server; content: "|E80E0000008B54240C8382B80000000D33C0C3|";sid: 2009747; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium v1.3.0.0 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB04258034CAE829000000EB02C181EB013A8B54240CEB0232928382B800000022EB02F27F33C0EB04657E1479C3EB0405AD7F45EB0405650BE86467FF360000EB040DF6A87F646789260000EB048D68C7FBEB016B|";sid: 2009748; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium v1.3.0.0 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB04258034CAE829000000EB02C181EB013A8B54240CEB0232928382B800000022EB02F27F33C0EB04657E1479C3EB0405AD7F45EB0405650BE86467FF360000EB040DF6A87F646789260000EB048D68C7FBEB016B50EB038A0B9333C0EB0228B98B00EB0104C3EB0465B3540AE9FA000000EB01A2E8D5FFFFFFEB022B49EB037C3E7658EB04B8949256EB017264678F060000EB02237283C404EB02A9CBE847260000|";sid: 2009749; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium V1.3.0.0 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB04|";content: "|E829000000|"; distance: 4; within: 5;sid: 2009750; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium V1.3.0.0 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB04|";content: "|E8|"; distance: 4; within: 1;content: "|000000|"; distance: 1; within: 3;sid: 2009751; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium v1.3.0.37 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB02|";content: "|E826000000EB03|"; distance: 3; within: 7;content: "|EB01|"; distance: 8; within: 2;content: "|8B54240CEB04|"; distance: 2; within: 6;content: "|8382B800000026EB01|"; distance: 8; within: 9;content: "|33C0EB02|"; distance: 9; within: 4;content: "|C3EB01|"; distance: 5; within: 3;content: "|EB04|"; distance: 3; within: 2;content: "|6467FF360000EB01|"; distance: 4; within: 8;content: "|646789260000EB01|"; distance: 8; within: 8;content: "|EB03|"; distance: 8; within: 2;content: "|50EB03|"; distance: 3; within: 3;content: "|33C0EB03|"; distance: 4; within: 4;content: "|8B00EB04|"; distance: 5; within: 4;content: "|C3EB03|"; distance: 6; within: 3;content: "|E9FA000000EB03|"; distance: 4; within: 7;content: "|E8D5FFFFFFEB04|"; distance: 8; within: 7;content: "|EB01|"; distance: 9; within: 2;content: "|58EB02|"; distance: 2; within: 3;content: "|EB03|"; distance: 4; within: 2;content: "|64678F060000EB01|"; distance: 3; within: 8;content: "|83C404EB03|"; distance: 8; within: 5;content: "|E82327|"; distance: 6; within: 3;sid: 2009752; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium v1.3.0.4 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB02|";content: "|E825000000EB04|"; distance: 3; within: 7;content: "|EB01|"; distance: 9; within: 2;content: "|8B54240CEB01|"; distance: 2; within: 6;content: "|8382B800000023EB01|"; distance: 6; within: 9;content: "|33C0EB02|"; distance: 9; within: 4;content: "|C3EB02|"; distance: 5; within: 3;content: "|EB04|"; distance: 4; within: 2;content: "|6467FF360000EB03|"; distance: 4; within: 8;content: "|646789260000EB02|"; distance: 9; within: 8;content: "|EB01|"; distance: 9; within: 2;content: "|50EB01|"; distance: 2; within: 3;content: "|33C0EB01|"; distance: 3; within: 4;sid: 2009753; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium v1.3.0.4 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB02|";content: "|E825000000EB04|"; distance: 3; within: 7;content: "|EB01|"; distance: 9; within: 2;content: "|8B54240CEB01|"; distance: 2; within: 6;content: "|8382B800000023EB01|"; distance: 6; within: 9;content: "|33C0EB02|"; distance: 9; within: 4;content: "|C3EB02|"; distance: 5; within: 3;content: "|EB04|"; distance: 4; within: 2;content: "|6467FF360000EB03|"; distance: 4; within: 8;content: "|646789260000EB02|"; distance: 9; within: 8;content: "|EB01|"; distance: 9; within: 2;content: "|50EB01|"; distance: 2; within: 3;content: "|33C0EB01|"; distance: 3; within: 4;content: "|8B00EB01|"; distance: 4; within: 4;content: "|C3EB02|"; distance: 4; within: 3;content: "|E9FA000000EB02|"; distance: 4; within: 7;content: "|E8D5FFFFFFEB03|"; distance: 8; within: 7;content: "|EB04|"; distance: 8; within: 2;content: "|58EB02|"; distance: 4; within: 3;content: "|EB04|"; distance: 4; within: 2;content: "|64678F060000EB03|"; distance: 4; within: 8;content: "|83C404EB01|"; distance: 9; within: 5;content: "|E83B260000|"; distance: 5; within: 5;sid: 2009754; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium V1.3.0.4 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB02|";content: "|E8|"; distance: 3; within: 1;content: "|000000|"; distance: 1; within: 3;sid: 2009755; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium V1.3.0.X -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB03|";content: "|E82E000000EB04|"; distance: 3; within: 7;content: "|EB04|"; distance: 9; within: 2;content: "|8B|"; distance: 4; within: 1;content: "|EB04|"; distance: 2; within: 2;content: "|83|"; distance: 4; within: 1;content: "|EB01|"; distance: 4; within: 2;content: "|33C0EB04|"; distance: 2; within: 4;content: "|C3|"; distance: 6; within: 1;sid: 2009756; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium V1.3.4.2 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB02|";content: "|E826000000EB03|"; distance: 3; within: 7;content: "|EB01|"; distance: 8; within: 2;content: "|8B54240CEB02|"; distance: 2; within: 6;content: "|8382B800000024EB03|"; distance: 7; within: 9;content: "|33C0EB01|"; distance: 10; within: 4;content: "|C3EB02|"; distance: 4; within: 3;content: "|EB02|"; distance: 4; within: 2;content: "|6467FF360000EB03|"; distance: 3; within: 8;content: "|646789260000EB03|"; distance: 9; within: 8;content: "|EB03|"; distance: 9; within: 2;content: "|50EB04|"; distance: 3; within: 3;content: "|33C0EB03|"; distance: 5; within: 4;content: "|8B00EB03|"; distance: 5; within: 4;content: "|C3EB03|"; distance: 5; within: 3;content: "|E9FA000000EB03|"; distance: 4; within: 7;content: "|E8D5FFFFFFEB01|"; distance: 8; within: 7;content: "|EB03|"; distance: 7; within: 2;content: "|58EB04|"; distance: 3; within: 3;content: "|EB04|"; distance: 5; within: 2;content: "|64678F060000EB04|"; distance: 4; within: 8;content: "|83C404EB01|"; distance: 10; within: 5;content: "|E8C3270000|"; distance: 5; within: 5;sid: 2009757; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsidium V1.3.5.0 -> Obsidium Software] binary file"; flow:established,to_server; content: "|EB03|";content: "|E8|"; distance: 3; within: 1;content: "|EB02|"; distance: 3; within: 2;content: "|EB04|"; distance: 3; within: 2;content: "|8B54240CEB04|"; distance: 4; within: 6;content: "|8382B800000020EB03|"; distance: 8; within: 9;content: "|33C0EB01|"; distance: 10; within: 4;content: "|C3EB02|"; distance: 4; within: 3;content: "|EB03|"; distance: 4; within: 2;content: "|6467FF360000EB03|"; distance: 3; within: 8;content: "|646789260000EB01|"; distance: 9; within: 8;content: "|EB04|"; distance: 8; within: 2;content: "|50EB04|"; distance: 4; within: 3;content: "|33C0EB04|"; distance: 5; within: 4;content: "|8B00EB03|"; distance: 6; within: 4;content: "|C3EB02|"; distance: 5; within: 3;content: "|E9FA000000EB01|"; distance: 4; within: 7;content: "|E8|"; distance: 7; within: 1;content: "|EB01|"; distance: 3; within: 2;content: "|EB02|"; distance: 2; within: 2;content: "|58EB04|"; distance: 3; within: 3;content: "|EB02|"; distance: 5; within: 2;content: "|64678F060000EB02|"; distance: 3; within: 8;content: "|83C404EB01|"; distance: 9; within: 5;content: "|E8|"; distance: 5; within: 1;sid: 2009758; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Obsiduim 1.3.0.4 -> Obsiduim Software] binary file"; flow:established,to_server; content: "|EB02|";content: "|E825000000EB04|"; distance: 3; within: 7;content: "|EB01|"; distance: 9; within: 2;content: "|8B54240CEB01|"; distance: 2; within: 6;content: "|8382B800000023EB01|"; distance: 6; within: 9;content: "|33C0EB02|"; distance: 9; within: 4;content: "|C3EB02|"; distance: 5; within: 3;content: "|EB04|"; distance: 4; within: 2;content: "|6467FF360000EB03|"; distance: 4; within: 8;content: "|64|"; distance: 9; within: 1;sid: 2009759; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ORiEN v2.11 (DEMO)] binary file"; flow:established,to_server; content: "|E95D010000CED1CECE0D0A2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D0D0A2D204F5269454E2065786563757461626C652066696C65732070726F|";sid: 2009760; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ORiEN v2.11 - 2.12 -> Fisun Alexander] binary file"; flow:established,to_server; content: "|E95D010000CED1CE|";content: "|0D0A2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D2D0D0A2D204F5269454E2065786563757461626C652066696C65732070726F|"; distance: 8; within: 76;sid: 2009761; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ORiEN V2.12 -> Fisun A.V.] binary file"; flow:established,to_server; content: "|E95D010000CED1CECD0D|";sid: 2009762; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Pack Master v1.0] binary file"; flow:established,to_server; content: "|60E801000000E883C404E801000000E95D81EDD3224000E804020000E8EB08EB02CD20FF24249A66BE4746|";sid: 2009763; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Pack Master v1.0] binary file"; flow:established,to_server; content: "|60E801|";content: "|E883C404E801|"; distance: 4; within: 6;content: "|E95D81EDD32240|"; distance: 7; within: 7;content: "|E80402|"; distance: 7; within: 3;content: "|E8EB08EB02CD20FF24249A66BE4746|"; distance: 4; within: 15;sid: 2009764; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Packanoid -> Arkanoid] binary file"; flow:established,to_server; content: "|BF00104000BE|";content: "|00E89D000000B8|"; distance: 7; within: 7;sid: 2009765; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Packanoid 1.0 -> ackanoid] binary file"; flow:established,to_server; content: "|BF00|";content: "|4000BE|"; distance: 2; within: 3;content: "|00E89D000000B8|"; distance: 4; within: 7;content: "|008B308B7804BB|"; distance: 8; within: 7;content: "|008B430491E31F51FFD656968B138B0291E30D525156FFD75A890283C204EBEE83C3085EEBDBB9|"; distance: 8; within: 39;content: "|0000BE00|"; distance: 40; within: 4;content: "|00EB0100BF|"; distance: 5; within: 5;content: "|00|"; distance: 6; within: 1;sid: 2009766; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Packanoid v1 -> Arkanoid] binary file"; flow:established,to_server; content: "|BF|";content: "|BE|"; distance: 3; within: 1;content: "|E89D000000B8|"; distance: 3; within: 6;content: "|8B308B7804BB|"; distance: 8; within: 6;content: "|8B430491E31F51FFD656968B138B0291E30D525156FFD75A890283C204EBEE83C308|"; distance: 8; within: 34;sid: 2009767; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Packed with: PKLITE v1.50 with CRC check (1)] binary file"; flow:established,to_server; content: "|1FB409BA|";content: "|CD21B8|"; distance: 5; within: 3;content: "|CD21|"; distance: 4; within: 2;sid: 2009768; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Packman 0.0.0.1 -> bubba] binary file"; flow:established,to_server; content: "|60E800000000588DA8|";content: "|FEFFFF8D98|"; distance: 9; within: 5;content: "|FF8D|"; distance: 6; within: 2;content: "|010000|"; distance: 3; within: 3;sid: 2009769; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Packman v0.0.0.1] binary file"; flow:established,to_server; content: "|60E800000000588DA8|";content: "|FFFF8D98|"; distance: 10; within: 4;content: "|FF8D|"; distance: 5; within: 2;content: "|010000|"; distance: 3; within: 3;content: "|0000|"; distance: 17; within: 2;sid: 2009770; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Packman V0.0.0.1 -> Bubbasoft] binary file"; flow:established,to_server; content: "|60E800000000588D|";content: "|8D|"; distance: 10; within: 1;content: "|8D|"; distance: 3; within: 1;content: "|8D|"; distance: 3; within: 1;content: "|48|"; distance: 2; within: 1;sid: 2009771; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Packman V1.0 -> Brandon LaCombe] binary file"; flow:established,to_server; content: "|60E8000000005B8D5BC6011B8B138D73146A08590116AD4975FA|";sid: 2009772; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Packman v1.0 -> Brandon LaCombe] binary file"; flow:established,to_server; content: "|60E8000000005B8D5BC6011B8B138D73146A08590116AD4975FA8BE8C606E98B430C8946016A046800100000FF730851FF55088B|";sid: 2009773; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PACKWIN v1.01p] binary file"; flow:established,to_server; content: "|8CC0FA8ED0BC|";content: "|FB060E1F2E|"; distance: 7; within: 5;content: "|8BF14E8BFE8CDB2E|"; distance: 7; within: 8;content: "|8EC3FDF3A453B8|"; distance: 10; within: 7;content: "|50CB|"; distance: 8; within: 2;sid: 2009774; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PAK-SFX Archive] binary file"; flow:established,to_server; content: "|558BEC83|";content: "|A1|"; distance: 5; within: 1;content: "|2E|"; distance: 2; within: 1;content: "|2E|"; distance: 2; within: 1;content: "|8CD78EC78D|"; distance: 3; within: 5;content: "|BE|"; distance: 6; within: 1;content: "|FCAC3C0D|"; distance: 2; within: 4;sid: 2009775; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PassEXE v2.0] binary file"; flow:established,to_server; content: "|061E0E0E071FBE|";content: "|B9|"; distance: 8; within: 1;content: "|871481|"; distance: 2; within: 3;content: "|EB|"; distance: 4; within: 1;content: "|C7|"; distance: 1; within: 1;content: "|840087|"; distance: 2; within: 3;content: "|FB1F584A|"; distance: 4; within: 4;sid: 2009776; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PassLock 2000 v1.0 (Eng) -> Moonlight-Software] binary file"; flow:established,to_server; content: "|558BEC535657BB00504000662EF7053420400004000F8598000000E81F010000C74360010000008D83E401000050FF15F061400083EC44C7042444000000C744242C0000000054FF15E8614000B80A000000F74424|";sid: 2009777; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Password Protector (c) MiniSoft 1992] binary file"; flow:established,to_server; content: "|060E0E071FE800005B83EB08BA270103D3E83C02BAEA|";sid: 2009778; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Password protector my SMT] binary file"; flow:established,to_server; content: "|E8|";content: "|5D8BFD81|"; distance: 3; within: 4;content: "|81|"; distance: 6; within: 1;content: "|83|"; distance: 3; within: 1;content: "|89|"; distance: 2; within: 1;content: "|8D|"; distance: 3; within: 1;content: "|8D|"; distance: 3; within: 1;content: "|4680|"; distance: 3; within: 2;content: "|74|"; distance: 3; within: 1;sid: 2009779; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PC Guard for Win32 v5.00 -> SofPro/Blagoje Ceklic] binary file"; flow:established,to_server; content: "|FC5550E8000000005D60E80300000083EB0EEB010C58EB013540EB0136FFE00B61B8|";content: "|00EB01E360E803000000D2EB0B58EB014840EB0135FFE0E7612BE89CEB01D59DEB010B5860E80300000083EB0EEB010C|"; distance: 35; within: 48;sid: 2009780; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PC PE Encryptor Alpha preview] binary file"; flow:established,to_server; content: "|535152565755E8000000005D8BCD81ED333040|";content: "|2B8DEE32400083E90B898DF23240|"; distance: 19; within: 14;content: "|80BDD13240|"; distance: 14; within: 5;content: "|010F84|"; distance: 5; within: 3;sid: 2009781; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PC Shrinker v0.20] binary file"; flow:established,to_server; content: "|E8E801|";content: "|6001ADB32740|"; distance: 4; within: 6;content: "|68|"; distance: 6; within: 1;sid: 2009782; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PC Shrinker v0.29] binary file"; flow:established,to_server; content: "|BD|";content: "|01AD553940|"; distance: 3; within: 5;content: "|8DB5353940|"; distance: 5; within: 5;sid: 2009783; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PC Shrinker v0.45] binary file"; flow:established,to_server; content: "|BD|";content: "|01ADE33840|"; distance: 3; within: 5;content: "|FFB5DF3840|"; distance: 5; within: 5;sid: 2009784; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PC Shrinker v0.71] binary file"; flow:established,to_server; content: "|9C60BD|";content: "|01AD543A40|"; distance: 5; within: 5;content: "|FFB5503A40|"; distance: 5; within: 5;content: "|6A40FF95883A40|"; distance: 5; within: 7;content: "|50502D|"; distance: 7; within: 3;content: "|8985|"; distance: 5; within: 2;sid: 2009785; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PC-Guard v3.03d, v3.05d] binary file"; flow:established,to_server; content: "|5550E8|";content: "|5DEB01E360E803|"; distance: 5; within: 7;content: "|D2EB0B58EB014840EB01|"; distance: 8; within: 10;sid: 2009786; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PC-Guard v4.05d, v4.10d, v4.15d] binary file"; flow:established,to_server; content: "|FC5550E8000000005DEB01|";sid: 2009787; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PC-Guard v5.00d] binary file"; flow:established,to_server; content: "|FC5550E8000000005D60E80300000083EB0EEB010C58EB013540EB0136FFE00B61B830D24000EB01E360E803000000D2EB0B58EB014840EB0135FFE0E7612BE89CEB01D59DEB010B5860E80300000083EB0EEB010C|";sid: 2009788; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PCPEC "alpha - preview"] binary file"; flow:established,to_server; content: "|535152565755E8000000005D8BCD81ED33304000|";sid: 2009789; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PCPEC [alpha]] binary file"; flow:established,to_server; content: "|535152565755E8|";content: "|5D8BCD81|"; distance: 9; within: 4;content: "|2B|"; distance: 6; within: 1;content: "|83|"; distance: 3; within: 1;sid: 2009790; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PCrypt v3.51] binary file"; flow:established,to_server; content: "|504352595054FF76332E353100E9|";sid: 2009791; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PcShare ?????????? v4.0 -> ????????] binary file"; flow:established,to_server; content: "|558BEC6AFF689034400068B628400064A1|";sid: 2009792; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PCShrink 0.71 beta] binary file"; flow:established,to_server; content: "|01AD543A4000FFB5503A40006A40FF95883A4000|";sid: 2009793; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PCShrink v0.40b] binary file"; flow:established,to_server; content: "|9C60BD|";content: "|01|"; distance: 5; within: 1;content: "|FF|"; distance: 3; within: 1;content: "|6A|"; distance: 3; within: 1;content: "|FF|"; distance: 1; within: 1;content: "|50502D|"; distance: 3; within: 3;sid: 2009794; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE Crypt 1.5 -> BitShape Software] binary file"; flow:established,to_server; content: "|60E8000000005D81ED55204000B97B0900008DBD9D2040008BF7AC|";content: "|AAE2CC|"; distance: 51; within: 3;sid: 2009795; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE Crypt v1.00/v1.01] binary file"; flow:established,to_server; content: "|E8|";content: "|5B83EB05EB04524E4421EB02CD20EB|"; distance: 3; within: 15;sid: 2009796; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE Crypt v1.02] binary file"; flow:established,to_server; content: "|E8|";content: "|5B83EB05EB04524E44|"; distance: 3; within: 9;sid: 2009797; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE Crypt32 (Console v1.0, v1.01, v1.02)] binary file"; flow:established,to_server; content: "|E8000000005B83EB05EB04524E4421EB02CD20EB|";sid: 2009798; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE Crypt32 v1.02] binary file"; flow:established,to_server; content: "|E8000000005B83|";content: "|EB|"; distance: 8; within: 1;content: "|524E4421|"; distance: 1; within: 4;sid: 2009799; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE Diminisher v0.1] binary file"; flow:established,to_server; content: "|535152565755E8000000005D8BD581EDA23040002B959133400081EA0B00000089959A33400080BD993340000074|";sid: 2009800; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE Diminisher v0.1] binary file"; flow:established,to_server; content: "|5D8BD581EDA23040|";content: "|2B95913340|"; distance: 8; within: 5;content: "|81EA0B|"; distance: 5; within: 3;content: "|89959A3340|"; distance: 4; within: 5;content: "|80BD99|"; distance: 5; within: 3;sid: 2009801; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE Diminisher V0.1 -> Teraphy] binary file"; flow:established,to_server; content: "|535152565755E800000000|";sid: 2009802; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE Diminisher v0.1 -> Teraphy] binary file"; flow:established,to_server; content: "|535152565755E8000000005D8BD581EDA23040002B959133400081EA0B00000089959A33400080BD99334000007450E8020100008BFD8D9D9A3340008B1B8D87|";sid: 2009803; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE Encrypt 1.0 -> Liwuyue] binary file"; flow:established,to_server; content: "|558BEC83C4D05356578D75FC8B442430250000FFFF81384D5A900074072D00100000EBF18945FCE8C8FFFFFF2D0F0500008945F48B068B403C03068B407803068BC88B512003168B5924031E895DF08B591C031E895DEC8B41188BC84985C9725A4133C08BD8C1E30203DA8B3B033E813F4765745075408BDF83C304813B726F634175338BDF83C308813B64647265752683C70C66813F7373|";sid: 2009804; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE Intro v1.0] binary file"; flow:established,to_server; content: "|8B04249C60E8|";content: "|5D81ED0A4540|"; distance: 8; within: 6;content: "|80BD674440|"; distance: 6; within: 5;content: "|0F8548|"; distance: 6; within: 3;sid: 2009805; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE Lock NT v2.01] binary file"; flow:established,to_server; content: "|EB03CD20EBEB01EB1EEB01EBEB02CD209CEB03CD|";sid: 2009806; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE Lock NT v2.02c] binary file"; flow:established,to_server; content: "|EB02C7851EEB03CD20EBEB01EB9CEB01EBEB02CD|";sid: 2009807; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE Lock NT v2.03] binary file"; flow:established,to_server; content: "|EB02C7851EEB03CD20C79CEB0269B160EB02EB01|";sid: 2009808; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE Lock NT v2.04] binary file"; flow:established,to_server; content: "|EB|";content: "|CD|"; distance: 1; within: 1;content: "|CD|"; distance: 3; within: 1;content: "|EB|"; distance: 3; within: 1;content: "|EB|"; distance: 1; within: 1;content: "|EB|"; distance: 1; within: 1;content: "|EB|"; distance: 1; within: 1;content: "|CD|"; distance: 1; within: 1;content: "|E8|"; distance: 3; within: 1;content: "|E9|"; distance: 3; within: 1;content: "|50C3|"; distance: 3; within: 2;sid: 2009809; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE Lock v1.06] binary file"; flow:established,to_server; content: "|0000000000000000|";content: "|000000004C6F61644C6962726172794100005669727475616C416C6C6F63004B45|"; distance: 12; within: 33;sid: 2009810; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE Ninja v1.0 -> +DzA kRAker TNT] binary file"; flow:established,to_server; content: "|BE5B2A4000BF35120000E8401200003D2283A3C60F85670F000090909090909090909090909090909090909090909090|";sid: 2009811; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE Pack v0.99] binary file"; flow:established,to_server; content: "|60E8|";content: "|5D83ED0680BDE004|"; distance: 4; within: 8;content: "|010F84F2|"; distance: 9; within: 4;sid: 2009812; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE Packer] binary file"; flow:established,to_server; content: "|FC8B35700140|";content: "|83EE406A4068|"; distance: 6; within: 6;content: "|3010|"; distance: 6; within: 2;sid: 2009813; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE Password v0.2 SMT/SMF] binary file"; flow:established,to_server; content: "|E804|";content: "|8BEC5DC333C05D8BFD81ED332640|"; distance: 3; within: 14;content: "|81EF|"; distance: 14; within: 2;content: "|83EF0589AD882740|"; distance: 4; within: 8;content: "|8D9D072940|"; distance: 8; within: 5;content: "|8DB5622840|"; distance: 5; within: 5;content: "|4680|"; distance: 5; within: 2;sid: 2009814; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE Protect v0.9] binary file"; flow:established,to_server; content: "|525155576467A1300085C0780DE8|";content: "|5883C007C6|"; distance: 16; within: 5;content: "|C3|"; distance: 5; within: 1;sid: 2009815; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE Protector 0.9.3 --> CRYPToCRACk] binary file"; flow:established,to_server; content: "|5B81E300FFFFFF66813B4D5A75338BF303733C813E5045000075260FB746188BC869C0AD0B0000F7E02DAB5D414B69C9DEC0000003C1750983EC040F85DD0000|";sid: 2009816; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE Spin v0.b] binary file"; flow:established,to_server; content: "|EB016860E8000000008B1C2483C312812BE8B10600FE4BFD822C2472C846000BE4749E7501C7817304D77AF72F817319770043B7F6C36BB70000F9FFE3C9C20800A3687201FF5D33C941E226E801000000EA5A33C9|";sid: 2009817; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE-Armor 0.46 -> China Cracking Group] binary file"; flow:established,to_server; content: "|E8AA0000002D|";content: "|0000000000000000003D|"; distance: 7; within: 10;content: "|002D|"; distance: 11; within: 2;content: "|0000000000000000000000000000000000000000004B|"; distance: 3; within: 22;content: "|005C|"; distance: 23; within: 2;content: "|006F|"; distance: 3; within: 2;content: "|00000000004B45524E454C33322E646C6C0000000047657450726F6341|"; distance: 3; within: 29;sid: 2009818; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE-Armor 0.46 -> Hying] binary file"; flow:established,to_server; content: "|E8AA0000002D|";content: "|0000000000000000003D|"; distance: 7; within: 10;content: "|002D|"; distance: 11; within: 2;content: "|0000000000000000000000000000000000000000004B|"; distance: 3; within: 22;content: "|005C|"; distance: 23; within: 2;content: "|006F|"; distance: 3; within: 2;content: "|00000000004B45524E454C33322E646C6C0000000047657450726F63416464726573730000004765744D6F64756C6548616E646C65410000004C6F61644C69627261727941|"; distance: 3; within: 69;sid: 2009819; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE-Armor 0.46 -> Hying] binary file"; flow:established,to_server; content: "|E8AA0000002D|";content: "|00000000000000003D|"; distance: 7; within: 9;sid: 2009820; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE-Armor 0.49 -> Hying] binary file"; flow:established,to_server; content: "|5652515355E81501000032|";content: "|0000000000|"; distance: 12; within: 5;sid: 2009821; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE-Armor V0.7X -> hying] binary file"; flow:established,to_server; content: "|60E8000000005D81ED|";content: "|8DB5|"; distance: 11; within: 2;content: "|555681C5|"; distance: 4; within: 4;content: "|55C3|"; distance: 6; within: 2;sid: 2009822; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE-Crypt 1.02] binary file"; flow:established,to_server; content: "|E8000000005B83EB05EB04524E442185C07302F7|";sid: 2009823; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE-Crypter] binary file"; flow:established,to_server; content: "|60E8000000005DEB26|";sid: 2009824; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE-PACK 0.99] binary file"; flow:established,to_server; content: "|60E8000000005D83ED0680BDE0040000010F84F2|";sid: 2009825; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE-PACK v1.0 by ANAKiN 1998 (???)] binary file"; flow:established,to_server; content: "|74|";content: "|E9|"; distance: 1; within: 1;content: "|00000000|"; distance: 3; within: 4;sid: 2009826; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE-PROTECT 0.9] binary file"; flow:established,to_server; content: "|E9CF0000000D0A0D0AC4C4C4C4C4C4C4C4C4C4C4|";sid: 2009827; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE-SHiELD 0.2] binary file"; flow:established,to_server; content: "|60E800000000414E414B494E5D83ED06EB02EA04|";sid: 2009828; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Pe123  v2006.4.12] binary file"; flow:established,to_server; content: "|8BC0609CE801000000C353E87200000050E81C0300008BD8FFD35BC38BC0E8000000005883C005C38BC0558BEC608B4D108B7D0C8B7508F3A4615DC20C00E8000000005883E805C38BC0E8000000005883C005C38B|";sid: 2009829; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Pe123  v2006.4.4] binary file"; flow:established,to_server; content: "|8BC0EB013460EB012A9CEB02EAC8E80F000000EB033D2323EB014AEB015BC38D400053EB016CEB017EEB018FE81501000050E867040000EB019A8BD8FFD35BC38BC0E8000000005883C005C38BC0558BEC608B4D10|";sid: 2009830; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEBundle v0.2 - v2.0x] binary file"; flow:established,to_server; content: "|9C60E802|";content: "|33C08BC483C004938BE38B5BFC81EB|"; distance: 5; within: 15;content: "|40|"; distance: 16; within: 1;content: "|87DD6A0468|"; distance: 1; within: 5;content: "|10|"; distance: 5; within: 1;content: "|68|"; distance: 2; within: 1;content: "|02|"; distance: 1; within: 1;content: "|6A|"; distance: 2; within: 1;content: "|FF95|"; distance: 1; within: 2;sid: 2009831; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEBundle v2.0b5 - v2.3] binary file"; flow:established,to_server; content: "|9C60E802|";content: "|33C08BC483C004938BE38B5BFC81EB|"; distance: 5; within: 15;content: "|40|"; distance: 16; within: 1;content: "|87DD01AD|"; distance: 1; within: 4;content: "|01AD|"; distance: 6; within: 2;sid: 2009832; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEBundle v2.44] binary file"; flow:established,to_server; content: "|9C60E802|";content: "|33C08BC483C004938BE38B5BFC81EB|"; distance: 5; within: 15;content: "|40|"; distance: 16; within: 1;content: "|87DD83BD|"; distance: 1; within: 4;sid: 2009833; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PeCompact 2.53 DLL (Slim Loader) --> BitSum Technologies] binary file"; flow:established,to_server; content: "|B8|";content: "|5064FF35000000006489250000000033C08908504543320000080C0048E101565753558B5C241C85DB0F84AB21E8BD0EE6600D0B6B65726E6C3332|"; distance: 3; within: 59;sid: 2009834; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact 2.xx (Slim Loader) --> BitSum Technologies] binary file"; flow:established,to_server; content: "|B8|";content: "|5064FF35000000006489250000000033C089085045433200|"; distance: 3; within: 24;sid: 2009835; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact 2.xx --> BitSum Technologies] binary file"; flow:established,to_server; content: "|B8|";content: "|5064FF35000000006489250000000033C089085045436F6D706163743200|"; distance: 3; within: 30;sid: 2009836; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v0.90] binary file"; flow:established,to_server; content: "|EB0668|";content: "|4000C39C60BD|"; distance: 4; within: 6;content: "|0000B902000000B0908DBD7A424000F3AA01ADD9434000FFB5|"; distance: 7; within: 25;sid: 2009837; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v0.92] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60BD|"; distance: 5; within: 4;content: "|B902|"; distance: 6; within: 2;content: "|B0908DBDA54F40|"; distance: 3; within: 7;content: "|F3AA01AD045140|"; distance: 7; within: 7;content: "|FFB5|"; distance: 7; within: 2;sid: 2009838; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v0.94] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E8|"; distance: 5; within: 4;content: "|5D555881ED|"; distance: 6; within: 5;content: "|2B85|"; distance: 7; within: 2;content: "|0185|"; distance: 4; within: 2;content: "|50B902|"; distance: 4; within: 3;sid: 2009839; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v0.971 - v0.976] binary file"; flow:established,to_server; content: "|EB0668C39C60E85D555B81ED8B85018566C785|";sid: 2009840; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v0.977] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EBA08640|"; distance: 6; within: 18;content: "|87DD8B852A87|"; distance: 18; within: 6;sid: 2009841; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v0.978] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB248840|"; distance: 6; within: 18;content: "|87DD8B85A988|"; distance: 18; within: 6;sid: 2009842; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v0.978.1] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB498740|"; distance: 6; within: 18;content: "|87DD8B85CE87|"; distance: 18; within: 6;sid: 2009843; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v0.978.2] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EBD18440|"; distance: 6; within: 18;content: "|87DD8B855685|"; distance: 18; within: 6;sid: 2009844; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v0.98] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EBD78440|"; distance: 6; within: 18;content: "|87DD8B855C85|"; distance: 18; within: 6;sid: 2009845; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v0.99] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB2F8540|"; distance: 6; within: 18;content: "|87DD8B85B485|"; distance: 18; within: 6;sid: 2009846; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.00] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EBC48440|"; distance: 6; within: 18;content: "|87DD8B854985|"; distance: 18; within: 6;sid: 2009847; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.10b1] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB286340|"; distance: 6; within: 18;content: "|87DD8B85AD63|"; distance: 18; within: 6;sid: 2009848; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.10b2] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB0F6040|"; distance: 6; within: 18;content: "|87DD8B859460|"; distance: 18; within: 6;sid: 2009849; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.10b3] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB0F6040|"; distance: 6; within: 18;content: "|87DD8B85956040|"; distance: 18; within: 7;content: "|0185036040|"; distance: 7; within: 5;content: "|66C785|"; distance: 5; within: 3;content: "|6040|"; distance: 3; within: 2;content: "|9090BB95|"; distance: 2; within: 4;sid: 2009850; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.10b4] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB0F6040|"; distance: 6; within: 18;content: "|87DD8B85956040|"; distance: 18; within: 7;content: "|0185036040|"; distance: 7; within: 5;content: "|66C785|"; distance: 5; within: 3;content: "|6040|"; distance: 3; within: 2;content: "|9090BB44|"; distance: 2; within: 4;sid: 2009851; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.10b5] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB0F6040|"; distance: 6; within: 18;content: "|87DD8B85956040|"; distance: 18; within: 7;content: "|0185036040|"; distance: 7; within: 5;content: "|66C785|"; distance: 5; within: 3;content: "|6040|"; distance: 3; within: 2;content: "|9090BB49|"; distance: 2; within: 4;sid: 2009852; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.10b6] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB0F60|"; distance: 6; within: 17;content: "|0087DD8B859A6040|"; distance: 17; within: 8;content: "|0185036040|"; distance: 8; within: 5;content: "|66C785|"; distance: 5; within: 3;content: "|6040|"; distance: 3; within: 2;content: "|90900185926040|"; distance: 2; within: 7;content: "|BBB7|"; distance: 7; within: 2;sid: 2009853; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.10b7] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB0F6040|"; distance: 6; within: 18;content: "|87DD8B859A6040|"; distance: 18; within: 7;content: "|0185036040|"; distance: 7; within: 5;content: "|66C785|"; distance: 5; within: 3;content: "|6040|"; distance: 3; within: 2;content: "|90900185926040|"; distance: 2; within: 7;content: "|BB14|"; distance: 7; within: 2;sid: 2009854; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.20 - v1.20.1] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB0F7040|"; distance: 6; within: 18;content: "|87DD8B859A7040|"; distance: 18; within: 7;sid: 2009855; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.22] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB0F7040|"; distance: 6; within: 18;content: "|87DD8B85A67040|"; distance: 18; within: 7;content: "|0185037040|"; distance: 7; within: 5;content: "|66C785|"; distance: 5; within: 3;content: "|7040|"; distance: 3; within: 2;content: "|909001859E7040|"; distance: 2; within: 7;content: "|BBF308|"; distance: 7; within: 3;sid: 2009856; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.23b3 - v1.24.1] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB0F7040|"; distance: 6; within: 18;content: "|87DD8B85A67040|"; distance: 18; within: 7;content: "|0185037040|"; distance: 7; within: 5;content: "|66C785704090|"; distance: 5; within: 6;content: "|9001859E7040BB|"; distance: 6; within: 7;content: "|D208|"; distance: 7; within: 2;sid: 2009857; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.24.2 - v1.24.3] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB0F7040|"; distance: 6; within: 18;content: "|87DD8B85A67040|"; distance: 18; within: 7;content: "|0185037040|"; distance: 7; within: 5;content: "|66C785704090|"; distance: 5; within: 6;content: "|9001859E7040BB|"; distance: 6; within: 7;content: "|D209|"; distance: 7; within: 2;sid: 2009858; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.25] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB0F7040|"; distance: 6; within: 18;content: "|87DD8B85A67040|"; distance: 18; within: 7;content: "|0185037040|"; distance: 7; within: 5;content: "|66C785704090|"; distance: 5; within: 6;content: "|9001859E7040BB|"; distance: 6; within: 7;content: "|F30D|"; distance: 7; within: 2;sid: 2009859; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.26b1 - v1.26b2] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB0F7040|"; distance: 6; within: 18;content: "|87DD8B85A67040|"; distance: 18; within: 7;content: "|0185037040|"; distance: 7; within: 5;content: "|66C785704090|"; distance: 5; within: 6;content: "|9001859E7040BB|"; distance: 6; within: 7;content: "|050E|"; distance: 7; within: 2;sid: 2009860; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.33] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB0F8040|"; distance: 6; within: 18;content: "|87DD8B85A68040|"; distance: 18; within: 7;content: "|0185038040|"; distance: 7; within: 5;content: "|66C785008040|"; distance: 5; within: 6;content: "|909001859E8040|"; distance: 6; within: 7;content: "|BBE80E|"; distance: 7; within: 3;sid: 2009861; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.34 - v1.40b1] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB0F8040|"; distance: 6; within: 18;content: "|87DD8B85A68040|"; distance: 18; within: 7;content: "|0185038040|"; distance: 7; within: 5;content: "|66C785|"; distance: 5; within: 3;content: "|0080|"; distance: 3; within: 2;content: "|40909001859E80|"; distance: 2; within: 7;content: "|40BBF810|"; distance: 7; within: 4;sid: 2009862; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.40 - v1.45] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB0FA040|"; distance: 6; within: 18;content: "|87DD8B85A6A040|"; distance: 18; within: 7;content: "|018503A040|"; distance: 7; within: 5;content: "|66C785|"; distance: 5; within: 3;content: "|A040|"; distance: 3; within: 2;content: "|909001859EA040|"; distance: 2; within: 7;content: "|BBC311|"; distance: 7; within: 3;sid: 2009863; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.40b2 - v1.40b4] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB0FA040|"; distance: 6; within: 18;content: "|87DD8B85A6A040|"; distance: 18; within: 7;content: "|018503A040|"; distance: 7; within: 5;content: "|66C785|"; distance: 5; within: 3;content: "|A040|"; distance: 3; within: 2;content: "|909001859EA040|"; distance: 2; within: 7;content: "|BB8611|"; distance: 7; within: 3;sid: 2009864; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.40b5 - v1.40b6] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB0FA040|"; distance: 6; within: 18;content: "|87DD8B85A6A040|"; distance: 18; within: 7;content: "|018503A040|"; distance: 7; within: 5;content: "|66C785|"; distance: 5; within: 3;content: "|A040|"; distance: 3; within: 2;content: "|909001859EA040|"; distance: 2; within: 7;content: "|BB8A11|"; distance: 7; within: 3;sid: 2009865; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.46] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB0FA040|"; distance: 6; within: 18;content: "|87DD8B85A6A040|"; distance: 18; within: 7;content: "|018503A040|"; distance: 7; within: 5;content: "|66C785|"; distance: 5; within: 3;content: "|A040|"; distance: 3; within: 2;content: "|909001859EA040|"; distance: 2; within: 7;content: "|BB6012|"; distance: 7; within: 3;sid: 2009866; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.47 - v1.50] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB0FA040|"; distance: 6; within: 18;content: "|87DD8B85A6A040|"; distance: 18; within: 7;content: "|018503A040|"; distance: 7; within: 5;content: "|66C785|"; distance: 5; within: 3;content: "|A040|"; distance: 3; within: 2;content: "|909001859EA040|"; distance: 2; within: 7;content: "|BB5B12|"; distance: 7; within: 3;sid: 2009867; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.4x+] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81|"; distance: 6; within: 14;sid: 2009868; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.55] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB0F8040|"; distance: 6; within: 18;content: "|87DD8B85A28040|"; distance: 18; within: 7;content: "|0185038040|"; distance: 7; within: 5;content: "|66C785|"; distance: 5; within: 3;content: "|8040|"; distance: 3; within: 2;content: "|909001859E8040|"; distance: 2; within: 7;content: "|BB2D12|"; distance: 7; within: 3;sid: 2009869; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.56] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB0F9040|"; distance: 6; within: 18;content: "|87DD8B85A29040|"; distance: 18; within: 7;content: "|0185039040|"; distance: 7; within: 5;content: "|66C785|"; distance: 5; within: 3;content: "|9040|"; distance: 3; within: 2;content: "|909001859E9040|"; distance: 2; within: 7;content: "|BB2D12|"; distance: 7; within: 3;sid: 2009870; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.60 - v1.65] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB3F8040|"; distance: 6; within: 18;content: "|87DD8B85D28040|"; distance: 18; within: 7;content: "|0185338040|"; distance: 7; within: 5;content: "|66C785|"; distance: 5; within: 3;content: "|8040|"; distance: 3; within: 2;content: "|90900185CE8040|"; distance: 2; within: 7;content: "|BBBB12|"; distance: 7; within: 3;sid: 2009871; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.66] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB3F9040|"; distance: 6; within: 18;content: "|87DD8B85E69040|"; distance: 18; within: 7;content: "|0185339040|"; distance: 7; within: 5;content: "|66C785|"; distance: 5; within: 3;content: "|9040|"; distance: 3; within: 2;content: "|90900185DA9040|"; distance: 2; within: 7;content: "|0185DE9040|"; distance: 7; within: 5;content: "|0185E29040|"; distance: 5; within: 5;content: "|BB5B11|"; distance: 5; within: 3;sid: 2009872; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.67] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB3F904087DD8B85E69040018533904066C785904090900185DA90400185DE90400185E29040BB8B11|"; distance: 6; within: 55;sid: 2009873; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.68 - v1.84] binary file"; flow:established,to_server; content: "|EB0668|";content: "|C39C60E802|"; distance: 5; within: 5;content: "|33C08BC483C004938BE38B5BFC81EB3F904087DD8B85E69040018533904066C785904090900185DA90400185DE90400185E29040BB7B11|"; distance: 6; within: 55;sid: 2009874; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v1.84] binary file"; flow:established,to_server; content: "|33C08BC483C004938BE38B5BFC81|";sid: 2009875; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v2.0 beta -> Jeremy Collake] binary file"; flow:established,to_server; content: "|B8|";content: "|05|"; distance: 3; within: 1;content: "|5064FF350000000064892500000000CC90909090|"; distance: 3; within: 20;sid: 2009876; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v2.5 Retail (Slim Loader) -> Bitsum Technologies] binary file"; flow:established,to_server; content: "|B8|";content: "|015064FF35000000006489250000000033C089085045433200|"; distance: 2; within: 25;sid: 2009877; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact v2.5 Retail -> Bitsum Technologies] binary file"; flow:established,to_server; content: "|B8|";content: "|015064FF35000000006489250000000033C089085045436F6D706163743200|"; distance: 2; within: 31;sid: 2009878; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECompact V2.X-> Bitsum Technologies] binary file"; flow:established,to_server; content: "|B8|";content: "|5064FF35000000006489250000000033C08908504543|"; distance: 3; within: 22;sid: 2009879; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PECrc32 0.88 -> ZhouJinYu] binary file"; flow:established,to_server; content: "|60E8000000005D81EDB6A445008DBDB0A4450081EF82000000|";sid: 2009880; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEcrypt - by archphase] binary file"; flow:established,to_server; content: "|558BEC83C4E0535633C08945E48945E08945EC|";content: "|64824000E87CC7FFFF33C05568BE84400064FF3064892068CC844000|"; distance: 21; within: 28;content: "|00A110A7400050E81DC8FFFF8BD885DB7539E83AC8FFFF6A006A0068A0A940006800040000506A006800130000E8FFC7FFFF6A0068E0844000A1A0A94000506A00E8|"; distance: 30; within: 66;content: "|E97D01000053A110A7400050E842C8FFFF8BF085F675186A0068E084400068E48440006A00E871C8FFFFE953010000536A00E82CC8FFFFA3|"; distance: 68; within: 56;content: "|833D48A840000075186A0068E084400068F88440006A00E843C8FFFFE92501000056E8F8C7FFFFA34CA84000A148A84000E891A1FFFF8BD88B1548A8400085D27C164233C08B0D4CA8400003C88A098D3418880E404A75ED8B1548A8400085D27C324233C08D34188A0E80F9017505C606FFEB1C8D0C188A0984|"; distance: 58; within: 122;content: "|00EB0E8B0D4CA8400003C80FB60949880E404A75D18D|"; distance: 124; within: 22;content: "|E8A5A3FFFF8B45E88D55ECE856D5FFFF8D45ECBA18854000E879BAFFFF8B45ECE839BBFFFF8BD0B854A84000E831A6FFFFBA01000000B854A84000E812A9FFFFE8DDA1FFFF6850A840008BD38B0D48A84000B854A84000E856A7FFFFE8C1A1FFFF|"; distance: 24; within: 97;sid: 2009881; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEEncrypt v4.0b (JunkCode)] binary file"; flow:established,to_server; content: "|66|";content: "|006683|"; distance: 2; within: 3;content: "|00|"; distance: 3; within: 1;sid: 2009882; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEiD-Bundle v1.00 - v1.01 --> BoB / BobSoft] binary file"; flow:established,to_server; content: "|60E8|";content: "|0200008B44240452486631C06681384D5A75F58B503C813C025045000075E95AC204006089DD89C38B453C8B54287801EA528B522001EA31C9418B348A|"; distance: 2; within: 61;sid: 2009883; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEiD-Bundle v1.00 --> BoB / BobSoft] binary file"; flow:established,to_server; content: "|60E8210200008B44240452486631C06681384D5A75F58B503C813C025045000075E95AC204006089DD89C38B453C8B54287801EA528B522001EA31C9418B348A|";sid: 2009884; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEiD-Bundle v1.01 --> BoB / BobSoft] binary file"; flow:established,to_server; content: "|60E8230200008B44240452486631C06681384D5A75F58B503C813C025045000075E95AC204006089DD89C38B453C8B54287801EA528B522001EA31C9418B348A|";sid: 2009885; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEiD-Bundle v1.02 - v1.03 --> BoB / BobSoft] binary file"; flow:established,to_server; content: "|60E89C00000000000000000000000000000036|";content: "|2E|"; distance: 20; within: 1;content: "|000000000000000000000000000000000000000001000080000000004B65726E656C33322E44|"; distance: 2; within: 38;sid: 2009886; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEiD-Bundle v1.02 - v1.03 DLL --> BoB / BobSoft] binary file"; flow:established,to_server; content: "|837C2408010F85|";content: "|60E89C0000000000000000000000000000004100080039000800000000000000000000000000000000000000000001000080000000|"; distance: 9; within: 53;sid: 2009887; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEiD-Bundle v1.02 - v1.04 --> BoB / BobSoft] binary file"; flow:established,to_server; content: "|60E8|";content: "|00000000000000000000000000000036|"; distance: 2; within: 16;content: "|2E|"; distance: 17; within: 1;content: "|000000000000000000000000000000000000000001000080000000004B65726E656C33322E44|"; distance: 2; within: 38;sid: 2009888; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Pelles C 2.8.x-4.5.x -> Pelle Orinius] binary file"; flow:established,to_server; content: "|5589E56AFF68|";content: "|68|"; distance: 8; within: 1;content: "|64FF35|"; distance: 3; within: 3;content: "|648925|"; distance: 5; within: 3;content: "|83EC|"; distance: 5; within: 2;sid: 2009889; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Pelles C 2.80 -2.90 EXE (X86 CRT-LIB)] binary file"; flow:established,to_server; content: "|5589E56AFF68|";content: "|68|"; distance: 8; within: 1;content: "|64FF35|"; distance: 3; within: 3;content: "|648925|"; distance: 5; within: 3;content: "|83EC|"; distance: 5; within: 2;content: "|83EC|"; distance: 2; within: 2;content: "|5356578965E868000000|"; distance: 2; within: 10;content: "|E8|"; distance: 10; within: 1;content: "|59A3|"; distance: 3; within: 2;sid: 2009890; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Pelles C 2.90, 3.00, 4.00 DLL (X86 CRT-LIB)] binary file"; flow:established,to_server; content: "|5589E55356578B5D0C8B7510BF0100000085DB7510833D|";content: "|00750731C0E9|"; distance: 25; within: 6;content: "|83FB01740583FB0275|"; distance: 8; within: 9;content: "|85FF74|"; distance: 9; within: 3;sid: 2009891; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Pelles C 2.x-4.x DLL -> Pelle Orinius] binary file"; flow:established,to_server; content: "|5589E55356578B5D0C8B7510|";sid: 2009892; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Pelles C 3.00, 4.00, 4.50 EXE (X86 CRT-DLL)] binary file"; flow:established,to_server; content: "|5589E56AFF68|";content: "|68|"; distance: 8; within: 1;content: "|64FF35|"; distance: 3; within: 3;content: "|648925|"; distance: 5; within: 3;content: "|83EC|"; distance: 5; within: 2;content: "|5356578965E8C745FC|"; distance: 2; within: 9;content: "|68|"; distance: 11; within: 1;content: "|E8|"; distance: 3; within: 1;content: "|59BE|"; distance: 3; within: 2;content: "|EB|"; distance: 4; within: 1;sid: 2009893; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Pelles C 3.00, 4.00, 4.50 EXE (X86 CRT-LIB)] binary file"; flow:established,to_server; content: "|5589E56AFF68|";content: "|68|"; distance: 8; within: 1;content: "|64FF35|"; distance: 3; within: 3;content: "|648925|"; distance: 5; within: 3;content: "|83EC|"; distance: 5; within: 2;content: "|5356578965E86800000002E8|"; distance: 2; within: 12;content: "|59A3|"; distance: 14; within: 2;sid: 2009894; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Pelles C 4.50 DLL (X86 CRT-LIB)] binary file"; flow:established,to_server; content: "|5589E55356578B5D0C8B751085DB750D833D|";content: "|00750431C0EB5783FB01740583FB0275|"; distance: 20; within: 16;sid: 2009895; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PELOCKnt 2.04] binary file"; flow:established,to_server; content: "|EB03CD20C71EEB03CD20EA9CEB02EB01EB01EB60|";sid: 2009896; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEMangle] binary file"; flow:established,to_server; content: "|609CBE|";content: "|8BFEB9|"; distance: 5; within: 3;content: "|BB44524F4CAD33C3|"; distance: 5; within: 8;sid: 2009897; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEncrypt 1.0 -> JunkCode] binary file"; flow:established,to_server; content: "|609CBE001040008BFEB9|";content: "|BB78563412AD33C3ABE2FA9D61E9|"; distance: 12; within: 14;content: "|FF|"; distance: 15; within: 1;sid: 2009898; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEncrypt 2.0 -> junkcode] binary file"; flow:established,to_server; content: "|EB250000F7BF000000000000000000001200E8005669727475616C50726F746563740000000000E8000000005D81ED2C1040008DB514104000E833000000898510104000BF000040008BF7037F3C8B4F5451568D85|";sid: 2009899; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEncrypt v1.0] binary file"; flow:established,to_server; content: "|609CBE001040008BFEB928030000BB78563412AD33C3ABE2FA9D61|";sid: 2009900; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEncrypt v3.0] binary file"; flow:established,to_server; content: "|E8000000005D81ED051040008DB5241040008BFEB90F000000BB|";content: "|AD33C3E2FA|"; distance: 28; within: 5;sid: 2009901; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEncrypt v3.1] binary file"; flow:established,to_server; content: "|E9|";content: "|00F00FC6|"; distance: 2; within: 4;sid: 2009902; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEnguinCrypt v1.0] binary file"; flow:established,to_server; content: "|B893|";content: "|0055506764FF360000676489260000BD4B484342B804000000CC3C0475049090C39067648F060000585DBB0000400033C933C0|"; distance: 3; within: 51;sid: 2009903; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PENightMare 2 Beta] binary file"; flow:established,to_server; content: "|60E9|";content: "|EF4003A7078F071C375D43A704B92C3A|"; distance: 4; within: 16;sid: 2009904; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PENightMare v1.3] binary file"; flow:established,to_server; content: "|60E8000000005DB9|";content: "|8031154181F9|"; distance: 10; within: 6;sid: 2009905; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PENinja] binary file"; flow:established,to_server; content: "|909090909090909090909090909090909090909090909090909090909090909090909090|";sid: 2009906; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PENinja modified] binary file"; flow:established,to_server; content: "|5D8BC581EDB22C40002B85943E40002D710200008985983E40000FB6B59C3E40008BFD|";sid: 2009907; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PESHiELD v0.1b MTE] binary file"; flow:established,to_server; content: "|E8|";content: "|B91B01|"; distance: 14; within: 3;content: "|D1|"; distance: 4; within: 1;sid: 2009908; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PESHiELD v0.2 / v0.2b / v0.2b2] binary file"; flow:established,to_server; content: "|60E8|";content: "|414E414B494E5D83ED06EB02EA04|"; distance: 4; within: 14;sid: 2009909; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PESHiELD v0.251] binary file"; flow:established,to_server; content: "|5D83ED06EB02EA048D|";sid: 2009910; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEShit] binary file"; flow:established,to_server; content: "|B8|";content: "|B9|"; distance: 3; within: 1;content: "|83F9007E068030|"; distance: 3; within: 7;content: "|40E2F5E9|"; distance: 7; within: 4;content: "|FF|"; distance: 5; within: 1;sid: 2009911; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PESpin v0.1 -> Cyberbob] binary file"; flow:established,to_server; content: "|EB016860E8000000008B1C2483C312812BE8B10600FE4BFD822C245CCB46000BE4749E7501C7817304D77AF72F817319770043B7F6C36BB70000F9FFE3C9C20800A3687201FF5D33C941E217EB07EAEB01EBEB0DFF|";sid: 2009912; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PESpin v0.1 -> Cyberbob] binary file"; flow:established,to_server; content: "|EB016860E8000000008B1C2483C312812BE8B10600FE4BFD822C245CCB46000BE4749E7501C7817304D77AF72F817319770043B7F6C36BB70000F9FFE3C9C20800A3687201FF5D33C941E217EB07EAEB01EBEB0DFFE801000000EA5A83EA0BFFE28B95B32840008B423C03C28985BD28400041C1E1078B0C0103CA8B591003DA8B1B899DD1284000538F85C4274000BB|";content: "|000000B9A50800008DBD752940004F301C39FECBE2F9682D010000598DBDAA304000C00C3902E2FAE802000000FF155A8D85074F5600BB54130B00D1E32BC3FFE0E80100000068E81A0000008D3428B8|"; distance: 144; within: 80;content: "|2BC983C9150FA3C80F83810000008DB40DC42840008BD6B910000000AC84C07406C04EFF03E2F5E8000000005981C11D0000005251C1E90523D1FF|"; distance: 82; within: 59;sid: 2009913; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PESpin v0.3 (Eng) -> cyberbob] binary file"; flow:established,to_server; content: "|EB016860E8000000008B1C2483C312812BE8B10600FE4BFD822C24B7CD46|";sid: 2009914; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PESpin v0.3 (Eng) -> cyberbob] binary file"; flow:established,to_server; content: "|EB016860E8000000008B1C2483C312812BE8B10600FE4BFD822C24B7CD46000BE4749E7501C7817304D77AF72F817319770043B7F6C36BB70000F9FFE3C9C20800A3687201FF5D33C941E217EB07EAEB01EBEB0DFF|";sid: 2009915; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PESpin V0.3 -> cyberbob] binary file"; flow:established,to_server; content: "|EB016860E8000000008B1C2483C312812BE8B10600FE4BFD822C24B7CD46000BE4749E7501C7817304D77AF72F817319770043B7F6C36BB70000F9FFE3C9C20800A3687201FF5D33C941E217EB07EAEB01EBEB0DFFE801000000EA5A83EA0BFFE28B95CB2C40008B423C03C28985D52C400041C1E1078B0C0103CA8B591003DA8B1B899DE92C4000538F85B62B4000BB|";content: "|000000B9750A00008DBD7E2D40004F301C39FECBE2F9683C010000598DBDB6364000C00C3902E2FAE802000000FF155A8D851F535600BB54130B00D1E32BC3FFE0E80100000068E81A0000008D3428B908000000B8|"; distance: 144; within: 85;content: "|2BC983C9150FA3C80F83810000008DB40DDC2C4000|"; distance: 87; within: 21;sid: 2009916; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PESpin v0.7 -> Cyberbob] binary file"; flow:established,to_server; content: "|EB016860E8000000008B1C2483C312812BE8B10600FE4BFD822C2483D546000BE4749E7501C7817304D77AF72F817319770043B7F6C36BB70000F9FFE3C9C20800A3687201FF5D33C941E217EB07EAEB01EBEB0DFF|";sid: 2009917; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PESpin V0.71 -> cyberbob] binary file"; flow:established,to_server; content: "|EB016860E8000000008B1C2483C312812BE8B10600FE4BFD822C2483D546000BE4749E|";sid: 2009918; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PESpin V1.1 -> cyberbob] binary file"; flow:established,to_server; content: "|EB016860E8000000008B1C2483C312812BE8B10600FE4BFD822C247DDE46000BE4749E|";sid: 2009919; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PESpin v1.1 -> Cyberbob] binary file"; flow:established,to_server; content: "|EB016860E8000000008B1C2483C312812BE8B10600FE4BFD822C247DDE46000BE4749E7501C7817304D77AF72F817319770043B7F6C36BB70000F9FFE3C9C20800A3687201FF5D33C941E217EB07EAEB01EBEB0DFF|";sid: 2009920; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PESPin v1.3 -> Cyberbob] binary file"; flow:established,to_server; content: "|EB016860E8000000008B1C2483C312812BE8B10600FE4BFD822C24ACDF46000BE4749E7501C7817304D77AF72F817319770043B7F6C36BB70000F9FFE3C9C20800A3687201FF5D33C941E217EB07EAEB01EBEB0DFF|";sid: 2009921; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PESpin v1.304 -> Cyberbob] binary file"; flow:established,to_server; content: "|EB016860E8000000008B1C2483C312812BE8B10600FE4BFD822C2488DF46000BE4749E7501C7817304D77AF72F817319770043B7F6C36BB70000F9FFE3C9C20800A3687201FF5D33C941E217EB07EAEB01EBEB0DFF|";sid: 2009922; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PESpin v1.3beta -> Cyberbob] binary file"; flow:established,to_server; content: "|EB016860E8000000008B1C2483C312812BE8B10600FE4BFD822C2471DF46000BE4749E7501C7817304D77AF72F817319770043B7F6C36BB70000F9FFE3C9C20800A3687201FF5D33C941E217EB07EAEB01EBEB0DFF|";sid: 2009923; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Petite 1.2] binary file"; flow:established,to_server; content: "|669C60E8CA000000030004000500060007000800|";sid: 2009924; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Petite 1.2 -> (c)1998 Ian Luck] binary file"; flow:established,to_server; content: "|669C60E8CA00000003000400050006000700080009000A000B000D000F001100130017001B001F0023002B0033003B0043005300630073008300A300C300E300020100000000000000000000000001010101020202|";sid: 2009925; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Petite 1.3 -> (c)1998 Ian Luck] binary file"; flow:established,to_server; content: "|9C60508D8800|";content: "|8D90|"; distance: 7; within: 2;content: "|00008BDC8BE1680000|"; distance: 3; within: 9;content: "|53508004240850800424425080042461508004249D50800424BB833A000F84DA1400008B442418F64203807419FD807203808BF08BF803|"; distance: 10; within: 55;sid: 2009926; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Petite 1.4 -> (c)1998-99 Ian Luck] binary file"; flow:established,to_server; content: "|669C60508BD803006854BC00006A00FF50148BCC8DA054BC0000508BC38D90|";content: "|160000680000|"; distance: 31; within: 6;content: "|51508004240850800424425080042461508004249D50800424BB833A000F84D81400008B442418F6|"; distance: 7; within: 40;sid: 2009927; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Petite 2.2 -> (c)1998-99 Ian Luck] binary file"; flow:established,to_server; content: "|68|";content: "|64FF350000000064892500000000669C6050680000|"; distance: 3; within: 21;content: "|8B3C248B306681C780078D74060889388B5E1050566A026880080000576A|"; distance: 22; within: 30;content: "|6A06566A04688008000057FFD383EE0859F3A55966|"; distance: 30; within: 21;sid: 2009928; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEtite v1.2] binary file"; flow:established,to_server; content: "|9C60E8CA|";content: "|03|"; distance: 5; within: 1;content: "|04|"; distance: 1; within: 1;content: "|05|"; distance: 1; within: 1;content: "|06|"; distance: 1; within: 1;content: "|07|"; distance: 1; within: 1;content: "|08|"; distance: 1; within: 1;sid: 2009929; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEtite v1.3] binary file"; flow:established,to_server; content: "|669C60508D88|";content: "|F0|"; distance: 6; within: 1;content: "|8D900416|"; distance: 2; within: 4;content: "|8BDC8BE168|"; distance: 5; within: 5;content: "|5350800424085080042442|"; distance: 7; within: 11;sid: 2009930; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEtite v1.4] binary file"; flow:established,to_server; content: "|669C60508BD803|";content: "|6854BC|"; distance: 7; within: 3;content: "|6A|"; distance: 4; within: 1;content: "|FF50148BCC|"; distance: 1; within: 5;sid: 2009931; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEtite v1.4] binary file"; flow:established,to_server; content: "|669C60508BD803006854BC00006A00FF50148BCC|";sid: 2009932; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Petite v1.4] binary file"; flow:established,to_server; content: "|B8|";content: "|669C60508BD8030068|"; distance: 3; within: 9;content: "|6A00|"; distance: 11; within: 2;sid: 2009933; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEtite v2.0] binary file"; flow:established,to_server; content: "|B8|";content: "|669C60508BD803|"; distance: 3; within: 7;content: "|6854BC|"; distance: 7; within: 3;content: "|6A|"; distance: 4; within: 1;content: "|FF50188BCC8DA054BC|"; distance: 1; within: 9;content: "|8BC38D90E015|"; distance: 10; within: 6;content: "|68|"; distance: 7; within: 1;sid: 2009934; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEtite v2.1] binary file"; flow:established,to_server; content: "|B8|";content: "|6A|"; distance: 3; within: 1;content: "|68|"; distance: 1; within: 1;content: "|64FF35|"; distance: 3; within: 3;content: "|648925|"; distance: 5; within: 3;content: "|669C6050|"; distance: 5; within: 4;sid: 2009935; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Petite v2.1 (1)] binary file"; flow:established,to_server; content: "|B8|";content: "|68|"; distance: 3; within: 1;content: "|64|"; distance: 3; within: 1;content: "|64|"; distance: 4; within: 1;content: "|669C6050|"; distance: 4; within: 4;sid: 2009936; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Petite v2.1 (2)] binary file"; flow:established,to_server; content: "|B8|";content: "|6A0068|"; distance: 3; within: 3;content: "|64|"; distance: 5; within: 1;content: "|64|"; distance: 4; within: 1;content: "|669C6050|"; distance: 4; within: 4;sid: 2009937; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEtite v2.2] binary file"; flow:established,to_server; content: "|B8|";content: "|68|"; distance: 3; within: 1;content: "|64FF35|"; distance: 3; within: 3;content: "|648925|"; distance: 5; within: 3;content: "|669C6050|"; distance: 5; within: 4;sid: 2009938; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Petite v?.? (after v1.4)] binary file"; flow:established,to_server; content: "|B8|";content: "|669C60508D|"; distance: 3; within: 5;content: "|68|"; distance: 7; within: 1;content: "|83|"; distance: 3; within: 1;sid: 2009939; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEtite vx.x] binary file"; flow:established,to_server; content: "|B8|";content: "|669C6050|"; distance: 3; within: 4;sid: 2009940; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PeX 0.99 -> bart^CrackPl] binary file"; flow:established,to_server; content: "|E9F5|";content: "|0D0AC4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4|"; distance: 3; within: 23;sid: 2009941; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PEX v0.99] binary file"; flow:established,to_server; content: "|60E801|";content: "|83C404E801|"; distance: 5; within: 5;content: "|5D81|"; distance: 7; within: 2;sid: 2009942; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PeX v0.99 (Eng) -> bart/CrackPl] binary file"; flow:established,to_server; content: "|E9F50000000D0AC4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4C4|";sid: 2009943; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE_Admin 1.0 (EncryptPE 1.2003.5.18 Sold) -> Flying Cat] binary file"; flow:established,to_server; content: "|609C64FF3500000000E879010000900000000000000000000000|";content: "|0000000000000000000000000000000000000000|"; distance: 30; within: 20;content: "|000000006B65726E656C33322E646C6C00000047657453797374656D4469726563746F72794100000043726561746546696C654100000043726561746546696C654D617070696E67410000004D6170566965774F6646696C65000000556E6D6170566965774F6646696C65000000436C6F736548616E646C650000004C6F61644C6962726172794100000047657450726F63416464726573730000004578697450726F63657373|"; distance: 38; within: 167;sid: 2009944; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PE_Admin 1.0 (EncryptPE 1.2003.5.18 Sold) -> Flying Cat] binary file"; flow:established,to_server; content: "|609C64FF3500000000E879010000900000000000000000000000|";content: "|0000000000000000000000000000000000000000|"; distance: 30; within: 20;content: "|000000006B65726E656C33322E646C6C00000047657453797374656D4469726563746F72794100000043726561746546696C654100000043726561746546696C654D617070696E67410000004D6170566965774F6646696C65000000556E6D6170566965774F6646696C65000000436C6F736548616E646C650000004C6F61644C6962726172794100000047657450726F63416464726573730000004578697450726F6365737300000000|"; distance: 38; within: 171;sid: 2009945; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PGMPACK v0.13] binary file"; flow:established,to_server; content: "|FA1E1750B430CD213C0273|";content: "|B44CCD21FCBE|"; distance: 11; within: 6;content: "|BF|"; distance: 7; within: 1;content: "|E8|"; distance: 2; within: 1;content: "|E8|"; distance: 2; within: 1;content: "|BB|"; distance: 2; within: 1;content: "|BA|"; distance: 2; within: 1;content: "|8AC38BF3|"; distance: 2; within: 4;sid: 2009946; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PGMPACK v0.14] binary file"; flow:established,to_server; content: "|1E1750B430CD213C0273|";content: "|B44CCD21FCBE|"; distance: 10; within: 6;content: "|BF|"; distance: 7; within: 1;content: "|E8|"; distance: 2; within: 1;content: "|E8|"; distance: 2; within: 1;content: "|BB|"; distance: 2; within: 1;content: "|BA|"; distance: 2; within: 1;content: "|8AC38BF3|"; distance: 2; within: 4;sid: 2009947; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Pi Cryptor 1.0 - by Scofield] binary file"; flow:established,to_server; content: "|558BEC83C4EC53565731C08945ECB8401E0600E848FAFFFF33C05568361F060064FF306489206A0068800000006A036A006A0168000000808D55EC31C0E84EF4FFFF8B45ECE8F6F7FFFF50E8CCFAFFFF8BD883FBFF744E6A0053E8CDFAFFFF8BF881EFAC2600006A006A0068AC26000053E8DEFAFFFF89F8E8E3F1FFFF89C66A006828310600575653E8AEFAFFFF53E880FAFFFF89FA81EA720100008BC6E855FEFFFF89C689F009C07405E8A8FBFFFF31C05A5959648910683D1F06008D45ECE8C3F6FFFFC3|";sid: 2009948; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PKLITE v1.00, v1.03] binary file"; flow:established,to_server; content: "|B8|";content: "|BA|"; distance: 2; within: 1;content: "|8CDB03D83B|"; distance: 2; within: 5;sid: 2009949; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PKLITE v1.00c (1)] binary file"; flow:established,to_server; content: "|2E8C1E|";content: "|8B1E|"; distance: 4; within: 2;content: "|8CDA81C2|"; distance: 3; within: 4;content: "|3BDA72|"; distance: 5; within: 3;content: "|81EB|"; distance: 3; within: 2;content: "|83EB|"; distance: 3; within: 2;content: "|FA8ED3BC|"; distance: 2; within: 4;content: "|FBFDBE|"; distance: 5; within: 3;content: "|8BFE|"; distance: 4; within: 2;sid: 2009950; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PKLITE v1.00c (2)] binary file"; flow:established,to_server; content: "|BA|";content: "|A1|"; distance: 2; within: 1;content: "|2D|"; distance: 2; within: 1;content: "|8CCB81C3|"; distance: 2; within: 4;content: "|3BC377|"; distance: 5; within: 3;content: "|05|"; distance: 3; within: 1;content: "|3BC377|"; distance: 2; within: 3;content: "|B409BA|"; distance: 3; within: 3;content: "|CD21CD2090|"; distance: 4; within: 5;sid: 2009951; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PKLITE v1.12, v1.15, v1.20 (1)] binary file"; flow:established,to_server; content: "|B8|";content: "|BA|"; distance: 2; within: 1;content: "|05|"; distance: 2; within: 1;content: "|3B06|"; distance: 2; within: 2;content: "|73|"; distance: 3; within: 1;content: "|2D|"; distance: 1; within: 1;content: "|FA8ED0FB2D|"; distance: 2; within: 5;content: "|8EC050B9|"; distance: 6; within: 4;content: "|33FF57BE|"; distance: 5; within: 4;content: "|FCF3A5CBB409BA|"; distance: 5; within: 7;content: "|CD21CD20|"; distance: 8; within: 4;sid: 2009952; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PKLITE v1.12, v1.15, v1.20 (2)] binary file"; flow:established,to_server; content: "|B8|";content: "|BA|"; distance: 2; within: 1;content: "|3BC473|"; distance: 2; within: 3;sid: 2009953; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PKLITE v1.14, v1.15, v1.20 (3)] binary file"; flow:established,to_server; content: "|B8|";content: "|BA|"; distance: 2; within: 1;content: "|05|"; distance: 2; within: 1;content: "|3B|"; distance: 2; within: 1;content: "|72|"; distance: 2; within: 1;content: "|B409BA|"; distance: 1; within: 3;content: "|01CD21CD204E6F|"; distance: 3; within: 7;sid: 2009954; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PKLITE v1.14, v1.20] binary file"; flow:established,to_server; content: "|B8|";content: "|BA|"; distance: 2; within: 1;content: "|05|"; distance: 2; within: 1;content: "|3B06|"; distance: 2; within: 2;content: "|72|"; distance: 3; within: 1;content: "|B409BA|"; distance: 1; within: 3;content: "|CD21CD20|"; distance: 4; within: 4;sid: 2009955; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PKLITE v1.20] binary file"; flow:established,to_server; content: "|B8|";content: "|BA|"; distance: 2; within: 1;content: "|05|"; distance: 2; within: 1;content: "|3B06|"; distance: 2; within: 2;content: "|72|"; distance: 3; within: 1;content: "|B409BA|"; distance: 1; within: 3;content: "|CD21B44CCD21|"; distance: 4; within: 6;sid: 2009956; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PKLITE v1.50 (1)] binary file"; flow:established,to_server; content: "|50B8|";content: "|BA|"; distance: 3; within: 1;content: "|05|"; distance: 2; within: 1;content: "|3B06|"; distance: 2; within: 2;content: "|72|"; distance: 3; within: 1;content: "|B4|"; distance: 1; within: 1;content: "|BA|"; distance: 1; within: 1;content: "|CD21B8|"; distance: 2; within: 3;content: "|CD21|"; distance: 4; within: 2;sid: 2009957; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PKLITE v1.50 (Device driver compression)] binary file"; flow:established,to_server; content: "|B409BA1401CD21B8004CCD21F89C505351525657551E06BB|";sid: 2009958; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PKLITE v2.00b] binary file"; flow:established,to_server; content: "|50B8|";content: "|BA|"; distance: 3; within: 1;content: "|05|"; distance: 2; within: 1;content: "|3B06020072|"; distance: 2; within: 5;content: "|B409BA|"; distance: 5; within: 3;content: "|CD21B8014CCD21|"; distance: 4; within: 7;content: "|592D|"; distance: 22; within: 2;content: "|8ED0512D|"; distance: 3; within: 4;content: "|8EC050B9|"; distance: 5; within: 4;sid: 2009959; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PKLITE v2.00b [extra]] binary file"; flow:established,to_server; content: "|50B8|";content: "|BA|"; distance: 3; within: 1;content: "|05|"; distance: 2; within: 1;content: "|3B06020072|"; distance: 2; within: 5;content: "|B409BA|"; distance: 5; within: 3;content: "|CD21B8014CCD21|"; distance: 4; within: 7;content: "|EA|"; distance: 22; within: 1;content: "|F3A5C3592D|"; distance: 3; within: 5;content: "|8ED0512D|"; distance: 6; within: 4;content: "|5080|"; distance: 5; within: 2;sid: 2009960; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PKLITE v2.00c] binary file"; flow:established,to_server; content: "|50B8|";content: "|BA|"; distance: 3; within: 1;content: "|3BC473|"; distance: 2; within: 3;content: "|8BC42D|"; distance: 3; within: 3;content: "|25|"; distance: 4; within: 1;content: "|8BF8B9|"; distance: 2; within: 3;content: "|BE|"; distance: 4; within: 1;content: "|FC|"; distance: 2; within: 1;sid: 2009961; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PKLITE32 1.1] binary file"; flow:established,to_server; content: "|504B4C495445333220436F707972696768742031|";sid: 2009962; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PKLITE32 1.1 -> PKWARE Inc.] binary file"; flow:established,to_server; content: "|68|";content: "|0068|"; distance: 2; within: 2;content: "|006800000000E8|"; distance: 3; within: 7;content: "|E9|"; distance: 9; within: 1;sid: 2009963; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PKLITE32 v1.1] binary file"; flow:established,to_server; content: "|558BECA1|";content: "|85C07409B8010000005DC20C008B450C5756538B5D10|"; distance: 6; within: 22;sid: 2009964; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PKLITE32 v1.1] binary file"; flow:established,to_server; content: "|68|";content: "|68|"; distance: 3; within: 1;content: "|6800000000E8|"; distance: 3; within: 6;sid: 2009965; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PKLITE32 v1.1] binary file"; flow:established,to_server; content: "|68|";content: "|68|"; distance: 3; within: 1;content: "|B8|"; distance: 3; within: 1;content: "|2B44240C50|"; distance: 3; within: 5;sid: 2009966; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PKLITE32 v1.1] binary file"; flow:established,to_server; content: "|504B4C495445333220436F707972696768742031|";sid: 2009967; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Pksmart 1.0b] binary file"; flow:established,to_server; content: "|BA|";content: "|8CC88BC803C281|"; distance: 2; within: 7;content: "|51B9|"; distance: 8; within: 2;content: "|511E8CD3|"; distance: 3; within: 4;sid: 2009968; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PKTINY v1.0 with TINYPROG v3.8] binary file"; flow:established,to_server; content: "|2EC606|";content: "|2EC606|"; distance: 4; within: 3;content: "|2EC606|"; distance: 4; within: 3;content: "|E9|"; distance: 4; within: 1;content: "|E8|"; distance: 2; within: 1;content: "|83|"; distance: 2; within: 1;sid: 2009969; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PKZIP-SFX v1.1 1989-90] binary file"; flow:established,to_server; content: "|FC2E8C0E|";content: "|A1|"; distance: 5; within: 1;content: "|8CCB81C3|"; distance: 2; within: 4;content: "|3BC372|"; distance: 5; within: 3;content: "|2D|"; distance: 3; within: 1;content: "|2D|"; distance: 2; within: 1;content: "|FABC|"; distance: 2; within: 2;content: "|8ED0FB|"; distance: 3; within: 3;sid: 2009970; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PLINK86 1984, 1985] binary file"; flow:established,to_server; content: "|FA8CC78CD68BCCBA|";content: "|8EC226|"; distance: 9; within: 3;sid: 2009971; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PluginToExe v1.00 -> BoB / BobSoft] binary file"; flow:established,to_server; content: "|E80000000029C05D81EDD140400050FF95B8404000898509404000FF95B440400089851140400050FF95C04040008A0880F922750750FF95C440400089850D4040008B9D09404000606A006A015381C3|";content: "|00FFD3616A006844694550FFB50D4040006A0081C3|"; distance: 81; within: 21;content: "|00FFD383C410FF95B0404000|"; distance: 22; within: 12;sid: 2009972; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PluginToExe v1.01 -> BoB / BobSoft] binary file"; flow:established,to_server; content: "|E80000000029C05D81EDC6414000508F857140400050FF95A541400089856D404000FF95A141400050FF95B541400080380074168A0880F922750750FF95B9414000898575404000EB6C6A018F85714040006A586A40FF95A941400089856940400089C768000800006A40FF95A941400089471CC70758000000C7472000080000C7471801000000C74734041088008D8DB9404000894F0C8D8DDB404000894F30FFB569404000FF9595414000FF771C8F85754040008B9D6D404000606A006A015381C3|";content: "|00FFD3616A006844694550FFB5754040006A0081C3|"; distance: 197; within: 21;content: "|0000FFD383C41083BD71404000007410FF771CFF95AD41400057FF95AD4140006A00FF959D414000|"; distance: 22; within: 40;sid: 2009973; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PluginToExe v1.02 -> BoB / BobSoft] binary file"; flow:established,to_server; content: "|E80000000029C05D81ED32424000508F85DD40400050FF95114240008985D9404000FF950D42400050FF952142400080380074168A0880F922750750FF95254240008985E1404000EB6C6A018F85DD4040006A586A40FF95154240008985D540400089C768000800006A40FF951542400089471CC7075800|";sid: 2009974; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PMODE/W v.1.12, 1.16, 1.21, 1.33 DOS extender] binary file"; flow:established,to_server; content: "|FC1607BF|";content: "|8BF757B9|"; distance: 5; within: 4;content: "|F3A5061E071F5FBE|"; distance: 5; within: 8;content: "|060EA4|"; distance: 9; within: 3;sid: 2009975; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PocketPC ARM] binary file"; flow:established,to_server; content: "|F0402DE90040A0E10150A0E10260A0E10370A0E1|";content: "|0000EB0730A0E10620A0E10510A0E10400A0E1|"; distance: 20; within: 19;content: "|EBF040BDE8|"; distance: 20; within: 5;content: "|0000EA|"; distance: 5; within: 3;content: "|402DE9|"; distance: 3; within: 3;content: "|9FE5|"; distance: 4; within: 2;content: "|00|"; distance: 4; within: 1;content: "|9FE500|"; distance: 5; within: 3;content: "|00|"; distance: 5; within: 1;sid: 2009976; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PocketPC MIB] binary file"; flow:established,to_server; content: "|E8FFBD271400BFAF1800A4AF1C00A5AF2000A6AF2400A7AF|";content: "|0C000000001800A48F1C00A58F2000A68F|"; distance: 25; within: 17;content: "|0C2400A78F|"; distance: 18; within: 5;content: "|0C252040001400BF8F0800E0031800BD27|"; distance: 6; within: 17;content: "|FFBD271800|"; distance: 17; within: 5;content: "|AF|"; distance: 5; within: 1;content: "|00|"; distance: 1; within: 1;sid: 2009977; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PocketPC SHA] binary file"; flow:established,to_server; content: "|862F962FA62FB62F224F4368536B636A7369F07F0BD00B40090009D0B365A36693670B408364036404D00B400900107F264FF66BF66AF6690B00F668|";content: "|00|"; distance: 61; within: 1;content: "|00|"; distance: 2; within: 1;content: "|00224FF07F0AD006D406D50B4009|"; distance: 2; within: 14;sid: 2009978; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Pohernah 1.0.0 - by Kas] binary file"; flow:established,to_server; content: "|5860E8000000005D81ED202540008BBD862540008B8D8E2540006BC00583F00489859225400083F900742D817F1CAB000000751E8B770C03B58A25400031C03B4710740E508B85922540003006584046EBED83C72849EBCE8B85822540008944241C61FFE0|";sid: 2009979; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Pohernah 1.0.1 - by Kas] binary file"; flow:established,to_server; content: "|60E8000000005D81EDF12640008BBD182840008B8D20284000B83828400001E880300583F9007471817F1CAB00000075628B570C03951C28400031C05131C966B9FA006683F90074498B570C03951C2840008B852428400083F802750681C200020000518B4F1083F802750681E90002000057BFC800000089CEE82700000089C15FB83828400001E8E8240000005949EBB15983C72849EB8A8B85142840008944241C61FFE056574FF7D721FE89F05F5EC36083F00540904883F00589C689D760E80B0000006183C70883E907E2F161C3578B1F8B4F0468B979379E5A4289D048C1E005BF200000004A89DDC1E50429E98B6E0831DD29E989DDC1ED0531C529E92B4E0C89CDC1E50429EB8B2E31CD29EB89CDC1ED0531C529EB2B5E0429D04F75C85F891F894F04C3|";sid: 2009980; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Pohernah 1.0.2 - by Kas] binary file"; flow:established,to_server; content: "|60E8000000005D81EDDE2640008BBD052840008B8D0D284000B82528400001E880300583F9007471817F1CAB00000075628B570C03950928400031C05131C966B9F7006683F90074498B570C0395092840008B851128400083F802750681C200020000518B4F1083F802750681E90002000057BFC800000089CEE82700000089C15FB82528400001E8E8240000005949EBB15983C72849EB8A8B85012840008944241C61FFE056574FF7D721FE89F05F5EC36083F00540904883F00589C689D760E80B0000006183C70883E907E2F161C3578B1F8B4F0468B979379E5A4289D048C1E005BF200000004A89DDC1E50429E98B6E0831DD29E989DDC1ED0531C529E92B4E0C89CDC1E50429EB8B2E31CD29EB89CDC1ED0531C529EB2B5E0429D04F75C85F891F894F04C3|";sid: 2009981; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Pohernah 1.0.3 - by Kas] binary file"; flow:established,to_server; content: "|60E8000000005D81ED2A27400031C04083F006403D401F00007507BE6A274000EB02EBEB8B859E28400083F801751731C001EE3D99000000740C8B8D86284000300E4046EBED|";content: "|56574FF7D721FE89F05F5EC36083F00540904883F00589C689D760E80B0000006183C70883E907E2F161C3578B1F8B4F0468B979379E5A4289D048C1E005BF200000004A89DDC1E50429E98B6E0831DD29E989DDC1ED0531C529E92B4E0C89CDC1E50429EB8B2E31CD29EB89CDC1ED0531C529EB2B5E0429D04F75C85F891F894F04C3|"; distance: 146; within: 131;sid: 2009982; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PolyCryptor by SMT Version %v3.%v4] binary file"; flow:established,to_server; content: "|EB|";content: "|28506F6C7953637279707420|"; distance: 1; within: 12;content: "|20627920534D5429|"; distance: 13; within: 8;sid: 2009983; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PoPa 0.01 (Packer on Pascal) -> bagie] binary file"; flow:established,to_server; content: "|558BEC83C4EC53565733C08945ECB8A43E0010E830F6FFFF33C05568BE400010|";content: "|89206A0068800000006A036A006A0168000000808D55EC33C0E862E7FFFF8B45ECE832F2FFFF50E8B4F6FFFFA36466001033D255689340001064FF32648922833D64660010FF0F843A0100006A006A006A00A16466001050E89BF6FFFF83E81050A16466001050E8BCF6FFFF6A0068806600106A106868660010A16466001050E88BF6FFFF|"; distance: 34; within: 133;sid: 2009984; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PPC-PROTECT 1.1X -> Alexey Gorchakov] binary file"; flow:established,to_server; content: "|FF5F2DE920009FE5000090E518008FE518009FE5000090E510008FE50100A0E3000000EB020000EA04F01FE5|";sid: 2009985; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Private Exe Protector 1.x -> setisoft] binary file"; flow:established,to_server; content: "|B8|";content: "|B9|"; distance: 3; within: 1;content: "|9001|"; distance: 1; within: 2;content: "|BE|"; distance: 2; within: 1;content: "|1040|"; distance: 1; within: 2;content: "|68509141|"; distance: 2; within: 4;content: "|6801|"; distance: 4; within: 2;content: "|C3|"; distance: 3; within: 1;sid: 2009986; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Private EXE v2.0a] binary file"; flow:established,to_server; content: "|53E8000000005B8BC32D|";sid: 2009987; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Private Personal Packer (PPP) 1.0.3 -> ConquestOfTroy.com] binary file"; flow:established,to_server; content: "|E8190000009090E868000000FF352C370010E8ED0100006A00E82E040000E841040000A3743700106A64E85F040000E830040000A3783700106A64E84E040000E81F040000A37C370010A1743700108B1D783700102BD88B0D7C3700102BC883FB64730F81F9C800000073076A00E8D9030000C36A0A6A076A00E8D3030000A320370010506A00E8DE030000A324370010FF35203700106A00E8EA030000A330370010FF3524370010E8C2030000A3283700108B0D303700108B3D28370010EB0949C0043955803439240BC9|";sid: 2009988; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Private Personal Packer (PPP) v1.0.2 --> ConquestOfTroy.com] binary file"; flow:established,to_server; content: "|E817000000E868000000FF352C370010E8ED0100006A00E82E040000E841040000A3743700106A64E85F040000E830040000A3783700106A64E84E040000E81F040000A37C370010A1743700108B1D783700102BD88B0D7C3700102BC883FB64730F81F9C800000073076A00E8D9030000C36A0A6A076A00|";sid: 2009989; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PrivateEXE v2.0a] binary file"; flow:established,to_server; content: "|0660C8|";content: "|0E68|"; distance: 4; within: 2;content: "|9A|"; distance: 3; within: 1;content: "|3D|"; distance: 3; within: 1;content: "|0F|"; distance: 2; within: 1;content: "|50500E68|"; distance: 2; within: 4;content: "|9A|"; distance: 5; within: 1;content: "|0E|"; distance: 3; within: 1;sid: 2009990; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PrivateEXE v2.0a] binary file"; flow:established,to_server; content: "|53E8|";content: "|5B8BC32D|"; distance: 4; within: 4;content: "|5081|"; distance: 6; within: 2;content: "|8B|"; distance: 4; within: 1;sid: 2009991; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PRO-PACK v2.08] binary file"; flow:established,to_server; content: "|8CD38EC38CCA8EDA8B0E|";content: "|8BF183|"; distance: 11; within: 3;content: "|8BFED1|"; distance: 4; within: 3;content: "|FDF3A553|"; distance: 3; within: 4;sid: 2009992; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PRO-PACK v2.08, emphasis on packed size, locked] binary file"; flow:established,to_server; content: "|83EC|";content: "|8BECBE|"; distance: 2; within: 3;content: "|FCE8|"; distance: 4; within: 2;content: "|05|"; distance: 3; within: 1;content: "|8BC8E8|"; distance: 2; within: 3;content: "|8B|"; distance: 4; within: 1;sid: 2009993; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ProActivate V1.0X -> TurboPower Software Company] binary file"; flow:established,to_server; content: "|558BECB90E0000006A006A004975F951535657B8|";content: "|909090909033C05568|"; distance: 22; within: 9;content: "|64FF30648920A1|"; distance: 11; within: 7;content: "|83C005A3|"; distance: 9; within: 4;content: "|C705|"; distance: 6; within: 2;content: "|0D000000E885E2FFFF813D|"; distance: 4; within: 11;content: "|217E7E40757A813D|"; distance: 13; within: 8;content: "|43524333756E813D|"; distance: 10; within: 8;content: "|32407E7E7562813D|"; distance: 10; within: 8;content: "|217E7E407556813D|"; distance: 10; within: 8;content: "|43524333754A813D|"; distance: 10; within: 8;content: "|32407E7E753E813D|"; distance: 10; within: 8;content: "|217E7E407532813D|"; distance: 10; within: 8;content: "|43524333|"; distance: 10; within: 4;sid: 2009994; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Program Protector XP v1.0] binary file"; flow:established,to_server; content: "|E8|";content: "|5883D80589C381C3|"; distance: 3; within: 8;content: "|8B436450|"; distance: 10; within: 4;sid: 2009995; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PROTECT! EXE/COM v6.0] binary file"; flow:established,to_server; content: "|1EB430CD213C0273|";content: "|CD20BE|"; distance: 8; within: 3;content: "|E8|"; distance: 4; within: 1;sid: 2009996; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Protection Plus vx.x] binary file"; flow:established,to_server; content: "|506029C064FF30E8|";content: "|5D83ED3C89E889A514|"; distance: 10; within: 9;content: "|2B851C|"; distance: 10; within: 3;content: "|89851C|"; distance: 4; within: 3;content: "|8D852703|"; distance: 4; within: 4;content: "|508B|"; distance: 5; within: 2;content: "|85C00F85C0|"; distance: 2; within: 5;content: "|8DBD5B03|"; distance: 6; within: 4;content: "|8DB54303|"; distance: 5; within: 4;content: "|E8DD|"; distance: 5; within: 2;content: "|89851F03|"; distance: 3; within: 4;content: "|6A4068|"; distance: 5; within: 3;content: "|10|"; distance: 3; within: 1;content: "|8B85|"; distance: 2; within: 2;sid: 2009997; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[pscrambler 1.2 -> by p0ke] binary file"; flow:established,to_server; content: "|558BECB9040000006A006A004975F95153|";content: "|10E82DF3FFFF33C05568E831001064FF306489208D45E0E853F5FFFF8B45E08D55E4E830F6FFFF8B45E48D55E8E8A9F4FFFF8B45E88D55ECE8EEF7FFFF8B55ECB8C4540010E8D9ECFFFF833DC4540010000F8405010000803DA0400010007441A1C4540010E8D9EDFFFFE848E0FFFF8BD8A1C4540010E8C8EDFFFF50B8C4540010E865EFFFFF8BD359E869E1FFFF8BC3E812FAFFFF8BC3E833E0FFFFE9AD000000B805010000E80CE0FFFF8BD8536805010000E857F3FFFF8D45DC8BD3E839EDFFFF8B55DCB814560010B900320010E8BBEDFFFF8B1514560010B8C8540010E853E5FFFFBA01000000B8C8540010E88CE8FFFFE8DFE0FFFF85C075526A00A1C4540010E83BEDFFFF50B8C4540010E8D8EEFFFF8BD0B8C854001059E83BE6FFFFE876E0FFFFB8C8540010E84CE6FFFFE867E0FFFF6A006A006A00A114560010E853EEFFFF506A006A00E841F3FFFF803D9C400010007405E8EFFBFFFF33C05A595964891068EF3100108D45DCBA05000000E87DEBFFFFC3E923E9FFFFEBEB5BE863EAFFFF000000FFFFFFFF0800000074656D702E657865|"; distance: 19; within: 407;sid: 2009998; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PUNiSHER v1.5 (DEMO) -> FEUERRADER/AHTeam] binary file"; flow:established,to_server; content: "|EB0483A4BCCE60EB0480BC0411E800000000812C24CAC24100EB04646B88185DE800000000EB04646B8818812C2486000000EB04646B88188B859CC24100EB04646B8818290424EB04646B8818EB04646B88188B04|";sid: 2009999; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PUNiSHER v1.5 (DEMO) -> FEUERRADER/AHTeam] binary file"; flow:established,to_server; content: "|EB0483A4BCCE60EB0480BC0411E800000000812C24CAC24100EB04646B88185DE800000000EB04646B8818812C2486000000EB04646B88188B859CC24100EB04646B8818290424EB04646B8818EB04646B88188B0424EB04646B881889859CC24100EB04646B881858689F6F56B650E85D000000EBFF7178C25000EBD35BF368895C24485C2458FF8D5C24585B83C34C75F45A8D7178750981F3EBFF52BA010083EBFC4AFF710F75198B5C240000813350538B1B0FFFC6751B81F3EB871C248B8B042483ECFCEB01E883ECFCE9E700000058EBFFF0EBFFC083E8FDEBFF30E8C900000089E0EBFFD0EBFF710F83C001EBFF70F071EEEBFAEB83C014EBFF70ED|";sid: 20091000; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PUNiSHER V1.5 Demo-> FEUERRADER] binary file"; flow:established,to_server; content: "|EB0483A4BCCE60EB0480BC0411E800000000|";sid: 20091001; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PureBasic 4.x -> Neil Hodgson] binary file"; flow:established,to_server; content: "|68|";content: "|0000680000000068|"; distance: 2; within: 8;content: "|00E8|"; distance: 9; within: 2;content: "|0083C40C6800000000E8|"; distance: 3; within: 10;content: "|00A3|"; distance: 11; within: 2;content: "|00680000000068001000006800000000E8|"; distance: 3; within: 17;content: "|00A3|"; distance: 18; within: 2;sid: 20091002; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PureBasic 4.x DLL -> Neil Hodgson] binary file"; flow:established,to_server; content: "|837C240801750E8B442404A3|";content: "|10E822000000837C2408027500837C2408007505E8|"; distance: 13; within: 21;content: "|000000837C2408037500B801000000C20C00680000000068001000006800000000E8|"; distance: 21; within: 34;content: "|0F0000A3|"; distance: 34; within: 4;sid: 20091003; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[PureBasic DLL -> Neil Hodgson] binary file"; flow:established,to_server; content: "|837C24080175|";content: "|8B442404A3|"; distance: 6; within: 5;content: "|10E8|"; distance: 6; within: 2;sid: 20091004; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[QrYPt0r - by NuTraL] binary file"; flow:established,to_server; content: "|EB00E8B5000000E92E01000064FF3500000000|";content: "|648925000000008B442404|"; distance: 44; within: 11;sid: 20091005; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RatPacker (Glue) stub] binary file"; flow:established,to_server; content: "|4020FF00000000000000|";content: "|BE006040008DBE00B0FFFF|"; distance: 10; within: 11;sid: 20091006; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RAZOR 1911 encruptor] binary file"; flow:established,to_server; content: "|E8|";content: "|BF|"; distance: 2; within: 1;content: "|3BFC72|"; distance: 2; within: 3;content: "|B44CCD21BE|"; distance: 3; within: 5;content: "|B9|"; distance: 6; within: 1;content: "|FDF3A5FC|"; distance: 2; within: 4;sid: 20091007; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RCryptor 1.5 -> Vaska] binary file"; flow:established,to_server; content: "|832C244F68|";content: "|FF542404834424044FB8|"; distance: 7; within: 10;content: "|3D|"; distance: 12; within: 1;content: "|74068030|"; distance: 3; within: 4;content: "|EBF3B8|"; distance: 5; within: 3;content: "|3D|"; distance: 5; within: 1;content: "|74068030|"; distance: 3; within: 4;content: "|40EBF3|"; distance: 4; within: 3;sid: 20091008; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RCryptor 1.6c -> Vaska] binary file"; flow:established,to_server; content: "|8BC70304242BC78038500F851B8B1FFF68|";content: "|B8|"; distance: 19; within: 1;content: "|3D|"; distance: 3; within: 1;content: "|74068030|"; distance: 3; within: 4;content: "|40EBF3B8|"; distance: 4; within: 4;content: "|3D|"; distance: 6; within: 1;content: "|74068030|"; distance: 3; within: 4;content: "|40EBF3|"; distance: 4; within: 3;sid: 20091009; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RCryptor 2.0 -> Vaska] binary file"; flow:established,to_server; content: "|F7D183F1FF6A00F7D183F1FF810424|";content: "|F7D183F1FF|"; distance: 17; within: 5;sid: 20091010; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RCryptor v1.3 / v1.4 --> Vaska] binary file"; flow:established,to_server; content: "|558BEC8B44240483E84F68|";content: "|FFD0585950|"; distance: 13; within: 5;sid: 20091011; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RCryptor v1.3 / v1.4 --> Vaska] binary file"; flow:established,to_server; content: "|558BEC8B44240483E84F68|";content: "|FFD0585950B8|"; distance: 13; within: 6;content: "|3D|"; distance: 8; within: 1;content: "|74068030|"; distance: 3; within: 4;content: "|40EBF3|"; distance: 4; within: 3;sid: 20091012; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RCryptor v1.3b --> Vaska] binary file"; flow:established,to_server; content: "|6183EF4F6068|";content: "|FFD7|"; distance: 8; within: 2;sid: 20091013; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RCryptor v1.3b --> Vaska] binary file"; flow:established,to_server; content: "|6183EF4F6068|";content: "|FFD7B8|"; distance: 8; within: 3;content: "|3D|"; distance: 5; within: 1;content: "|74068030|"; distance: 3; within: 4;content: "|40EBF3|"; distance: 4; within: 3;sid: 20091014; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RCryptor v1.5 (Private) --> Vaska] binary file"; flow:established,to_server; content: "|832C244F68|";content: "|FF542404834424044FB8|"; distance: 7; within: 10;content: "|3D|"; distance: 12; within: 1;content: "|74068030|"; distance: 3; within: 4;content: "|40EBF3|"; distance: 4; within: 3;sid: 20091015; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RCryptor v1.5 --> Vaska] binary file"; flow:established,to_server; content: "|832C244F68|";content: "|FF542404834424044F|"; distance: 7; within: 9;sid: 20091016; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RCryptor v1.6 -> Vaska] binary file"; flow:established,to_server; content: "|33D068|";content: "|FFD2|"; distance: 5; within: 2;sid: 20091017; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RCryptor v1.6 -> Vaska] binary file"; flow:established,to_server; content: "|33D068|";content: "|FFD2B8|"; distance: 5; within: 3;content: "|3D|"; distance: 5; within: 1;content: "|74068030|"; distance: 3; within: 4;content: "|40EBF3|"; distance: 4; within: 3;sid: 20091018; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RCryptor v1.6b / v1.6c --> Vaska] binary file"; flow:established,to_server; content: "|8BC70304242BC78038500F851B8B1FFF68|";sid: 20091019; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RCryptor v1.6b / v1.6c --> Vaska] binary file"; flow:established,to_server; content: "|8BC70304242BC78038500F851B8B1FFF68|";content: "|B8|"; distance: 19; within: 1;content: "|3D|"; distance: 3; within: 1;content: "|74068030|"; distance: 3; within: 4;content: "|40EBF3|"; distance: 4; within: 3;sid: 20091020; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RCryptor v1.6d --> Vaska] binary file"; flow:established,to_server; content: "|60906161807FF04590600F851B8B1FFF68|";sid: 20091021; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RCryptor V1.6d -> Vaska] binary file"; flow:established,to_server; content: "|60906161807FF04590600F851B8B1FFF68|";content: "|B8|"; distance: 19; within: 1;content: "|903D|"; distance: 3; within: 2;content: "|74068030|"; distance: 4; within: 4;content: "|40EBF3B8|"; distance: 4; within: 4;content: "|903D|"; distance: 6; within: 2;content: "|74068030|"; distance: 4; within: 4;content: "|40EBF3|"; distance: 4; within: 3;sid: 20091022; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RCryptor v1.6x --> Vaska] binary file"; flow:established,to_server; content: "|60906161807FF04590600F851B8B1FFF68|";content: "|C3|"; distance: 19; within: 1;sid: 20091023; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RCryptor v1.?? -> Vaska] binary file"; flow:established,to_server; content: "|90589050908B00903C5090580F8567D6EF115068|";sid: 20091024; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RCryptor v1.?? -> Vaska] binary file"; flow:established,to_server; content: "|90589050908B00903C5090580F8567D6EF115068|";content: "|B8|"; distance: 22; within: 1;content: "|3D|"; distance: 3; within: 1;content: "|74068030|"; distance: 3; within: 4;content: "|40EBF3|"; distance: 4; within: 3;sid: 20091025; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RCryptor v2.0 (Hide EP) --> Vaska] binary file"; flow:established,to_server; content: "|F7D183F1FF6A00F7D183F1FF810424DC20|";content: "|00F7D183F1FFE800000000F7D183F1FFC3|"; distance: 17; within: 17;sid: 20091026; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RCryptor v2.0 --> Vaska] binary file"; flow:established,to_server; content: "|F7D183F1FF6A00F7D183F1FF810424|";content: "|020000F7D183F1FF59BA3221|"; distance: 15; within: 12;content: "|00F7D183F1FFF7D183F1FF8002E3F7D183F1FFC00A05F7D183F1FF80026FF7D183F1FF8032A4F7D183F1FF80022DF7D183F1FF424985C975CD1C4F8D5BFD621E1C4F8D5BFD4D9DB9|"; distance: 12; within: 72;content: "|1E1C4F8D5BFD221C4F8D5BFD8EA2B9B9E283DBE2E54DCD1EBF60AB1F4DDB1E1E3D1E921B8EDC7DECA4E24DE520C6CCB28EEC2D7DDC1C4F8D5BFD83568EE03A7DD08E9D6E7DD64D2506C2AB20CC3A4D2D9D6B0B8145CC184D2D1FA1A16BC2CCF7E24D2D9E8B8BCCDE2E2DF71EAB7D4592308EE6B97DD68E9D27DAFDFD1E1E8EDFB87DCF8EA34D7DDC1C4F8D5BFD33D71E1E1EA60B41A1A642616B416B4C451E21F626BCE2621E621E621E236359|"; distance: 73; within: 173;content: "|1E621E621E33D71E1E1E856BC241ABC29F236BC241A11EC0FDF0FD3020339E1E1E1E85A20B8BC22741EBA1A2C21EC0FDF0FD30621E337E1E1E1EC62D42AB9F236BC241A11EC0FDF0FD30C0FDF08E1D1C4F8D5BFDE000335E1E1E1EBF0BECC2E642A2C2451EC0FDF0FD30CE36CCF21C4F8D5BFD|"; distance: 173; within: 115;sid: 20091027; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RE-Crypt v0.7x -> Crudd [RET] (h1)] binary file"; flow:established,to_server; content: "|60E8000000005D81EDF31D4000B97B0900008DBD3B1E40008BF76160E8000000005D558104240A000000C38BF581C5|";content: "|0000896D348975388B7D3881E700FFFFFF81C74800000047037D608B4D5C83F9007E0F8B|"; distance: 48; within: 36;sid: 20091028; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RE-Crypt v0.7x -> Crudd [RET] (h2)] binary file"; flow:established,to_server; content: "|60E8000000005D558104240A000000C38BF581C5|";content: "|0000896D348975388B7D3881E700FFFFFF81C74800000047037D608B4D5C83F9007E0F8B17335558891783C70483C1FCEBEC8B|"; distance: 21; within: 51;sid: 20091029; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Reflexive Arcade Wrapper] binary file"; flow:established,to_server; content: "|558BEC6AFF68986842006814FA410064A100000000506489250000000083EC585356578965E8FF15F850420033D28AD489153CE842008BC881E1FF000000890D38E84200C1E10803CA890D34E84200C1E810A330E8|";sid: 20091030; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Reg2Exe 2.20/2.21 - by Jan Vorel] binary file"; flow:established,to_server; content: "|6A00E87D120000A3A0444000E8791200006A0A506A00FF35A0444000E80F00000050E869120000CCCCCCCCCCCCCCCCCC682C020000680000000068B0444000E83A12000083C40C8B442404A3B8444000680000000068A00F00006800000000E832120000A3B044400068F401000068BC444000FF35B8444000E81E120000B8BC44400089C18A304080FE5C750289C180FE0075F1C60100E8EC180000E828160000E84A1200006800FA00006808000000FF35B0444000E8E7110000A3B44440008B15D4464000E8650A0000BB00001000B801000000E8720A00007409C7000100000083C004A3D4464000FF35B4444000E8260500008D0DB84640005AE8CF0F0000FF35B4444000FF35B8464000E8EE0600008D0DB44640005AE8|";sid: 20091031; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Reg2Exe 2.22/2.23 - by Jan Vorel] binary file"; flow:established,to_server; content: "|6A00E82F1E0000A3C4354000E82B1E00006A0A506A00FF35C4354000E80700000050E81B1E0000CC6848000000680000000068C8354000E87616000083C40C8B442404A3CC354000680000000068A00F00006800000000E8EC1D0000A3C8354000E8621D0000E8921A0000E880160000E8131400006801000000680836400068000000008B1508364000E8713F0000B800001000BB01000000E8823F0000FF3548314000B800010000E80D1300008D0DEC3540005AE8F21300006800010000FF35EC354000E8841D0000A3F4354000FF3548314000FF35F4354000FF35EC354000E8|";sid: 20091032; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Reg2Exe 2.24 - by Jan Vorel] binary file"; flow:established,to_server; content: "|6A00E8CF200000A3F4454000E8CB2000006A0A506A00FF35F4454000E80700000050E8BB200000CC6848000000680000000068F8454000E80619000083C40C8B442404A3FC454000680000000068A00F00006800000000E88C200000A3F8454000E802200000E8321D0000E820190000E8A31600006801000000683846400068000000008B1538464000E8714F0000B800001000BB01000000E8824F0000FF3548414000B800010000E89D1500008D0D1C4640005AE8821600006800010000FF351C464000E824200000A324464000FF3548414000FF3524464000FF351C464000E8DC1000008D0D144640005AE84A16|";sid: 20091033; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Reg2Exe 2.25 - by Jan Vorel] binary file"; flow:established,to_server; content: "|6868000000680000000068707D4000E8AE20000083C40C6800000000E8AF520000A3747D4000680000000068001000006800000000E89C520000A3707D4000E824500000E8E2480000E844340000E854280000E898270000E893200000680100000068D07D400068000000008B15D07D4000E8898F0000B8000010006801000000E89A8F0000FF35A47F40006800010000E83A2300008D0DA87D40005AE85E1F0000FF35A87D40006800010000E82A520000A3B47D4000FF35A47F4000FF35B47D4000FF35A87D4000E85C0C00008D0DA07D40005AE8261F0000FF35|";sid: 20091034; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ReversingLabsProtector 0.7.4 beta -> Ap0x] binary file"; flow:established,to_server; content: "|6800004100E801000000C3C3|";sid: 20091035; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RJcrush v1.00] binary file"; flow:established,to_server; content: "|06FC8CC8BA|";content: "|03D052BA|"; distance: 6; within: 4;content: "|52BA|"; distance: 5; within: 2;content: "|03C28BD805|"; distance: 3; within: 5;content: "|8EDB8EC033F633FFB9|"; distance: 6; within: 9;sid: 20091036; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RJoiner 1.2 by Vaska (25.03.2007 16:58)] binary file"; flow:established,to_server; content: "|558BEC81EC0C0200008D85F4FDFFFF56506804010000FF1514104000908D85F4FDFFFF50FF151010400090BE0020400090833EFF0F8484000000535733FF8D46|";sid: 20091037; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RJoiner by Vaska (Sign from pinch 25.03.2007 17:00)] binary file"; flow:established,to_server; content: "|E803FDFFFF6A00E80C000000FF256C104000FF2570104000FF2574104000FF2578104000FF257C104000FF2580104000FF2584104000FF2588104000FF258C10|";sid: 20091038; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack --> Ap0x] binary file"; flow:established,to_server; content: "|60E8000000008B2C2483C4048DB52C0A00008D9D2202000033FFE8830100006A4068001000006800200C006A00FF95CD0900008985140A0000EB1460FFB5140A|";sid: 20091039; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack --> Ap0x] binary file"; flow:established,to_server; content: "|60E8000000008B2C2483C4048DB55A0A00008D9D4002000033FFE8830100006A4068001000006800200C006A00FF95EB09000089853A0A0000EB1460FFB53A0A|";sid: 20091040; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack --> Ap0x] binary file"; flow:established,to_server; content: "|60E8000000008B2C2483C404EB030C0000EB030C00008DB5CB2200008D9DF002000033FFE847020000EB031500006A4068001000006800200C006A00FF959B0A|";sid: 20091041; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack -> Ap0x] binary file"; flow:established,to_server; content: "|60E8000000008B2C2483C4048DB52C0A00008D9D2202000033FFE8|";content: "|6A4068|"; distance: 29; within: 3;content: "|68|"; distance: 5; within: 1;content: "|6A00FF95CD0900008985|"; distance: 3; within: 10;content: "|EB1460FFB5140A|"; distance: 12; within: 7;sid: 20091042; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack -> Ap0x] binary file"; flow:established,to_server; content: "|60E8000000008B2C2483C4048DB55A0A00008D9D4002000033FFE8|";content: "|6A4068|"; distance: 29; within: 3;content: "|68|"; distance: 5; within: 1;content: "|6A00FF95EB0900008985|"; distance: 3; within: 10;content: "|EB1460FFB53A0A|"; distance: 12; within: 7;sid: 20091043; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack -> Ap0x] binary file"; flow:established,to_server; content: "|60E8000000008B2C2483C404EB03|";content: "|EB03|"; distance: 15; within: 2;content: "|8DB5CB2200008D9DF002000033FFE8|"; distance: 3; within: 15;content: "|EB03|"; distance: 17; within: 2;content: "|6A4068|"; distance: 3; within: 3;content: "|68|"; distance: 5; within: 1;content: "|6A00FF959B0A|"; distance: 3; within: 6;sid: 20091044; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack 1.0 beta -> ap0x] binary file"; flow:established,to_server; content: "|60E8000000008D6424048B6C24FC8DB54C0200008D9D1301000033FFEB0FFF743704FF3437FFD383C40883C708833C370075EB8D743704536A40680010000068|";content: "|6A00FF95F90100008985480200005BFFB5|"; distance: 66; within: 17;sid: 20091045; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack 1.0 beta -> ap0x] binary file"; flow:established,to_server; content: "|60E8000000008D6424048B6C24FC8DB54C0200008D9D1301000033FFEB0FFF743704FF3437FFD383C40883C708833C370075EB8D743704536A40680010000068|";content: "|6A00FF95F90100008985480200005BFFB54802000056FFD383C4088BB5480200008BC6EB014080380175FA408B3883C004898544020000EB7A56FF95F10100008985400200008BC6EB4F8B85440200008B00A90000008074143500000080508B8544020000C70020202000EB06FFB544020000FFB540020000FF95F5010000890783C7048B8544020000EB014080380075FA4089854402000080380075ACEB0146803E0075FA46408B3883C004898544020000803E017581680040000068|"; distance: 66; within: 190;content: "|FFB548020000FF95FD0100006168|"; distance: 192; within: 14;content: "|C3608B7424248B7C|"; distance: 16; within: 8;sid: 20091046; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack 1.1 BasicEdition -> ap0x] binary file"; flow:established,to_server; content: "|60E8000000008B2C2483C4048DB54A0200008D9D1101000033FFEB0FFF743704FF3437FFD383C40883C708833C370075EB8D743704536A40680010000068|";sid: 20091047; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack 1.18 (aPlib 0.43) -> ap0x] binary file"; flow:established,to_server; content: "|60E8000000008B2C2483C4|";content: "|8DB51A0400008D9DC102000033FFE861010000EB0FFF743704FF3437FFD383C4|"; distance: 11; within: 32;content: "|83C7|"; distance: 32; within: 2;content: "|833C370075EB83BD0604000000740E83BD0A040000007405E8D70100008D743704536A|"; distance: 2; within: 35;content: "|68|"; distance: 35; within: 1;content: "|68|"; distance: 3; within: 1;content: "|6A00FF95A70300008985160400005BFFB51604000056FFD383C4|"; distance: 3; within: 26;content: "|8BB5160400008BC6EB01|"; distance: 26; within: 10;sid: 20091048; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack 1.18 (LZMA 4.30) -> ap0x] binary file"; flow:established,to_server; content: "|60E8000000008B2C2483C4|";content: "|8DB5210B00008D9DFF02000033FFE89F0100006A|"; distance: 11; within: 20;content: "|68|"; distance: 20; within: 1;content: "|68|"; distance: 3; within: 1;content: "|6A00FF95AA0A00008985F90A0000EB1460FFB5F90A0000FF3437FF743704FFD36183C7|"; distance: 3; within: 35;content: "|833C370075E683BD0D0B000000740E83BD110B0000007405E8F60100008D743704536A|"; distance: 35; within: 35;content: "|68|"; distance: 35; within: 1;content: "|68|"; distance: 3; within: 1;content: "|6A00FF95AA0A000089851D0B00005B60FFB5F90A000056FFB51D0B0000FFD3618BB51D0B00008BC6EB01|"; distance: 3; within: 42;sid: 20091049; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack 1.18 Dll (aPlib 0.43) -> ap0x] binary file"; flow:established,to_server; content: "|807C2408010F855C01000060E8000000008B2C2483C4|";content: "|8DB51A0400008D9DC102000033FFE861010000EB0FFF743704FF3437FFD383C4|"; distance: 22; within: 32;content: "|83C7|"; distance: 32; within: 2;content: "|833C370075EB83BD0604000000740E83BD0A040000007405E8D70100008D743704536A|"; distance: 2; within: 35;content: "|68|"; distance: 35; within: 1;content: "|68|"; distance: 3; within: 1;content: "|6A|"; distance: 3; within: 1;content: "|FF95A70300008985160400005BFFB51604000056FFD383C4|"; distance: 1; within: 24;content: "|8BB5160400008BC6EB01|"; distance: 24; within: 10;sid: 20091050; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack 1.18 Dll (LZMA 4.30) -> ap0x] binary file"; flow:established,to_server; content: "|807C2408010F85|";content: "|01000060E8000000008B2C2483C4048DB5|"; distance: 7; within: 17;content: "|8D9D|"; distance: 19; within: 2;content: "|33FFE89F0100006A|"; distance: 4; within: 8;content: "|68|"; distance: 8; within: 1;content: "|68|"; distance: 3; within: 1;content: "|6A|"; distance: 3; within: 1;content: "|FF95AA0A00008985F90A0000EB1460FFB5F90A0000FF3437FF743704FFD36183C708833C370075E683BD0D0B000000740E83BD110B0000007405E8F60100008D743704536A|"; distance: 1; within: 69;content: "|68|"; distance: 69; within: 1;content: "|68|"; distance: 3; within: 1;content: "|6A|"; distance: 3; within: 1;content: "|FF95AA0A000089851D0B00005B60FFB5F90A000056FFB51D0B0000FFD3618BB51D0B00008BC6EB01|"; distance: 1; within: 40;sid: 20091051; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack 1.20 Basic Edition [aPLib] -> Ap0x] binary file"; flow:established,to_server; content: "|60E8000000008B2C2483C404837C242801750C8B442424898592050000EB0C8B858E0500008985920500008DB5BA0500008D9D4104000033FFE838010000EB1B8B8592050000FF743704010424FF3437010424FFD383C40883C708833C370075DF83BD9E05000000740E83BDA2050000007405E8D6010000|";sid: 20091052; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack 1.20 Basic Edition [LZMA] -> Ap0x] binary file"; flow:established,to_server; content: "|60E8000000008B2C2483C404837C242801750C8B44242489859C0C0000EB0C8B85980C000089859C0C00008DB5C40C00008D9D8204000033FF6A4068001000006800200C006A00FF952D0C00008985940C0000E859010000EB20608B859C0C0000FFB5940C0000FF3437010424FF743704010424FFD36183|";sid: 20091053; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack Full Edition 1.17 -> Ap0x] binary file"; flow:established,to_server; content: "|60E8000000008B2C2483C404|";content: "|8DB5|"; distance: 19; within: 2;content: "|8D9D|"; distance: 4; within: 2;content: "|33FF|"; distance: 4; within: 2;sid: 20091054; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack Full Edition 1.17 DLL -> Ap0x] binary file"; flow:established,to_server; content: "|807C2408010F85|";content: "|60E8000000008B2C2483C4048DB5|"; distance: 9; within: 14;content: "|8D9D|"; distance: 16; within: 2;content: "|33FFE8|"; distance: 4; within: 3;sid: 20091055; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack Full Edition 1.17 DLL [aPLib] -> Ap0x] binary file"; flow:established,to_server; content: "|807C2408010F85|";content: "|60E8000000008B2C2483C4048DB5530300008D9D0202000033FFE8|"; distance: 9; within: 27;content: "|EB0FFF743704FF3437FFD383C40883C708833C370075|"; distance: 29; within: 22;sid: 20091056; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack Full Edition 1.17 DLL [LZMA] -> Ap0x] binary file"; flow:established,to_server; content: "|807C2408010F85|";content: "|60E8000000008B2C2483C4048DB55A0A00008D9D4002000033FFE8|"; distance: 9; within: 27;content: "|6A4068|"; distance: 29; within: 3;content: "|68|"; distance: 5; within: 1;content: "|6A00FF95EB0900008985|"; distance: 3; within: 10;sid: 20091057; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack Full Edition 1.17 iBox [aPLib] -> Ap0x] binary file"; flow:established,to_server; content: "|60E8000000008B2C2483C404|";content: "|8DB5792900008D9D2C03000033FF|"; distance: 19; within: 14;content: "|EB0FFF743704FF34|"; distance: 21; within: 8;sid: 20091058; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack Full Edition 1.17 iBox [LZMA] -> Ap0x] binary file"; flow:established,to_server; content: "|60E8000000008B2C2483C404|";content: "|8DB5673000008D9D6603000033FF|"; distance: 19; within: 14;content: "|6A4068|"; distance: 19; within: 3;content: "|68|"; distance: 5; within: 1;content: "|6A|"; distance: 3; within: 1;sid: 20091059; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack Full Edition 1.17 [aPLib] -> Ap0x] binary file"; flow:established,to_server; content: "|60E8000000008B2C2483C404|";content: "|8DB5741F00008D9D1E03000033FF|"; distance: 19; within: 14;content: "|EB0FFF743704FF34|"; distance: 21; within: 8;sid: 20091060; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack Full Edition 1.17 [LZMA] -> Ap0x] binary file"; flow:established,to_server; content: "|60E8000000008B2C2483C404|";content: "|8DB5732600008D9D5803000033FF|"; distance: 19; within: 14;content: "|6A4068|"; distance: 19; within: 3;content: "|68|"; distance: 5; within: 1;content: "|6A|"; distance: 3; within: 1;sid: 20091061; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack V1.0.beta -> ap0x] binary file"; flow:established,to_server; content: "|60E8000000008D6424048B6C24FC8DB54C0200008D9D1301000033FFEB0FFF743704FF3437FFD383C40883C708833C370075EB|";sid: 20091062; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack V1.11 -> ap0x] binary file"; flow:established,to_server; content: "|60E8000000008B2C2483C4048DB54A0200008D9D1101000033FFEB0FFF743704FF3437FFD383C40883C708833C370075EB|";sid: 20091063; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack V1.15-V1.17 (aPlib 0.43) -> ap0x] binary file"; flow:established,to_server; content: "|60E8000000008B2C2483C4048DB5|";content: "|8D9D|"; distance: 16; within: 2;content: "|33FFE845010000EB0FFF743704FF3437FFD383C40883C708833C370075EB|"; distance: 4; within: 30;sid: 20091064; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack V1.15-V1.17 (LZMA 4.30) -> ap0x] binary file"; flow:established,to_server; content: "|60E8000000008B2C2483C4048DB5|";content: "|8D9D|"; distance: 16; within: 2;content: "|33FFE8830100006A|"; distance: 4; within: 8;content: "|68|"; distance: 8; within: 1;content: "|68|"; distance: 3; within: 1;content: "|6A|"; distance: 3; within: 1;content: "|FF95|"; distance: 1; within: 2;content: "|8985|"; distance: 4; within: 2;content: "|EB14|"; distance: 4; within: 2;sid: 20091065; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack V1.15-V1.17 Dll -> ap0x] binary file"; flow:established,to_server; content: "|807C2408010F85|";content: "|01000060E8000000008B2C2483C4048DB5|"; distance: 7; within: 17;content: "|8D9D|"; distance: 19; within: 2;content: "|33FFE8|"; distance: 4; within: 3;sid: 20091066; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack v1.18 Basic DLL [aPLib] -> Ap0x] binary file"; flow:established,to_server; content: "|807C2408010F85|";content: "|60E8000000008B2C2483C4048DB51A0400008D9DC102000033FFE861010000EB0FFF743704FF3437FFD383C40883C708833C370075EB83BD0604000000740E83|"; distance: 9; within: 64;sid: 20091067; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack v1.18 Basic DLL [LZMA] -> Ap0x] binary file"; flow:established,to_server; content: "|807C2408010F85|";content: "|60E8000000008B2C2483C4048DB5210B00008D9DFF02000033FFE89F0100006A4068001000006800200C006A00FF95AA0A00008985F90A0000EB1460FFB5F90A|"; distance: 9; within: 64;sid: 20091068; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack v1.18 Basic [aPLib] -> Ap0x] binary file"; flow:established,to_server; content: "|60E8000000008B2C2483C4048DB51A0400008D9DC102000033FFE861010000EB0FFF743704FF3437FFD383C40883C708833C370075EB83BD0604000000740E83|";sid: 20091069; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack v1.18 Basic [LZMA] -> Ap0x] binary file"; flow:established,to_server; content: "|60E8000000008B2C2483C4048DB5210B00008D9DFF02000033FFE89F0100006A4068001000006800200C006A00FF95AA0A00008985F90A0000EB1460FFB5F90A|";sid: 20091070; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack V1.19 (aPlib 0.43) -> ap0x] binary file"; flow:established,to_server; content: "|60E8000000008B2C2483C404837C242801750C8B44242489853C040000EB0C8B853804000089853C0400008DB5600400008D9DEB02000033FFE852010000EB1B8B853C040000FF743704010424FF3437010424FFD383C40883C708833C370075DF83BD4804000000740E83BD4C040000007405E8B80100008D743704536A40680010000068|";content: "|6A00FF95D103000089855C0400005BFFB55C04000056FFD383C4088BB55C0400008BC6EB014080380175FA408B3803BD3C04000083C004898558040000E99400000056FF95C903000085C00F84B40000008985540400008BC6EB5B8B85580400008B00A90000008074143500000080508B8558040000C70020202000EB06FFB558040000FFB554040000FF95CD03000085C07471890783C7048B8558040000EB014080380075FA4089855804000066817802008074A580380075A0EB0146803E0075FA46408B3803BD3C04000083C004898558040000803E010F8563FFFFFF680040000068|"; distance: 135; within: 229;content: "|FFB55C040000FF95D5030000E83D000000E82401000061E9|"; distance: 231; within: 24;content: "|61C3|"; distance: 26; within: 2;sid: 20091071; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack V1.19 (LZMA 4.30) -> ap0x] binary file"; flow:established,to_server; content: "|60E8000000008B2C2483C404837C242801750C8B4424248985490B0000EB0C8B85450B00008985490B00008DB56D0B00008D9D2F03000033FF6A4068001000006800200C006A00FF95DA0A00008985410B0000E876010000EB20608B85490B0000FFB5410B0000FF3437010424FF743704010424FFD36183C708833C370075DA83BD550B000000740E83BD590B0000007405E8D70100008D743704536A40680010000068|";content: "|6A00FF95DA0A00008985690B00005B60FFB5410B000056FFB5690B0000FFD3618BB5690B00008BC6EB014080380175FA408B3803BD490B000083C0048985650B0000E99800000056FF95D20A00008985610B000085C00F84C80000008BC6EB5F8B85650B00008B00A90000008074143500000080508B85650B0000C70020202000EB06FFB5650B0000FFB5610B0000FF95D60A000085C00F8487000000890783C7048B85650B0000EB014080380075FA408985650B000066817802008074A1803800759CEB0146803E0075FA46408B3803BD490B000083C0048985650B0000803E010F855FFFFFFF680040000068|"; distance: 166; within: 238;content: "|FFB5690B0000FF95DE0A000068004000006800200C00FFB5410B0000FF95DE0A0000E83D000000E82401000061E9|"; distance: 240; within: 46;content: "|61C3|"; distance: 48; within: 2;sid: 20091072; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack V1.19 Dll (aPlib 0.43) -> ap0x] binary file"; flow:established,to_server; content: "|807C2408010F858901000060E8000000008B2C2483C404837C242801750C8B44242489853C040000EB0C8B853804000089853C0400008DB5600400008D9DEB02000033FFE852010000EB1B8B853C040000FF743704010424FF3437010424FFD383C40883C708833C370075DF83BD4804000000740E83BD4C040000007405E8B80100008D743704536A40680010000068|";content: "|6A00FF95D103000089855C0400005BFFB55C04000056FFD383C4088BB55C0400008BC6EB014080380175FA408B3803BD3C04000083C004898558040000E99400000056FF95C903000085C00F84B40000008985540400008BC6EB5B8B85580400008B00A90000008074143500000080508B8558040000C70020202000EB06FFB558040000FFB554040000FF95CD03000085C07471890783C7048B8558040000EB014080380075FA4089855804000066817802008074A580380075A0EB0146803E0075FA46408B3803BD3C04000083C004898558040000803E010F8563FFFFFF680040000068|"; distance: 146; within: 229;content: "|FFB55C040000FF95D5030000E83D000000E82401000061E9|"; distance: 231; within: 24;content: "|61C3|"; distance: 26; within: 2;sid: 20091073; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RLPack V1.19 Dll (LZMA 4.30) -> ap0x] binary file"; flow:established,to_server; content: "|807C2408010F85C701000060E8000000008B2C2483C404837C242801750C8B4424248985490B0000EB0C8B85450B00008985490B00008DB56D0B00008D9D2F03000033FF6A4068001000006800200C006A00FF95DA0A00008985410B0000E876010000EB20608B85490B0000FFB5410B0000FF3437010424FF743704010424FFD36183C708833C370075DA83BD550B000000740E83BD590B0000007405E8D70100008D743704536A40680010000068|";content: "|6A00FF95DA0A00008985690B00005B60FFB5410B000056FFB5690B0000FFD3618BB5690B00008BC6EB014080380175FA408B3803BD490B000083C0048985650B0000E99800000056FF95D20A00008985610B000085C00F84C80000008BC6EB5F8B85650B00008B00A90000008074143500000080508B85650B0000C70020202000EB06FFB5650B0000FFB5610B0000FF95D60A000085C00F8487000000890783C7048B85650B0000EB014080380075FA408985650B000066817802008074A1803800759CEB0146803E0075FA46408B3803BD490B000083C0048985650B0000803E010F855FFFFFFF680040000068|"; distance: 177; within: 238;content: "|FFB5690B0000FF95DE0A000068004000006800200C00FFB5410B0000FF95DE0A0000E83D000000E82401000061E9|"; distance: 240; within: 46;content: "|61C3|"; distance: 48; within: 2;sid: 20091074; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ROD High TECH -> Ayman] binary file"; flow:established,to_server; content: "|608B151D134000F7E08D8283190000E8580C0000|";sid: 20091075; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[RPolyCrypt v 1.0 (personal polycryptor) sign from pinch] binary file"; flow:established,to_server; content: "|5058979760618B04248078F36AE80000000058E800000000589191EB000F856BF4766FE80000000083C404E8000000005890E80000000083C4048B04248078F1|";sid: 20091076; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SafeGuard V1.0X -> simonzh2000] binary file"; flow:established,to_server; content: "|E800000000EB29|";content: "|599C81C1E2FFFFFFEB01|"; distance: 20; within: 10;content: "|9DFFE1|"; distance: 10; within: 3;sid: 20091077; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Sc Obfuscator -> SuperCRacker] binary file"; flow:established,to_server; content: "|6033C98B1D|";content: "|031D|"; distance: 7; within: 2;content: "|8A041984C074093C|"; distance: 4; within: 8;content: "|740534|"; distance: 8; within: 3;content: "|880419413B0D|"; distance: 3; within: 6;content: "|75E7A1|"; distance: 8; within: 3;content: "|0105|"; distance: 5; within: 2;content: "|61FF25|"; distance: 4; within: 3;content: "|0000|"; distance: 5; within: 2;sid: 20091078; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SDC 1.2 (Self Decrypting Binary Generator) - by Claes M Nyberg] binary file"; flow:established,to_server; content: "|5589E583EC08C7042401000000FF15A0914000E8DBFEFFFF5589E55383EC148B45088B008B003D910000C0773B3D8D0000C0724BBB01000000C744240400000000C7042408000000E8CE24000083F8010F84C400000085C00F85A900000031C083C4145B5DC204003D940000C074563D960000C0741E3D930000C075E1EBB53D050000C08DB4260000000074433D1D0000C075CAC744240400000000C7042404000000E87324000083F8010F849900000085C074A9C7042404000000FFD0B8FFFFFFFFEB9B31DB8D742600E969FFFFFFC744240400000000C704240B000000E83724000083F801747F85C00F846DFFFFFFC704240B0000008D7600FFD0B8FFFFFFFFE959FFFFFFC7042408000000FFD0B8FFFFFFFFE946FFFFFFC744240401000000C7042408000000E8ED230000B8FFFFFFFF85DB0F8425FFFFFFE8DB150000B8FFFFFFFFE916FFFFFFC744240401000000C7042404000000E8BD230000B8FFFFFFFFE9F8FEFFFFC744240401000000C704240B000000E89F230000B8FFFFFFFFE9DAFEFFFF|";sid: 20091079; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SDProtect -> Randy Li] binary file"; flow:established,to_server; content: "|558BEC6AFF68|";content: "|688888880864A10000000050648925000000005864A300000000585858588BE8E83B000000E801000000FF5805|"; distance: 8; within: 45;sid: 20091080; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SDProtector 1.x -> Randy Li] binary file"; flow:established,to_server; content: "|558BEC6AFF681D321305688888880864A10000000050648925000000005864A300000000585858588BE8E83B000000E801000000FF580553000000518B4C24108981B8000000B85501000089412033C08941048941|";sid: 20091081; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SDProtector Basic/Pro Edition 1.10 -> Randy Li] binary file"; flow:established,to_server; content: "|558BEC6AFF681D321305688888880864A10000000050648925000000005864A300000000585858588BE85083EC0864A10000000064FF35000000006489250000000083C4085064FF35000000006489250000000064|";sid: 20091082; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SDProtector Basic/Pro Edition 1.12 -> Randy Li] binary file"; flow:established,to_server; content: "|558BEC6AFF681D321305688888880864A10000000050648925000000005864A300000000585858588BE8E83B000000E801000000FF580553000000518B4C24108981B8000000B85501000089412033C089410489410889410C89411059C3C3C3C3C3C3C3C3C3C3C3C3C333C064FF306489209C804C2401019D9090C3C3C3C3C3C3C3C3C3C3C3C3648F005874077505193267E8E874277525EB00EBFC683944CD00599C50740F750DE859C20400558BECE9FAFFFF0EE8EFFFFFFF56575378037901E868A2AF470159E801000000FF58057B03000003C874C475C2E80000000000000000000000000000000000000000000000000000000000000000000000000000000000E2|";sid: 20091083; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SDProtector Pro Edition 1.16 -> Randy Li] binary file"; flow:established,to_server; content: "|558BEC6AFF681D321305688888880864A10000000050648925000000005864A300000000585858588BE8E83B000000E801000000FF580553000000518B4C24108981B8000000B85501000089411833C08941048941|";sid: 20091084; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SDProtector Pro Edition 1.16 -> Randy Li] binary file"; flow:established,to_server; content: "|558BEC6AFF681D321305688888880864A10000000050648925000000005864A300000000585858588BE8E83B000000E801000000FF580553000000518B4C24108981B8000000B85501000089411833C089410489410889410C89411059C3C3C3C3C3C3C3C3C3C3C3C3C333C064FF306489209C804C2401019D9090C3C3C3C3C3C3C3C3C3C3C3C3648F005874077505193267E8E874277525EB00EBFC683944CD00599C50740F750DE859C20400558BECE9FAFFFF0EE8EFFFFFFF56575378037901E868A2AF470159E801000000FF58059303000003C874C475C2E8|";sid: 20091085; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SDProtector V1.1x -> Randy Li] binary file"; flow:established,to_server; content: "|558BEC6AFF68|";content: "|688888880864A1|"; distance: 8; within: 7;sid: 20091086; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SEA-AXE] binary file"; flow:established,to_server; content: "|FCBC|";content: "|0E1FE8|"; distance: 3; within: 3;content: "|26A1|"; distance: 4; within: 2;content: "|8B1E|"; distance: 3; within: 2;content: "|2BC38EC0B1|"; distance: 3; within: 5;content: "|D3E3|"; distance: 5; within: 2;sid: 20091087; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SEA-AXE v2.2] binary file"; flow:established,to_server; content: "|FCBC|";content: "|0E1FA3|"; distance: 3; within: 3;content: "|E8|"; distance: 4; within: 1;content: "|A1|"; distance: 2; within: 1;content: "|8B|"; distance: 2; within: 1;content: "|2BC38EC0B103D3E38BCBBF|"; distance: 2; within: 11;content: "|8BF7F3A5|"; distance: 12; within: 4;sid: 20091088; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SecuPack v1.5] binary file"; flow:established,to_server; content: "|558BEC83C4F053565733C08945F0B8CC3A40|";content: "|E8E0FCFFFF33C05568EA3C40|"; distance: 18; within: 12;content: "|64FF306489206A|"; distance: 12; within: 7;content: "|6880|"; distance: 7; within: 2;content: "|6A036A|"; distance: 3; within: 3;content: "|6A01|"; distance: 3; within: 2;content: "|80|"; distance: 3; within: 1;sid: 20091089; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SecureEXE 3.0 -> ZipWorx] binary file"; flow:established,to_server; content: "|E9B8000000|";content: "|00|"; distance: 6; within: 1;content: "|00|"; distance: 2; within: 1;content: "|000000000000|"; distance: 2; within: 6;sid: 20091090; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SecurePE 1.X -> www.deepzone.org] binary file"; flow:established,to_server; content: "|8B0424E8000000005D81ED4C2F40008985612F40008D9D652F400053C3000000008DB5BA2F40008BFEBB652F4000B9C6010000AD2BC3C1C00333C3AB4381FB8E2F40007505BB652F4000E2E789AD1A31400089AD5534400089AD683440008D85BA2F400050C3|";sid: 20091091; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Securom7 -> Sony DADC] binary file"; flow:established,to_server; content: "|B8|";content: "|8B|"; distance: 3; within: 1;content: "|0A|"; distance: 3; within: 1;content: "|E8|"; distance: 4; within: 1;sid: 20091092; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SEN Debug Protector???] binary file"; flow:established,to_server; content: "|BB|";content: "|00|"; distance: 3; within: 1;content: "|29|"; distance: 3; within: 1;content: "|4EE8|"; distance: 2; within: 2;sid: 20091093; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Sentinel SuperPro (Automatic Protection) v6.4.0 -> Safenet] binary file"; flow:established,to_server; content: "|68|";content: "|6A016A00FF15|"; distance: 3; within: 6;content: "|A3|"; distance: 8; within: 1;content: "|FF15|"; distance: 3; within: 2;content: "|33C93DB7000000A1|"; distance: 4; within: 8;content: "|0F94C185C0890D|"; distance: 10; within: 7;content: "|0F85|"; distance: 9; within: 2;content: "|5556C705|"; distance: 4; within: 4;content: "|01000000FF15|"; distance: 6; within: 6;content: "|0105|"; distance: 8; within: 2;content: "|FF15|"; distance: 4; within: 2;sid: 20091094; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Sentinel SuperPro (Automatic Protection) v6.4.1 -> Safenet] binary file"; flow:established,to_server; content: "|A1|";content: "|558B|"; distance: 3; within: 2;content: "|85C074|"; distance: 3; within: 3;content: "|85ED75|"; distance: 3; within: 3;content: "|A1|"; distance: 3; within: 1;content: "|5055FF15|"; distance: 3; within: 4;content: "|8B0D|"; distance: 6; within: 2;content: "|5551FF15|"; distance: 4; within: 4;content: "|85C074|"; distance: 6; within: 3;content: "|8B15|"; distance: 3; within: 2;content: "|52FF15|"; distance: 4; within: 3;content: "|6A006A0068|"; distance: 5; within: 5;content: "|E8|"; distance: 7; within: 1;content: "|B8010000005DC20C00|"; distance: 3; within: 9;sid: 20091095; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Sexe Crypter 1.1 - by santasdad] binary file"; flow:established,to_server; content: "|558BEC83C4EC53565733C08945ECB8D8390010E830FAFFFF33C05568D43A001064FF306489|";content: "|E43A0010A10057001050E8CCFAFFFF8BD853A10057001050E8FEFAFFFF8BF853A10057001050E8C8FAFFFF8BD853E8C8FAFFFF8BF085F674268BD74AB814570010E8ADF6FFFFB814570010E89BF6FFFF8BCF8BD6E8DAFAFFFF53E884FAFFFF8D4DECBAF83A0010A114570010E80AFBFFFF8B55ECB814570010E865F5FFFFB814570010E863F6FFFFE852FCFFFF33C05A595964891068DB3A00108D45ECE8EDF4FFFFC3E983EFFFFFEBF05F5E5BE8EDF3FFFF0053455454494E475300000000FFFFFFFF120000006B7574683736676262673637347638386779|"; distance: 39; within: 217;sid: 20091096; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Shegerd Dongle V4.78 -> MS.Co.] binary file"; flow:established,to_server; content: "|E832000000B8|";content: "|8B18C1CB0589DA368B4C240C|"; distance: 8; within: 12;sid: 20091097; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ShellModify 0.1 -> pll621] binary file"; flow:established,to_server; content: "|558BEC6AFF6898664100683C3D410064A100000000|";sid: 20091098; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Shrink v1.0] binary file"; flow:established,to_server; content: "|509CFCBE|";content: "|BF|"; distance: 5; within: 1;content: "|57B9|"; distance: 2; within: 2;content: "|F3A48B|"; distance: 3; within: 3;content: "|BE|"; distance: 4; within: 1;content: "|BF|"; distance: 2; within: 1;content: "|F3A4C3|"; distance: 2; within: 3;sid: 20091099; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Shrink v2.0] binary file"; flow:established,to_server; content: "|E9|";content: "|509CFCBE|"; distance: 2; within: 4;content: "|8BFE8CC805|"; distance: 5; within: 5;content: "|8EC00657B9|"; distance: 6; within: 5;sid: 20091100; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Shrink Wrap v1.4] binary file"; flow:established,to_server; content: "|58608BE85533F6684801|";content: "|E84901|"; distance: 11; within: 3;content: "|EB|"; distance: 4; within: 1;sid: 20091101; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Shrinker v3.2] binary file"; flow:established,to_server; content: "|833D|";content: "|558BEC56577565680001|"; distance: 4; within: 10;content: "|E8|"; distance: 11; within: 1;content: "|E6FFFF83C4048B7508A3|"; distance: 1; within: 10;content: "|85F6741D68FF|"; distance: 12; within: 6;sid: 20091102; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Shrinker v3.3] binary file"; flow:established,to_server; content: "|833D|";content: "|0000558BEC565775656800010000E8|"; distance: 3; within: 15;sid: 20091103; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Shrinker v3.4] binary file"; flow:established,to_server; content: "|833DB4|";content: "|558BEC5657756B6800010000E8|"; distance: 5; within: 13;content: "|0B000083C4048B7508A3B4|"; distance: 13; within: 11;content: "|85F67423837D0C03771D68FF|"; distance: 12; within: 12;sid: 20091104; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Shrinker v3.4] binary file"; flow:established,to_server; content: "|BB|";content: "|BA|"; distance: 2; within: 1;content: "|81C30700B840B4B104D3E803C38CD9498EC126030E03002B|"; distance: 2; within: 24;sid: 20091105; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SimbiOZ -> Extranger] binary file"; flow:established,to_server; content: "|5060E8000000005D81ED0710400068800B00008D851F10400050E8840B0000|";sid: 20091106; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SimbiOZ 1.3 -> Extranger] binary file"; flow:established,to_server; content: "|57578D7C240450B800|";content: "|AB585FC3|"; distance: 10; within: 4;sid: 20091107; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SimbiOZ Poly 2.1 -> Extranger] binary file"; flow:established,to_server; content: "|55508BC483C004C700|";content: "|58C390|"; distance: 11; within: 3;sid: 20091108; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SimbiOZ PolyCryptor v.xx-> Extranger] binary file"; flow:established,to_server; content: "|5560E8000000005D81ED|";content: "|8D85|"; distance: 12; within: 2;content: "|68|"; distance: 4; within: 1;content: "|50E8|"; distance: 3; within: 2;sid: 20091109; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Simple UPX Cryptor V30.4.2005 -> MANtiCORE] binary file"; flow:established,to_server; content: "|60B8|";content: "|B9|"; distance: 4; within: 1;content: "|E2FA6168|"; distance: 5; within: 4;content: "|C3|"; distance: 6; within: 1;sid: 20091110; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Simple UPX Cryptor v30.4.2005 [multi layer encryption] --> MANtiCORE] binary file"; flow:established,to_server; content: "|60B8|";content: "|00B918000000803408|"; distance: 3; within: 9;content: "|E2FA6168|"; distance: 9; within: 4;content: "|00C3|"; distance: 5; within: 2;sid: 20091111; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Simple UPX Cryptor v30.4.2005 [multi layer encryption] --> MANtiCORE] binary file"; flow:established,to_server; content: "|60B8|";content: "|B918000000803408|"; distance: 4; within: 8;content: "|E2FA6168|"; distance: 8; within: 4;content: "|C3|"; distance: 6; within: 1;sid: 20091112; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Simple UPX Cryptor v30.4.2005 [One layer encryption] --> MANtiCORE] binary file"; flow:established,to_server; content: "|60B8|";content: "|00B9|"; distance: 3; within: 2;content: "|010000803408|"; distance: 2; within: 6;content: "|E2FA6168|"; distance: 6; within: 4;content: "|00C3|"; distance: 5; within: 2;sid: 20091113; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SimplePack 1.0X -> bagie] binary file"; flow:established,to_server; content: "|60E8000000005B8D5BFA6A00FF93|";content: "|000089C58B7D3C8D743D008DBEF80000008B868800000009C0|"; distance: 15; within: 25;sid: 20091114; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SimplePack 1.11 Method 1 -> bagie[TMX]] binary file"; flow:established,to_server; content: "|60E8000000005B8D5BFABD0000|";content: "|8B7D3C8D743D008DBEF80000000FB776064E8B471009C074550FB7472209C0744D6A046800100000FF77106A00FF933803000050565789EE03770C8B4F1089C789C8C1E902FC|"; distance: 14; within: 70;sid: 20091115; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SimplePack 1.11 Method 1 -> bagie[TMX]] binary file"; flow:established,to_server; content: "|60E8000000005B8D5BFABD0000|";content: "|8B7D3C8D743D008DBEF80000000FB776064E8B471009C074550FB7472209C0744D6A046800100000FF77106A00FF933803000050565789EE03770C8B4F1089C789C8C1E902FCF3A589C183E103F3A45F5E8B042489EA03570CE83F010000586800400000FF771050FF933C03000083C7284E759EBE|"; distance: 14; within: 117;content: "|09F60F840C01000001EE8B4E0C09C90F84FF00000001E989CF57FF933003000009C0753D6A04680010000068001000006A00FF933803000089C68D836F020000575056FF93440300006A106A00566A00FF934803000089E5|"; distance: 119; within: 88;sid: 20091116; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SimplePack 1.11 Method 2(NT) -> bagie[TMX]] binary file"; flow:established,to_server; content: "|4D5A90EB010052E989010000504500004C010200000000000000000000000000E0000F030B01|";sid: 20091117; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SimplePack V1.1X-V1.2X (Method1) -> bagie] binary file"; flow:established,to_server; content: "|60E8000000005B8D5BFABD|";content: "|8B7D3C8D743D008DBEF80000000FB776064E8B471009C0|"; distance: 13; within: 23;sid: 20091118; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SkD Undetectabler 3 (No FSG 2 Method) -> SkD] binary file"; flow:established,to_server; content: "|558BEC81EC1002000068000200008D85F8FDFFFF506A00FF153810000150FF153C1000018D8DF8FDFFFF51E84FFBFFFF83C4048B15|";content: "|16000152A1|"; distance: 53; within: 5;content: "|16000150E850FFFFFF83C408A3|"; distance: 5; within: 13;content: "|160001C785F4FDFFFF00000000EB0F8B8DF4FDFFFF83C101898DF4FDFFFF8B95F4FDFFFF3B15|"; distance: 13; within: 38;content: "|160001731C8B85F4FDFFFF8B0D|"; distance: 38; within: 13;content: "|1600018D54010781FA741000017502EB02EBC78B85F4FDFFFF50E8|"; distance: 13; within: 27;content: "|00000083C4048985F0FDFFFF8B8DF0FDFFFF894DFCC745F800000000EB098B55F883C2018955F88B45F83B85F4FDFFFF73158B4DFC034DF88B15|"; distance: 27; within: 58;content: "|1600010355F88A028801EBD7833D|"; distance: 58; within: 14;content: "|1600010074|"; distance: 14; within: 5;sid: 20091119; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SkD Undetectabler Pro 2.0 (No UPX Method) -> SkD] binary file"; flow:established,to_server; content: "|558BEC83C4F0B8FC260010E8ECF3FFFF6A0FE815F5FFFFE864FDFFFFE8BBEDFFFF8D40|";sid: 20091120; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SLVc0deProtector 1.1x -> SLV / ICU] binary file"; flow:established,to_server; content: "|E80000000058C600EBC6400108FFE0E94C|";content: "|00|"; distance: 18; within: 1;sid: 20091121; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SLVc0deProtector v0.6 -> SLV] binary file"; flow:established,to_server; content: "|E84900000069E84900000095E84F00000068E81F00000049E8E9FFFFFF67E81F00000093E83100000078E8DDFFFFFF38E8E3FFFFFF66E80D00000004E8E3FFFFFF70E8CBFFFFFF69E8DDFFFFFF58E8DDFFFFFF69E8E3FFFFFF79E8BFFFFFFF6983C440E8000000005D81ED971140008DB5EF114000B9FE2D00008BFEACF8|";content: "|90|"; distance: 129; within: 1;sid: 20091122; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SLVc0deProtector v0.61 -> SLV] binary file"; flow:established,to_server; content: "|EB02FA04E84900000069E84900000095E84F00000068E81F00000049E8E9FFFFFF67E81F00|";sid: 20091123; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SLVc0deProtector v0.61 -> SLV] binary file"; flow:established,to_server; content: "|EB02FA04E84900000069E84900000095E84F00000068E81F00000049E8E9FFFFFF67E81F00000093E83100000078E8DDFFFFFF38E8E3FFFFFF66E80D00000004E8E3FFFFFF70E8CBFFFFFF69E8DDFFFFFF58E8DDFFFFFF69E8E3FFFFFF79E8BFFFFFFF6983C440E8000000005D81ED9D1140008D95B4114000E8CB2E000033C0F7F0698DB505124000B95D2E00008BFEAC|";sid: 20091124; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SLVc0deProtector v1.1 -> SLV] binary file"; flow:established,to_server; content: "|E80000000058C600EBC6400108FFE0E94C|";sid: 20091125; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SmartE -> Microsoft] binary file"; flow:established,to_server; content: "|EB1503000000|";content: "|0000000000000000000000680000000055E8000000005D81ED1D0000008BC555609C2B858F070000898583070000FF74242CE8BB0100000F822F060000E88E040000490F882306|"; distance: 6; within: 71;sid: 20091126; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SmokesCrypt v1.2] binary file"; flow:established,to_server; content: "|60B8|";content: "|B8|"; distance: 4; within: 1;content: "|8A140880F2|"; distance: 3; within: 5;content: "|8814084183F9|"; distance: 5; within: 6;content: "|75F1|"; distance: 6; within: 2;sid: 20091127; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Soft Defender v1.0 - v1.1] binary file"; flow:established,to_server; content: "|74077505193267E8E8741F751DE8683944CD|";content: "|599C50740A7508E859C204|"; distance: 18; within: 11;content: "|558BECE8F4FFFFFF565753780F790DE8349947493433EF313452472368A2AF470159E8|"; distance: 11; within: 35;content: "|5805BA01|"; distance: 37; within: 4;content: "|03C874BE75BCE8|"; distance: 5; within: 7;sid: 20091128; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Soft Defender v1.1x -> Randy Li] binary file"; flow:established,to_server; content: "|74077505|";content: "|741F751D|"; distance: 6; within: 4;content: "|68|"; distance: 4; within: 1;content: "|00599C50740A7508|"; distance: 2; within: 8;content: "|59C20400|"; distance: 8; within: 4;content: "|E8F4FFFFFF|"; distance: 5; within: 5;content: "|780F790D|"; distance: 6; within: 4;sid: 20091129; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SoftDefender 1.x -> Randy Li] binary file"; flow:established,to_server; content: "|74077505193267E8E8741F751DE8683944CD00599C50740A7508E859C20400558BECE8F4FFFFFF565753780F790DE8349947493433EF313452472368A2AF470159E801000000FF5805E601000003C874BD75BBE800|";sid: 20091130; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SoftDefender V1.1x -> Randy Li] binary file"; flow:established,to_server; content: "|74077505193267E8E8741F751DE8683944|";sid: 20091131; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SoftProtect -> SoftProtect.by.ru] binary file"; flow:established,to_server; content: "|EB01E360E803|";content: "|D2EB0B58EB014840EB0135FFE0E76160E803|"; distance: 7; within: 18;content: "|83EB0EEB010C58EB013540EB0136FFE00B61EB01839CEB01D5EB08359DEB0189EB030BEBF7E8|"; distance: 19; within: 38;content: "|58E8|"; distance: 40; within: 2;content: "|5983010180395C|"; distance: 4; within: 7;sid: 20091132; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SoftProtect -> www.softprotect.by.ru] binary file"; flow:established,to_server; content: "|E8|";content: "|8D|"; distance: 3; within: 1;content: "|C70000000000E8|"; distance: 3; within: 7;content: "|E8|"; distance: 9; within: 1;content: "|8D|"; distance: 3; within: 1;content: "|50E8|"; distance: 3; within: 2;content: "|83|"; distance: 4; within: 1;content: "|01|"; distance: 3; within: 1;sid: 20091133; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SoftSentry v2.11] binary file"; flow:established,to_server; content: "|558BEC83EC|";content: "|535657E950|"; distance: 5; within: 5;sid: 20091134; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SoftSentry v3.0] binary file"; flow:established,to_server; content: "|558BEC83EC|";content: "|535657E9B006|"; distance: 5; within: 6;sid: 20091135; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Software Compress -> BG Software] binary file"; flow:established,to_server; content: "|E9BE000000608B7424248B7C2428FCB28033DBA4B302E86D00000073F633C9E864000000731C33C0E85B0000007323B30241B010E84F00000012C073F7753FAAEBD4E84D0000002BCB7510E842000000EB28ACD1E8|";sid: 20091136; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Software Compress V1.2 ->  BG Software Protect Technologies] binary file"; flow:established,to_server; content: "|E9BE000000608B7424248B7C2428FCB28033DBA4B302E86D0000|";sid: 20091137; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Software Compress v1.2 -> BG Software Protect Technologies] binary file"; flow:established,to_server; content: "|E9BE000000608B7424248B7C2428FCB28033DBA4B302E86D00000073F633C9E864000000731C33C0E85B0000007323B30241B010E84F00000012C073F7753FAAEBD4E84D0000002BCB7510E842000000EB28ACD1E8744D13C9EB1C9148C1E008ACE82C0000003D007D0000730A80FC05730683F87F77024141958BC5B301568BF72BF0F3A45EEB8E02D275058A164612D2C333C941E8EEFFFFFF13C9E8E7FFFFFF72F2C32B7C2428897C241C61C360FF7424246A40FF951A0F41008944241C61C20400E800000000812C243A1041005DE800000000812C24310100008B852A0F4100290424|";sid: 20091138; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Software Compress v1.4 LITE -> BG Software Protect Technologies] binary file"; flow:established,to_server; content: "|E800000000812C24AA1A41005DE800000000832C246E8B855D1A41002904248B042489855D1A4100588B855D1A41008B503C03D08B928000000003D08B4A58898D491A41008B4A5C898D4D1A41008B4A60898D551A|";sid: 20091139; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Software Compress v1.4 LITE -> BG Software Protect Technologies] binary file"; flow:established,to_server; content: "|E800000000812C24AA1A41005DE800000000832C246E8B855D1A41002904248B042489855D1A4100588B855D1A41008B503C03D08B928000000003D08B4A58898D491A41008B4A5C898D4D1A41008B4A60898D551A41008B4A64898D511A41008B4A74898D591A41006800200000E8D2000000508D8D001C41005051E81B00000083C408588D78748DB5491A4100B918000000F3A405A400000050C3608B7424248B7C2428FCB28033DBA4B302E86D00000073F633C9E864000000731C33C0E85B0000007323B30241B010E84F00000012C073F7753FAAEBD4E84D0000002BCB7510E842000000EB28ACD1E8744D13C9EB1C9148C1E008ACE82C0000003D007D0000730A80FC05730683F87F77024141958BC5B301568BF72BF0F3A45EEB8E02D275058A164612D2C333C941E8EEFFFFFF13C9E8E7FFFFFF72F2C32B7C2428897C241C61C360FF7424246A40FF954D1A41008944241C61C204|";sid: 20091140; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SoftWrap] binary file"; flow:established,to_server; content: "|525351565755E8|";content: "|5D81ED36|"; distance: 9; within: 4;content: "|E8|"; distance: 5; within: 1;content: "|01|"; distance: 1; within: 1;content: "|60BA|"; distance: 2; within: 2;content: "|E8|"; distance: 4; within: 1;content: "|5F|"; distance: 3; within: 1;sid: 20091141; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SOFTWrapper for Win9x/NT (Evaluation Version)] binary file"; flow:established,to_server; content: "|E8000000005D8BC52D|";content: "|005081ED050000008BC52B85030F00008985030F00008BF003B50B0F00008BF803BD070F0000837F0C00742B56578B7F1003F88B761003F0833F00740C8B1E891F83C60483C704EBEF|"; distance: 10; within: 73;sid: 20091142; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SPEC b2] binary file"; flow:established,to_server; content: "|55575153E8|";content: "|5D8BC581ED|"; distance: 7; within: 5;content: "|2B85|"; distance: 7; within: 2;content: "|83E8098985|"; distance: 4; within: 5;content: "|0FB6|"; distance: 7; within: 2;sid: 20091143; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SPEC b3] binary file"; flow:established,to_server; content: "|5B535045435DE8|";content: "|5D8BC581ED412440|"; distance: 9; within: 8;content: "|2B85892640|"; distance: 8; within: 5;content: "|83E80B89858D2640|"; distance: 5; within: 8;content: "|0FB6B5912640|"; distance: 8; within: 6;content: "|8BFD|"; distance: 6; within: 2;sid: 20091144; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Special EXE Password Protector v1.0] binary file"; flow:established,to_server; content: "|60E8000000005D81ED0600000089AD8C0100008BC52B85FE75000089853E77|";sid: 20091145; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Special EXE Pasword Protector V1.01 (Eng) -> Pavol Cerven] binary file"; flow:established,to_server; content: "|60E8000000005D81ED0600000089AD8C0100008BC52B85FE75000089853E|";sid: 20091146; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Special EXE Pasword Protector v1.01 (Eng) -> Pavol Cerven] binary file"; flow:established,to_server; content: "|60E8000000005D81ED0600000089AD8C0100008BC52B85FE75000089853E7700008D95C67700008D8DFF77000055680020000051526A00FF95047A00005D6A00FF95FC7900008D8D607800008D9585010000556800|";sid: 20091147; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Splash Bitmap v1.00 (With Unpack Code) --> BoB / Bobsoft] binary file"; flow:established,to_server; content: "|E800000000608B6C24205581ED|";content: "|8DBD|"; distance: 15; within: 2;content: "|8D8D|"; distance: 4; within: 2;content: "|29F931C0FCF3AA8B042448662500F06681384D5A75F48B483C813C015045000075E88985|"; distance: 4; within: 36;content: "|6A40|"; distance: 38; within: 2;sid: 20091148; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Splash Bitmap v1.00 --> BoB / Bobsoft] binary file"; flow:established,to_server; content: "|E800000000608B6C24205581ED|";content: "|8DBD|"; distance: 15; within: 2;content: "|8D8D|"; distance: 4; within: 2;content: "|29F931C0FCF3AA8B042448662500F06681384D5A75F48B483C813C015045000075E88985|"; distance: 4; within: 36;content: "|8DBD|"; distance: 38; within: 2;content: "|6A00|"; distance: 4; within: 2;sid: 20091149; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Splasher v1.0 - v3.0] binary file"; flow:established,to_server; content: "|9C608B442424E8|";content: "|5D81ED|"; distance: 9; within: 3;content: "|50E8ED02|"; distance: 5; within: 4;content: "|8CC00F84|"; distance: 5; within: 4;sid: 20091150; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Splice 1.1 - by Tw1sted L0gic] binary file"; flow:established,to_server; content: "|68001A4000E8EEFFFFFF000000000000300000004000000000000000|";content: "|00000000000001000000|"; distance: 36; within: 10;content: "|50726F6A6563743100|"; distance: 13; within: 9;content: "|0000000006000000AC29400007000000BC2840000700000074284000070000002C2840000700000008234000010000003821400000000000FFFFFFFFFFFFFFFF000000008C21400008|"; distance: 12; within: 73;content: "|400001000000AC194000000000000000000000000000AC1940004F00430050000000E7AF582F9A4C174DB7A9CA3E576FF776|"; distance: 73; within: 50;sid: 20091151; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[StarForce 3.0 -> StarForce Technology] binary file"; flow:established,to_server; content: "|68|";content: "|FF25|"; distance: 3; within: 2;content: "|63|"; distance: 3; within: 1;sid: 20091152; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[StarForce ProActive 1.1 -> StarForce Technology] binary file"; flow:established,to_server; content: "|68|";content: "|FF25|"; distance: 3; within: 2;content: "|57|"; distance: 3; within: 1;sid: 20091153; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[StarForce Protection Driver -> Protection Technology] binary file"; flow:established,to_server; content: "|5768|";content: "|0D01006800|"; distance: 2; within: 5;content: "|00E850|"; distance: 6; within: 3;content: "|FFFF68|"; distance: 3; within: 3;content: "|0068|"; distance: 4; within: 2;content: "|0068|"; distance: 3; within: 2;content: "|0068|"; distance: 3; within: 2;content: "|0068|"; distance: 3; within: 2;content: "|00|"; distance: 3; within: 1;sid: 20091154; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[StarForce V1.X-V3.X -> StarForce Copy Protection System] binary file"; flow:established,to_server; content: "|68|";content: "|FF25|"; distance: 3; within: 2;content: "|0000000000|"; distance: 4; within: 5;sid: 20091155; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[StarForce V3.X DLL -> StarForce Copy Protection System] binary file"; flow:established,to_server; content: "|E8|";content: "|000000000000|"; distance: 3; within: 6;sid: 20091156; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Ste at lth PE 1.01 -> BGCorp] binary file"; flow:established,to_server; content: "|BA|";content: "|00|"; distance: 2; within: 1;sid: 20091157; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Stealth PE v1.1] binary file"; flow:established,to_server; content: "|BA|";content: "|00FFE2BA|"; distance: 2; within: 4;content: "|00B8|"; distance: 5; within: 2;content: "|890283C203B8|"; distance: 4; within: 6;content: "|890283C2FDFFE2|"; distance: 8; within: 7;sid: 20091158; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[STNPEE 1.13] binary file"; flow:established,to_server; content: "|555756525153E8000000005D8BD581ED973B4000|";sid: 20091159; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Stone's PE Encryptor v1.0] binary file"; flow:established,to_server; content: "|555756525153E8|";content: "|5D8BD581ED633A40|"; distance: 9; within: 8;content: "|2B95C23A40|"; distance: 8; within: 5;content: "|83EA0B8995CB3A40|"; distance: 5; within: 8;content: "|8DB5CA3A40|"; distance: 8; within: 5;content: "|0FB636|"; distance: 5; within: 3;sid: 20091160; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Stone's PE Encryptor v1.13] binary file"; flow:established,to_server; content: "|555756525153E8|";content: "|5D8BD581ED973B40|"; distance: 9; within: 8;content: "|2B952D3C40|"; distance: 8; within: 5;content: "|83EA0B8995363C40|"; distance: 5; within: 8;content: "|0195243C40|"; distance: 8; within: 5;content: "|019528|"; distance: 5; within: 3;sid: 20091161; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Stone's PE Encryptor v2.0] binary file"; flow:established,to_server; content: "|535152565755E8|";content: "|5D81ED423040|"; distance: 9; within: 6;content: "|FF95323540|"; distance: 6; within: 5;content: "|B8373040|"; distance: 5; within: 4;content: "|03C52B851B3440|"; distance: 4; within: 7;content: "|8985273440|"; distance: 7; within: 5;content: "|83|"; distance: 5; within: 1;sid: 20091162; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Stone`s PE Encruptor v1.13] binary file"; flow:established,to_server; content: "|555756525153E8|";content: "|5D8BD581|"; distance: 9; within: 4;sid: 20091163; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[STUD RC4 1.0 Jamie Edition (ScanTime UnDetectable) - by MarjinZ] binary file"; flow:established,to_server; content: "|682C114000E8F0FFFFFF00000000000030000000380000000000000037BB71ECA4E1984C9BFE8F0FFA6A07F6000000000000010000002020466F7220737475640020546F0000000006000000CC1A400007000000D4184000070000007C184000070000002C18400007000000E017400056423521F01F2A000000000000000000000000007E000000000000000000000000000A000904000000000000E8134000F413400000F0300000FFFFFF080000000100000000000000E90000000411400004114000C8104000780000007C00000081000000820000000000000000000000000000000000000061616100537475640000737475640000010001003016400000000000FFFFFFFFFFFFFFFF00000000B41640001030400007000000241240000E002000000000001C9E2100EC1140005C104000E41A40002C3440006817400058174000781740008C1740008C1040006210400092104000F81A400024194000981040009E104000770418FF041CFF0500002401000D1400781C400048214000|";sid: 20091164; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SuckStop v1.11] binary file"; flow:established,to_server; content: "|EB|";content: "|BE|"; distance: 2; within: 1;content: "|B430CD21EB|"; distance: 2; within: 5;content: "|9B|"; distance: 5; within: 1;sid: 20091165; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SuperDAT] binary file"; flow:established,to_server; content: "|558BEC6AFF6840F3420068A4BF420064A100000000506489250000000083EC585356578965E8FF1508F2420033D28AD48915604243008BC881E1FF000000890D|";sid: 20091166; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SVK Protector v1.32 (Eng) -> Pavol Cerven] binary file"; flow:established,to_server; content: "|60E8000000005D81ED06000000EB05B80636420064A023000000EB03C784E884C0EB03C784E97567B9490000008DB5C50200005680064446E2FA8B8DC10200005E55516A0056FF950C610000595D4085C0753C803E|";sid: 20091167; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SVK Protector v1.3x (Eng) -> Pavol Cerven] binary file"; flow:established,to_server; content: "|60E8000000005D81ED06000000EB05B8|";content: "|420064A023000000EB03C784E884C0EB03C784E97567B9490000008DB5C50200005680064446E2FA8B8DC10200005E55516A0056FF950C610000595D4085C0753C803E|"; distance: 17; within: 67;sid: 20091168; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SVK Protector V1.3X -> Pavol Cerven] binary file"; flow:established,to_server; content: "|60E8000000005D81ED06000000EB05B8|";content: "|420064A023000000EB03C784E884C0EB03C784E97567B9490000008DB5C50200005680064446E2FA8B8DC10200005E55516A0056FF950C610000595D4085C0753C803E00740346EBF846E2E38BC58B4C24202B85BD0200008985B902000080BDB40200000175068B8D0C610000898DB50200008D850E0300008BDDFFE05568101000008D85B4000000508D85B4010000506A00FF95186100005D6AFFFF95106100004465627567676572206F7220746F6F6C20666F72206D6F6E69746F72696E672064657465637465642121210000000000000000000000000000000000000000000000000000000000000000|"; distance: 17; within: 237;sid: 20091169; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SVK-Protector v1.051] binary file"; flow:established,to_server; content: "|60EB03C784E8EB03C7849AE8000000005D81ED10000000EB03C784E964A023000000EB|";sid: 20091170; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SVK-Protector v1.11] binary file"; flow:established,to_server; content: "|60E8|";content: "|5D81ED06|"; distance: 4; within: 4;content: "|64A023|"; distance: 5; within: 3;sid: 20091171; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[SVK-Protector v1.32] binary file"; flow:established,to_server; content: "|60E8000000005D81ED06000000EB05B80636420064A023|";sid: 20091172; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[T-PACK v0.5c -m1] binary file"; flow:established,to_server; content: "|68|";content: "|FD60BE|"; distance: 2; within: 3;content: "|BF|"; distance: 4; within: 1;content: "|B9|"; distance: 2; within: 1;content: "|F3A48BF7BF|"; distance: 2; within: 5;content: "|FC46E98EFE|"; distance: 6; within: 5;sid: 20091173; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[T-PACK v0.5c -m2] binary file"; flow:established,to_server; content: "|68|";content: "|FD60BE|"; distance: 2; within: 3;content: "|BF|"; distance: 4; within: 1;content: "|B9|"; distance: 2; within: 1;content: "|F3A48BF7BF|"; distance: 2; within: 5;content: "|FC46E9CEFD|"; distance: 6; within: 5;sid: 20091174; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[tElock 0.51 -> tE!] binary file"; flow:established,to_server; content: "|C1EE00668BC9EB01EB60EB01EB9CE8000000005E83C65E8BFE687901000059EB01EBAC54E8030000005CEB088D642404FF6424FC6A05D02C247201E80124245CF7DCEB02CD208D6424FEF7DCEB02CD20FEC8E80000000032C1EB02820DAAEB03820D58EB021D7A49EB05E8010000007FAE147EA077767574|";sid: 20091175; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[tElock 0.96 -> tE!] binary file"; flow:established,to_server; content: "|E959E4FFFF00000000000000|";content: "|EE|"; distance: 14; within: 1;content: "|0000000000000000000E|"; distance: 2; within: 10;content: "|00FE|"; distance: 11; within: 2;content: "|00F6|"; distance: 3; within: 2;content: "|0000000000000000001B|"; distance: 3; within: 10;content: "|0006|"; distance: 11; within: 2;content: "|00000000000000000000000000000000000000000026|"; distance: 3; within: 22;content: "|000000000039|"; distance: 23; within: 6;content: "|000000000026|"; distance: 7; within: 6;content: "|000000000039|"; distance: 7; within: 6;content: "|00000000006B65726E656C33322E646C6C|"; distance: 7; within: 17;sid: 20091176; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[tElock 0.98 -> tE!] binary file"; flow:established,to_server; content: "|E925E4FFFF000000|";content: "|1E|"; distance: 10; within: 1;content: "|0000000000000000003E|"; distance: 2; within: 10;content: "|002E|"; distance: 11; within: 2;content: "|0026|"; distance: 3; within: 2;content: "|0000000000000000004B|"; distance: 3; within: 10;content: "|0036|"; distance: 11; within: 2;content: "|00000000000000000000000000000000000000000056|"; distance: 3; within: 22;content: "|000000000069|"; distance: 23; within: 6;content: "|000000000056|"; distance: 7; within: 6;content: "|000000000069|"; distance: 7; within: 6;content: "|00000000006B65726E656C33322E646C6C00757365|"; distance: 7; within: 21;sid: 20091177; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[tElock 0.98 Special Build -> forgot & heXer] binary file"; flow:established,to_server; content: "|E999D7FFFF000000|";content: "|AA|"; distance: 10; within: 1;content: "|000000000000000000CA|"; distance: 2; within: 10;sid: 20091178; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[tElock 0.99 - 1.0 private -> tE!] binary file"; flow:established,to_server; content: "|E9|";content: "|FFFF000000|"; distance: 2; within: 5;content: "|000000000000000000|"; distance: 8; within: 9;sid: 20091179; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[tElock 0.99 -> tE!] binary file"; flow:established,to_server; content: "|E95EDFFFFF000000|";content: "|E5|"; distance: 10; within: 1;content: "|00000000000000000005|"; distance: 2; within: 10;sid: 20091180; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[tElock 0.99c (Private ECLIPSE) -> tE!] binary file"; flow:established,to_server; content: "|E93FDFFFFF000000|";content: "|04|"; distance: 10; within: 1;content: "|00000000000000000024|"; distance: 2; within: 10;content: "|0014|"; distance: 11; within: 2;content: "|000C|"; distance: 3; within: 2;content: "|00000000000000000031|"; distance: 3; within: 10;content: "|001C|"; distance: 11; within: 2;content: "|0000000000000000000000000000000000000000003C|"; distance: 3; within: 22;content: "|00000000004F|"; distance: 23; within: 6;content: "|00000000003C|"; distance: 7; within: 6;content: "|00000000004F|"; distance: 7; within: 6;content: "|00000000006B65726E656C33322E646C6C00757365|"; distance: 7; within: 21;sid: 20091181; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[tElock v0.41x] binary file"; flow:established,to_server; content: "|668BC08D2424EB01EB60EB01EB9CE8000000005E83C6508BFE687801|";content: "|59EB01EBAC54E803|"; distance: 29; within: 8;content: "|5CEB08|"; distance: 9; within: 3;sid: 20091182; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[tElock v0.42] binary file"; flow:established,to_server; content: "|C1EE00668BC9EB01EB60EB01EB9CE8000000005E83C6528BFE68790159EB01EBAC54E8035CEB08|";sid: 20091183; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[tElock v0.4x - v0.5x] binary file"; flow:established,to_server; content: "|C1EE00668BC9EB01EB60EB01EB9CE8000000005E83C6|";content: "|8BFE687901|"; distance: 22; within: 5;content: "|59EB01|"; distance: 6; within: 3;sid: 20091184; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[tElock v0.51] binary file"; flow:established,to_server; content: "|C1EE00668BC9EB01EB60EB01EB9CE8000000005E83C65E8BFE68790159EB01EBAC54E8035CEB08|";sid: 20091185; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[tElock v0.60] binary file"; flow:established,to_server; content: "|E90000000060E8000000005883C008|";sid: 20091186; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[tElock v0.70] binary file"; flow:established,to_server; content: "|60E8BD100000C383E200F975FA70|";sid: 20091187; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[tElock v0.71] binary file"; flow:established,to_server; content: "|60E8ED100000C383|";sid: 20091188; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[tElock v0.71b2] binary file"; flow:established,to_server; content: "|60E844110000C383|";sid: 20091189; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[tElock v0.71b7] binary file"; flow:established,to_server; content: "|60E848110000C383|";sid: 20091190; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[tElock v0.80] binary file"; flow:established,to_server; content: "|60E8F9110000C383|";sid: 20091191; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[tElock v0.85f] binary file"; flow:established,to_server; content: "|60E802000000CD20E8000000005E2BC9587402|";sid: 20091192; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[tElock v0.90] binary file"; flow:established,to_server; content: "|E802000000E800E8000000005E2B|";sid: 20091193; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[tElock v0.98] binary file"; flow:established,to_server; content: "|E925E4FFFF000000|";content: "|1E|"; distance: 10; within: 1;sid: 20091194; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[tElock v0.98 -> tE!] binary file"; flow:established,to_server; content: "|E925E4FFFF000000|";content: "|0000000000000000|"; distance: 12; within: 8;content: "|0000000000000000|"; distance: 14; within: 8;content: "|0000000000000000000000000000000000000000|"; distance: 12; within: 20;content: "|00000000|"; distance: 22; within: 4;content: "|00|"; distance: 6; within: 1;sid: 20091195; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[tElock v0.99] binary file"; flow:established,to_server; content: "|E9|";content: "|FFFF000000|"; distance: 2; within: 5;content: "|00|"; distance: 8; within: 1;content: "|00|"; distance: 4; within: 1;content: "|00|"; distance: 2; within: 1;content: "|00|"; distance: 2; within: 1;content: "|0200|"; distance: 2; within: 2;content: "|00|"; distance: 3; within: 1;content: "|00|"; distance: 2; within: 1;content: "|00|"; distance: 2; within: 1;content: "|00|"; distance: 2; within: 1;content: "|00|"; distance: 2; within: 1;content: "|00000000000000000000000000|"; distance: 2; within: 13;content: "|0000000000|"; distance: 14; within: 5;content: "|020000|"; distance: 6; within: 3;sid: 20091196; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[tElock v0.99 Special Build -> heXer & forgot] binary file"; flow:established,to_server; content: "|E95EDFFFFF000000|";content: "|E5|"; distance: 10; within: 1;content: "|00000000000000000005|"; distance: 2; within: 10;content: "|00F5|"; distance: 11; within: 2;content: "|00ED|"; distance: 3; within: 2;content: "|00000000000000000012|"; distance: 3; within: 10;content: "|00FD|"; distance: 11; within: 2;content: "|0000000000000000000000000000000000000000001D|"; distance: 3; within: 22;content: "|000000000030|"; distance: 23; within: 6;content: "|0000|"; distance: 7; within: 2;sid: 20091197; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[tElock v0.99 Special Build -> heXer & forgot] binary file"; flow:established,to_server; content: "|E95EDFFFFF000000|";content: "|E5|"; distance: 10; within: 1;content: "|00000000000000000005|"; distance: 2; within: 10;content: "|00F5|"; distance: 11; within: 2;content: "|00ED|"; distance: 3; within: 2;content: "|00000000000000000012|"; distance: 3; within: 10;content: "|00FD|"; distance: 11; within: 2;content: "|0000000000000000000000000000000000000000001D|"; distance: 3; within: 22;content: "|000000000030|"; distance: 23; within: 6;content: "|00000000001D|"; distance: 7; within: 6;content: "|000000000030|"; distance: 7; within: 6;content: "|0000000000|"; distance: 7; within: 5;sid: 20091198; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[The Guard Library] binary file"; flow:established,to_server; content: "|50E8|";content: "|5825|"; distance: 4; within: 2;content: "|F0FFFF8BC883C1605183C04083EA0652FF209DC3|"; distance: 2; within: 20;sid: 20091199; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[TheHyper's protector -> TheHyper] binary file"; flow:established,to_server; content: "|558BEC83EC148BFCE814000000|";content: "|0101|"; distance: 14; within: 2;content: "|0101|"; distance: 3; within: 2;content: "|00|"; distance: 3; within: 1;content: "|0101|"; distance: 2; within: 2;content: "|02015EE80D0000006B65726E656C33322E646C6C008B4604FF108BD8E80D0000005669727475616C416C6C6F6300538B06FF108907E8|"; distance: 3; within: 54;sid: 20091200; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Themida -> Oreans Technologies 2004] binary file"; flow:established,to_server; content: "|B800000000600BC07458E8000000005805430000008038E9750361EB35E8|";sid: 20091201; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[themida 1.0.0.5 -> http://www.oreans.com] binary file"; flow:established,to_server; content: "|B800000000600BC07458E8000000005805430000008038E9750361EB35E800000000582500F0FFFF33FF66BB195A6683C33466391875120FB7503C03D0BBE944|";sid: 20091202; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Themida 1.0.x.x - 1.8.0.0 (compressed engine) -> Oreans Technologies] binary file"; flow:established,to_server; content: "|B8|";content: "|600BC07458E8000000005805430000008038E9750361EB35E800000000582500F0FFFF33FF66BB195A6683C33466391875120FB7503C03D0BBE944000083C367391A74072D00100000EBDA8BF8B8|"; distance: 3; within: 78;sid: 20091203; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Themida 1.0.x.x - 1.8.0.0 (compressed engine) -> Oreans Technologies] binary file"; flow:established,to_server; content: "|B8|";content: "|600BC07458E8000000005805430000008038E9750361EB35E800000000582500F0FFFF33FF66BB195A6683C33466391875120FB7503C03D0BBE944000083C367391A74072D00100000EBDA8BF8B8|"; distance: 3; within: 78;content: "|03C7B95A|"; distance: 80; within: 4;content: "|03CFEB0AB8|"; distance: 5; within: 5;content: "|B95A|"; distance: 7; within: 2;content: "|5051E884000000E800000000582D26000000B9EF010000C600E983E90589480161E9AF01|"; distance: 3; within: 36;sid: 20091204; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Themida 1.2.0.1 (compressed) -> Oreans Technologies] binary file"; flow:established,to_server; content: "|B80000|";content: "|600BC07458E8000000005805430000008038E9750361EB35E800000000582500F0FFFF33FF66BB195A6683C33466391875120FB7503C03D0BBE944000083C367391A74072D00100000EBDA8BF8B8|"; distance: 4; within: 78;sid: 20091205; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Themida 1.8.x.x -> Oreans Technologies] binary file"; flow:established,to_server; content: "|B8|";content: "|600BC07468E8000000005805530000008038E9751361EB45DB2D37|"; distance: 3; within: 27;content: "|FFFFFFFFFFFFFFFF3D40E800000000582500F0FFFF33FF66BB195A6683C33466391875120FB7503C03D0BBE944000083C367|"; distance: 28; within: 50;sid: 20091206; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Themida 1.8.x.x -> Oreans Technologies] binary file"; flow:established,to_server; content: "|B8|";content: "|600BC07468E8000000005805530000008038E9751361EB45DB2D37|"; distance: 3; within: 27;content: "|FFFFFFFFFFFFFFFF3D40E800000000582500F0FFFF33FF66BB195A6683C33466391875120FB7503C03D0BBE944000083C367391A74072D00100000EBDA8BF8B8|"; distance: 28; within: 64;content: "|03C7B9|"; distance: 66; within: 3;content: "|03CFEB0AB8|"; distance: 5; within: 5;content: "|B9|"; distance: 7; within: 1;content: "|5051E884000000E800000000582D26000000B9EF010000C600E983E90589480161E9|"; distance: 3; within: 34;sid: 20091207; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Themida/WinLicense V1.0.0.0-V1.8.0.0-> Oreans Technologies] binary file"; flow:established,to_server; content: "|B800000000600BC07458E8000000005805|";content: "|0000008038E975|"; distance: 17; within: 7;content: "|61EB|"; distance: 7; within: 2;content: "|E800000000|"; distance: 2; within: 5;sid: 20091208; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Themida/WinLicense V1.0.X-V1.7.X DLL -> Oreans Technologies] binary file"; flow:established,to_server; content: "|B8|";content: "|600BC07458E8000000005805|"; distance: 3; within: 12;content: "|8038E9750361EB35E800000000582500F0FFFF33FF66BB|"; distance: 14; within: 23;content: "|6683|"; distance: 24; within: 2;content: "|66391875120FB7503C03D0BB|"; distance: 3; within: 12;content: "|83C3|"; distance: 14; within: 2;content: "|391A74072D00100000EBDA8BF8B8|"; distance: 2; within: 14;content: "|03C7B9|"; distance: 16; within: 3;content: "|03CFEB0AB8|"; distance: 5; within: 5;content: "|B9|"; distance: 7; within: 1;content: "|5051E884000000E800000000582D|"; distance: 3; within: 14;content: "|B9|"; distance: 16; within: 1;content: "|C600E983E9|"; distance: 3; within: 5;content: "|89480161E9|"; distance: 5; within: 5;sid: 20091209; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Themida/WinLicense V1.8.0.2 + -> Oreans Technologies] binary file"; flow:established,to_server; content: "|B800000000600BC07468E8000000005805|";content: "|0000008038E975|"; distance: 17; within: 7;content: "|61EB|"; distance: 7; within: 2;content: "|DB2D|"; distance: 2; within: 2;content: "|FFFFFFFFFFFFFFFF3D40E800000000|"; distance: 4; within: 15;sid: 20091210; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Themida/WinLicense V1.8.X-V1.9.X  -> Oreans Technologies] binary file"; flow:established,to_server; content: "|B8|";content: "|600BC07468E8000000005805530000008038E9751361EB45DB2D|"; distance: 3; within: 26;content: "|FFFFFFFFFFFFFFFF3D|"; distance: 28; within: 9;content: "|0000582500F0FFFF33FF66BB|"; distance: 11; within: 12;content: "|6683|"; distance: 13; within: 2;content: "|66391875120FB7503C03D0BB|"; distance: 3; within: 12;content: "|83C3|"; distance: 14; within: 2;content: "|391A74072D|"; distance: 2; within: 5;content: "|EBDA8BF8B8|"; distance: 7; within: 5;content: "|03C7B9|"; distance: 7; within: 3;content: "|03CFEB0AB8|"; distance: 5; within: 5;content: "|B9|"; distance: 7; within: 1;content: "|5051E8|"; distance: 3; within: 3;content: "|E8|"; distance: 5; within: 1;content: "|582D|"; distance: 3; within: 2;content: "|B9|"; distance: 4; within: 1;content: "|C600E983E90589480161E9|"; distance: 3; within: 11;sid: 20091211; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[theWRAP - by TronDoc] binary file"; flow:established,to_server; content: "|558BEC83C4F053565733C08945F0B848D24B00E8BC87F4FFBB040B4D0033C05568E8D54B0064FF30648920E89CF4FFFFE8F7FBFFFF6A408D55F0A1F0ED4B008B00E8422EF7FF8B4DF0B201A1F4C24000E8F720F5FF8BF0B201A1B4C34000E8F15BF4FF890333D28B03E8421EF5FF66B90200BAFCFFFFFF8BC68B38FF570CBAB8A74D00B9040000008BC68B38FF5704833DB8A74D00000F845E0100008B15B8A74D0083C204F7DA66B902008BC68B38FF570C8B0DB8A74D008BD68B03E82B1FF5FF8BC6E8B45BF4FF33D28B03E8DF1DF5FFBAF0444E00B9010000008B038B30FF5604803DF0444E000A753FBAB8A74D00B9040000008B038B30FF56048B15B8A7|";sid: 20091212; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall 2.4x - 2.5x -> Jitit Software] binary file"; flow:established,to_server; content: "|558BECB8|";content: "|BB|"; distance: 6; within: 1;content: "|50E800000000582D|"; distance: 3; within: 8;content: "|B9|"; distance: 10; within: 1;content: "|BA|"; distance: 3; within: 1;content: "|BE|"; distance: 3; within: 1;content: "|BF|"; distance: 3; within: 1;content: "|BD|"; distance: 3; within: 1;content: "|03E8|"; distance: 3; within: 2;sid: 20091213; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall 2.5 -> ???] binary file"; flow:established,to_server; content: "|558BECB8|";content: "|BB|"; distance: 6; within: 1;content: "|50E800000000582DA71A0000B96C1A0000BA201B0000BE00100000BFB0530000BDEC1A000003E8817500|"; distance: 3; within: 42;content: "|817504|"; distance: 44; within: 3;content: "|817508|"; distance: 5; within: 3;content: "|81750C|"; distance: 5; within: 3;content: "|817510|"; distance: 5; within: 3;sid: 20091214; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall 2.5xx -> Jtit] binary file"; flow:established,to_server; content: "|558BECB8|";content: "|BB|"; distance: 6; within: 1;content: "|50E800000000582D|"; distance: 3; within: 8;content: "|1A0000B9|"; distance: 8; within: 4;content: "|1A0000BA|"; distance: 4; within: 4;content: "|1B0000BE00100000BF|"; distance: 4; within: 9;content: "|530000BD|"; distance: 9; within: 4;content: "|1A000003E8817500|"; distance: 4; within: 8;content: "|7504|"; distance: 10; within: 2;content: "|817508|"; distance: 4; within: 3;content: "|81750C|"; distance: 5; within: 3;content: "|817510|"; distance: 5; within: 3;sid: 20091215; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall 2.5xx -> Jtit] binary file"; flow:established,to_server; content: "|558BECB8|";content: "|BB|"; distance: 6; within: 1;content: "|50E800000000582D|"; distance: 3; within: 8;content: "|1A0000B9|"; distance: 8; within: 4;content: "|1A0000BA|"; distance: 4; within: 4;content: "|1B0000BE00100000BF|"; distance: 4; within: 9;content: "|530000BD|"; distance: 9; within: 4;content: "|1A000003E8817500|"; distance: 4; within: 8;content: "|7504|"; distance: 10; within: 2;content: "|817508|"; distance: 4; within: 3;content: "|81750C|"; distance: 5; within: 3;content: "|817510|"; distance: 5; within: 3;content: "|03|"; distance: 5; within: 1;content: "|3BF17C043BF27C02892E83C6043BF77CE35850680000400068805A|"; distance: 12; within: 27;sid: 20091216; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall 2.628 -> Jtit] binary file"; flow:established,to_server; content: "|E80000000058BB341D00002BC3506800004000680040000068BC000000E8C3FEFFFFE999FFFFFFCCCCCCCCCCCCCCCCCCCC558BEC83C4F4FC5357568B75088B7D0CC745FC0800000033DBBA000000804333C0E81901|";sid: 20091217; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall 2.628 -> Jtit] binary file"; flow:established,to_server; content: "|E80000000058BB341D00002BC3506800004000680040000068BC000000E8C3FEFFFFE999FFFFFFCCCCCCCCCCCCCCCCCCCC558BEC83C4F4FC5357568B75088B7D0CC745FC0800000033DBBA000000804333C0E819010000730E8B4DF8E8270100000245F7AAEBE9E8040100000F8296000000E8F9000000735BB904000000E8050100004874DE0F89C6000000E8DF000000731B55BD00010000E8DF0000008807474D75F5E8C700000072E95DEBA2B901000000E8D000000083C0078945F8C645F70083F8087489E8B10000008845F7E97CFFFFFFB907000000E8AA0000005033C9B102E8A00000008BC84141580BC074048BD8EB5E83F902746A41E8880000008945FCE948FFFFFFE88700000049E2098BC3E87D000000EB3A498BC1558B4DFC8BE833C0D3E5E85D0000000BC55D8BD8E85F0000003D0000010073143DFF370000730E3D7F020000730883F87F770441414141568BF72BF0F3|";sid: 20091218; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall 2.736 -> Jitit] binary file"; flow:established,to_server; content: "|9C60E80000000058BBF31C00002BC3506800004000680026000068CC000000E8C1FEFFFFE997FFFFFFCCCCCCCCCCCCCCCCCCCCCC558BEC83C4F4FC5357568B75088B7D0CC745FC0800000033DBBA000000804333C0E819010000730E8B4DF8E8270100000245F7AAEBE9E8040100000F8296000000E8F9000000735BB904000000E8050100004874DE0F89C6000000E8DF000000731B55BD00010000E8DF0000008807474D75F5E8C700000072E95DEBA2B901000000E8D000000083C0078945F8C645F70083F8087489E8B10000008845F7E97CFFFFFFB907000000E8AA0000005033C9B102E8A00000008BC84141580BC074048BD8EB5E83F902746A41E8880000008945FCE948FFFFFFE88700000049E2098BC3E87D000000EB3A498BC1558B4DFC8BE833C0D3E5E85D0000000BC55D8BD8E85F0000003D0000010073143DFF370000730E3D7F020000730883F87F770441414141568BF72BF0F3A45EE9F0FEFFFF33C0EB058BC72B450C5E5F5BC9C20800|";sid: 20091219; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall 3.035 -> Jtit] binary file"; flow:established,to_server; content: "|9C60685374416C685468496EE80000000058BB371F00002BC35068|";content: "|68002800006804010000E8BAFEFFFFE990FFFFFFCCCCCCCCCCCCCC558BEC83C4F4FC5357568B75088B7D0CC745FC0800000033DBBA00|"; distance: 29; within: 54;sid: 20091220; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall 3.035 -> Jtit] binary file"; flow:established,to_server; content: "|9C60685374416C685468496EE80000000058BB371F00002BC35068|";content: "|68002800006804010000E8BAFEFFFFE990FFFFFFCCCCCCCCCCCCCC558BEC83C4F4FC5357568B75088B7D0CC745FC0800000033DBBA000000804333C0E819010000730E8B4DF8E8270100000245F7AAEBE9E8040100000F8296000000E8F9000000735BB904000000E8050100004874DE0F89C6000000E8DF000000731B55BD00010000E8DF0000008807474D75F5E8C700000072E95DEBA2B901000000E8D000000083C0078945F8C645F70083F8087489E8B10000008845F7E97CFFFFFFB907000000E8AA0000005033C9B102E8A00000008BC84141580BC074048BD8EB5E83F902746A41E8880000008945FCE948FFFFFFE88700000049E2098BC3E87D000000EB3A498BC1558B4DFC8BE833C0D3E5E85D0000000BC55D8BD8E85F0000003D0000010073143DFF370000730E3D7F020000730883F87F770441414141568BF72BF0F3A45EE9F0FEFFFF33C0EB058BC72B450C5E5F5BC9C2080003D275088B1683C604F913D2C3B908000000E801000000C333C0E8E1FFFFFF13C0E2F7C333C941E8D4FFFFFF13C9E8CDFFFFFF72F2C3|"; distance: 29; within: 400;sid: 20091221; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall Embedded 1.9X -> Jitit] binary file"; flow:established,to_server; content: "|558BEC515356576A006A00FF15|";content: "|50E887FCFFFF5959A1|"; distance: 15; within: 9;content: "|8B40100305|"; distance: 11; within: 5;content: "|8945FC8B45FCFFE05F5E5BC9C3000000|"; distance: 7; within: 16;sid: 20091222; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall Embedded 2.0X -> Jitit] binary file"; flow:established,to_server; content: "|B8EFBEADDE506A00FF15|";content: "|E9ADFFFFFF8BC18B4C2404898829040000C7400C010000000FB64901D1E9894810C7401480000000C204008B442404C7410C010000008981290400000FB64001D1E8894110C7411480000000C20400558BEC53565733C033FF39450C8BF1760C8B4D08033C81403B450C72F48BCEE8430000008B461433D2F7F78B5E1033D28BF88BC3F7F7897E1889450C33C033C98B5508030C8240394D0C73F4488B14822BCA0FAFCF2BD90FAFFA897E14895E105F5E5B5DC20800|"; distance: 12; within: 182;sid: 20091223; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall Embedded 2.2X-2.308 -> Jitit] binary file"; flow:established,to_server; content: "|B8EFBEADDE506A00FF15|";content: "|E9B9FFFFFF8BC18B4C2404898829040000C7400C010000000FB64901D1E9894810C7401480000000C204008B442404C7410C010000008981290400000FB64001D1E8894110C7411480000000C20400558BEC53565733C033FF39450C8BF1760C8B4D08033C81403B450C72F48BCEE8430000008B461433D2F7F78B5E1033D28BF88BC3F7F7897E1889450C33C033C98B5508030C8240394D0C73F4488B14822BCA0FAFCF2BD90FAFFA897E14895E105F5E5B5DC20800|"; distance: 12; within: 182;sid: 20091224; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall Embedded 2.312 -> Jitit] binary file"; flow:established,to_server; content: "|6A00FF15|";content: "|E8D4F8FFFFE9E9ADFFFFFF8BC18B4C2404898829040000C7400C010000000FB64901D1E9894810C7401480000000C204008B442404C7410C010000008981290400000FB64001D1E8894110C7411480000000C20400558BEC53565733C033FF39450C8BF1760C8B4D08033C81403B450C72F48BCEE8430000008B461433D2F7F78B5E1033D28BF88BC3F7F7897E1889450C33C033C98B5508030C8240394D0C73F4488B14822BCA0FAFCF2BD90FAFFA897E14895E105F5E5B5DC20800|"; distance: 6; within: 188;sid: 20091225; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall Embedded 2.422-2.428 -> Jitit] binary file"; flow:established,to_server; content: "|558BECB8|";content: "|BB|"; distance: 6; within: 1;content: "|50E800000000582D9B1A0000B9841A0000BA141B0000BE00100000BFB0530000BDE01A000003E8817500|"; distance: 3; within: 42;content: "|817504|"; distance: 44; within: 3;content: "|817508|"; distance: 5; within: 3;content: "|81750C|"; distance: 5; within: 3;content: "|817510|"; distance: 5; within: 3;sid: 20091226; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall Embedded 2.501 -> Jitit] binary file"; flow:established,to_server; content: "|558BECB8|";content: "|BB|"; distance: 6; within: 1;content: "|50E800000000582DA81A0000B96D1A0000BA211B0000BE00100000BFC0530000BDF01A000003E8817500|"; distance: 3; within: 42;content: "|817504|"; distance: 44; within: 3;content: "|817508|"; distance: 5; within: 3;content: "|81750C|"; distance: 5; within: 3;content: "|817510|"; distance: 5; within: 3;sid: 20091227; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall Embedded 2.545 -> Jitit] binary file"; flow:established,to_server; content: "|E8F2FFFFFF5068|";content: "|68401B0000E842FFFFFFE99DFFFFFF000000000000|"; distance: 9; within: 21;sid: 20091228; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall Embedded 2.547-V2.600 -> Jitit] binary file"; flow:established,to_server; content: "|E80000000058BBBC1800002BC35068|";content: "|68601B00006860000000E835FFFFFFE999FFFFFF0000|"; distance: 17; within: 22;sid: 20091229; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall Embedded 2.609 -> Jitit] binary file"; flow:established,to_server; content: "|E80000000058BBAD1900002BC35068|";content: "|68B01C00006880000000E835FFFFFFE999FFFFFF00|"; distance: 17; within: 21;sid: 20091230; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall Embedded 2.620-2.623 -> Jitit] binary file"; flow:established,to_server; content: "|E80000000058BBAC1E00002BC35068|";content: "|68B021000068C4000000E8C3FEFFFFE999FFFFFF0000|"; distance: 17; within: 22;sid: 20091231; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall Embedded 2.717-2.719 -> Jitit] binary file"; flow:established,to_server; content: "|9C60E80000000058BB|";content: "|2BC35068|"; distance: 11; within: 4;content: "|68|"; distance: 6; within: 1;content: "|68|"; distance: 3; within: 1;content: "|E8C1FEFFFFE997FFFFFFCCCC558BEC83C4F4FC5357568B75088B7D0CC745FC0800000033DBBA000000804333C0E819010000730E8B4DF8E8270100000245F7AAEBE9E8040100000F8296000000E8F9000000735BB904000000E8050100004874DE0F89C6000000E8DF000000731B55BD00010000E8DF0000008807474D75F5E8C700000072E95DEBA2B901000000E8D000000083C0078945F8C645F70083F8087489E8B10000008845F7E97CFFFFFFB907000000E8AA0000005033C9B102E8A00000008BC84141580BC074048BD8EB5E83F902746A41E8880000008945FCE948FFFFFFE88700000049E2098BC3E87D000000EB3A498BC1558B4DFC8BE833C0D3E5E85D0000000BC55D8BD8E85F0000003D0000010073143DFF370000730E3D7F020000730883F87F770441414141568BF72BF0F3A45EE9F0FEFFFF33C0EB058BC72B450C5E5F5BC9C20800|"; distance: 3; within: 331;sid: 20091232; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall V2.403 -> Jitit] binary file"; flow:established,to_server; content: "|6A00FF1520504000E8D4F8FFFFE9E9ADFFFFFF8BC18B4C2404898829040000C7400C010000000FB64901D1E9894810C7401480000000C204008B442404C7410C010000008981290400000FB64001D1E8894110C741|";sid: 20091233; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall V2.403 -> Jitit] binary file"; flow:established,to_server; content: "|6A00FF1520504000E8D4F8FFFFE9E9ADFFFFFF8BC18B4C2404898829040000C7400C010000000FB64901D1E9894810C7401480000000C204008B442404C7410C010000008981290400000FB64001D1E8894110C7411480000000C20400558BEC53565733C033FF39450C8BF1760C8B4D08033C81403B450C72F48BCEE8430000008B461433D2F7F78B5E1033D28BF88BC3F7F7897E1889450C33C033C98B5508030C8240394D0C73F4488B14822BCA0FAFCF2BD90FAFFA897E14895E105F5E5B5DC2080057BF00008000397914773653568BB1290400008B410C8B591003DB8A143083E2010BD3C1E2074089511089410C0FB60430C1611408D1E809411039|";sid: 20091234; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall v2.460 -> Jitit] binary file"; flow:established,to_server; content: "|558BEC515356576A006A00FF15F418400050E887FCFFFF5959A1941A40008B40100305901A40008945FC8B45FCFFE05F5E5BC9C3000000760C0000D40C00001E|";sid: 20091235; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall V2.7X -> Jitit] binary file"; flow:established,to_server; content: "|9C60E80000000058BB|";content: "|2BC35068|"; distance: 11; within: 4;content: "|68|"; distance: 6; within: 1;content: "|68|"; distance: 3; within: 1;content: "|E8|"; distance: 3; within: 1;content: "|E9|"; distance: 3; within: 1;sid: 20091236; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall Virtualization Suite 3.035-3.043 -> Thinstall Company] binary file"; flow:established,to_server; content: "|9C60685374416C685468496EE80000000058BB371F00002BC35068|";content: "|68002800006804010000E8BAFEFFFFE990FFFFFFCCCCCCCCCCCCCC558BEC83C4F4FC5357568B75088B7D0CC745FC0800000033DBBA000000804333C0E819010000730E8B4DF8E8270100000245F7AAEBE9E8040100000F8296000000E8F9000000735BB904000000E8050100004874DE0F89C6000000E8DF000000731B55BD00010000E8DF0000008807474D75F5E8C700000072E95DEB|"; distance: 29; within: 151;sid: 20091237; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall Virtualization Suite 3.049-3.080 -> Thinstall Company] binary file"; flow:established,to_server; content: "|9C60685374416C685468496EE80000000058BB371F00002BC35068|";content: "|68002C00006804010000E8BAFEFFFFE990FFFFFFCCCCCCCCCCCCCC558BEC83C4F4FC5357568B75088B7D0CC745FC0800000033DBBA00|"; distance: 29; within: 54;sid: 20091238; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall Virtualization Suite 3.049-3.080 -> Thinstall Company] binary file"; flow:established,to_server; content: "|9C60685374416C685468496EE80000000058BB371F00002BC35068|";content: "|68002C00006804010000E8BAFEFFFFE990FFFFFFCCCCCCCCCCCCCC558BEC83C4F4FC5357568B75088B7D0CC745FC0800000033DBBA000000804333C0E819010000730E8B4DF8E8270100000245F7AAEBE9E8040100000F8296000000E8F9000000735BB904000000E8050100004874DE0F89C6000000E8DF000000731B55BD00010000E8DF0000008807474D75F5E8C700000072E95DEB|"; distance: 29; within: 151;sid: 20091239; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall Virtualization Suite 3.0X -> Thinstall Company] binary file"; flow:established,to_server; content: "|9C6068|";content: "|68|"; distance: 5; within: 1;content: "|E80000000058BB|"; distance: 3; within: 7;content: "|2BC35068|"; distance: 9; within: 4;content: "|68|"; distance: 6; within: 1;content: "|68|"; distance: 3; within: 1;content: "|E8BAFEFFFFE9|"; distance: 3; within: 6;content: "|CCCCCCCCCCCCCC558BEC83C4F4FC5357568B75088B7D0CC745FC0800000033DBBA|"; distance: 8; within: 33;sid: 20091240; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall Virtualization Suite 3.0X -> Thinstall Company] binary file"; flow:established,to_server; content: "|9C6068|";content: "|68|"; distance: 5; within: 1;content: "|E80000000058BB|"; distance: 3; within: 7;content: "|2BC35068|"; distance: 9; within: 4;content: "|68|"; distance: 6; within: 1;content: "|68|"; distance: 3; within: 1;content: "|E8BAFEFFFFE9|"; distance: 3; within: 6;content: "|CCCCCCCCCCCCCC558BEC83C4F4FC5357568B75088B7D0CC745FC0800000033DBBA|"; distance: 8; within: 33;content: "|4333C0E819010000730E8B4DF8E8270100000245F7AAEBE9E8040100000F8296000000E8F9000000735BB904000000E8050100004874DE0F89|"; distance: 35; within: 57;content: "|E8DF000000731B55BD|"; distance: 59; within: 9;content: "|E8DF0000008807474D75F5E8C700000072E95DEB|"; distance: 11; within: 20;sid: 20091241; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Thinstall vx.x] binary file"; flow:established,to_server; content: "|B8EFBEADDE506A|";content: "|FF15101940|"; distance: 7; within: 5;content: "|E9ADFFFFFF|"; distance: 5; within: 5;sid: 20091242; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[TMT-Pascal v0.40] binary file"; flow:established,to_server; content: "|0E1F068C06|";content: "|26A1|"; distance: 6; within: 2;content: "|A3|"; distance: 3; within: 1;content: "|8EC06633FF6633C9|"; distance: 2; within: 8;sid: 20091243; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[TopSpeed v3.01 1989] binary file"; flow:established,to_server; content: "|1EBA|";content: "|8EDA8B|"; distance: 3; within: 3;content: "|8B|"; distance: 4; within: 1;content: "|FF|"; distance: 2; within: 1;content: "|5053|"; distance: 2; within: 2;sid: 20091244; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[TPPpack -> clane] binary file"; flow:established,to_server; content: "|E8000000005D81EDF58F40006033|";content: "|E8|"; distance: 14; within: 1;sid: 20091245; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Trivial173 by SMT/SMF] binary file"; flow:established,to_server; content: "|EB|";content: "|285472697669616C31373320627920534D542F534D4629|"; distance: 2; within: 23;sid: 20091246; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UG2002 Cruncher v0.3b3] binary file"; flow:established,to_server; content: "|60E8|";content: "|5D81ED|"; distance: 4; within: 3;content: "|E80D|"; distance: 5; within: 2;content: "|58|"; distance: 10; within: 1;sid: 20091247; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UltraPro V1.0 -> SafeNet] binary file"; flow:established,to_server; content: "|A1|";content: "|85C00F853B0600005556C705|"; distance: 3; within: 12;content: "|01000000FF15|"; distance: 14; within: 6;sid: 20091248; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Unknown by SMT] binary file"; flow:established,to_server; content: "|60BE|";content: "|8DBE|"; distance: 4; within: 2;content: "|83|"; distance: 4; within: 1;content: "|57EB|"; distance: 2; within: 2;sid: 20091249; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Unknown Joiner (sign from pinch 26.03.2007 02:12)] binary file"; flow:established,to_server; content: "|44904C90B9DE000000BA0010400083C20344904CB90700000044904C33C9C705083040000000000090680001000068213040006A00E8C5020000906A006880|";sid: 20091250; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Unnamed Scrambler 1.3B -> p0ke] binary file"; flow:established,to_server; content: "|558BECB9080000006A006A004975F9535657B898560010E848EBFFFF33C05568AC5D001064FF306489206A0068BC5D001068C45D00106A00E823ECFFFFE8C6CEFFFF6A0068BC5D001068|";content: "|6A00E80BECFFFFE8F2F4FFFFB808BC001033C9BA04010000E8C1D2FFFF6A0068BC5D001068E45D00106A00E8E2EBFFFF68040100006808BC00106A00FF15687700106A0068BC5D001068FC5D00106A00E8BDEBFFFFBA105E0010B870770010E8CAF3FFFF85C00F84F7050000BA747700108B0D70770010E8FECDFFFF6A00|"; distance: 76; within: 126;sid: 20091251; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UnoPiX 0.75 -> BaGiE] binary file"; flow:established,to_server; content: "|60E8070000006168|";content: "|4000C383042418C32083B8ED2037EFC6B979379E61|"; distance: 9; within: 21;sid: 20091252; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UnoPiX 1.03-1.10 -> BaGiE] binary file"; flow:established,to_server; content: "|83EC04C7042400|";content: "|C300|"; distance: 8; within: 2;content: "|000000000000000000000000|"; distance: 3; within: 12;content: "|00100000000200000100000000000000040000000000000000|"; distance: 13; within: 25;content: "|000010000000000000020000|"; distance: 26; within: 12;content: "|0000|"; distance: 12; within: 2;content: "|0000|"; distance: 2; within: 2;content: "|0000001000001000000000000010|"; distance: 3; within: 14;sid: 20091253; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Unpacked BS-SFX Archive v1.9] binary file"; flow:established,to_server; content: "|1E33C050B8|";content: "|8ED8FA8ED0BC|"; distance: 6; within: 6;content: "|FBB8|"; distance: 7; within: 2;content: "|CD213C0373|"; distance: 3; within: 5;sid: 20091254; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack 0.10 - 0.12 beta -> Dwing] binary file"; flow:established,to_server; content: "|BE48014000AD8BF895A533C033C9AB48ABF7D8B104F3ABC1E00AB5|";content: "|F3ABAD509751AD87F5588D54865CFFD5725A2C037302B0003C0772022C03500FB65FFFC1|"; distance: 27; within: 36;sid: 20091255; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack 0.12 beta-->Dwing] binary file"; flow:established,to_server; content: "|BE48014000AD|";content: "|A5|"; distance: 7; within: 1;content: "|C033C9|"; distance: 1; within: 3;content: "|F3AB|"; distance: 6; within: 2;content: "|0A|"; distance: 3; within: 1;content: "|AD509751|"; distance: 3; within: 4;content: "|87F5588D54865C|"; distance: 4; within: 7;content: "|D572|"; distance: 7; within: 2;content: "|B65FFFC1|"; distance: 9; within: 4;sid: 20091256; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack 0.20 beta -> Dwing] binary file"; flow:established,to_server; content: "|BE88014000AD8BF895A533C033C9AB48ABF7D8B104F3ABC1E00AB5|";content: "|F3ABAD509751588D54855CFF16725A2C037302B0003C0772022C03500FB65FFFC1E3|"; distance: 27; within: 34;content: "|B3|"; distance: 34; within: 1;sid: 20091257; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack 0.21 beta -> Dwing] binary file"; flow:established,to_server; content: "|BE88014000AD8BF86A0495A533C0AB48ABF7D859F3ABC1E00AB5|";content: "|F3ABAD509751588D54855CFF16725A2C037302B0003C0772022C03500FB65FFFC1E3|"; distance: 26; within: 34;content: "|B300|"; distance: 34; within: 2;sid: 20091258; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack 0.22 - 0.23 beta -> Dwing] binary file"; flow:established,to_server; content: "|6A07BE88014000AD8BF85995F3A5ADB5|";content: "|F3ABAD509751588D54855CFF1672592C037302B0003C0772022C03500FB65FFFC1E3|"; distance: 16; within: 34;content: "|B3008D1C5B8D9C9D0C100000|"; distance: 34; within: 12;sid: 20091259; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack 0.22 - 0.23 beta -> Dwing] binary file"; flow:established,to_server; content: "|AD8BF85995F3A5ADB5|";content: "|F3ABAD509751588D54855CFF1672|"; distance: 9; within: 14;content: "|2C037302B0003C0772022C03500FB65FFFC1E3|"; distance: 14; within: 19;content: "|B3008D1C5B8D9C9D0C100000|"; distance: 19; within: 12;sid: 20091260; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack 0.24 - 0.27 beta / 0.28 alpha -> Dwing] binary file"; flow:established,to_server; content: "|BE88014000AD8BF895AD91F3A5ADB5|";content: "|F3ABAD509751588D54855CFF1672572C037302B0003C0772022C03500FB65FFFC1E3|"; distance: 15; within: 34;content: "|B3008D1C5B8D9C9D0C100000B0|"; distance: 34; within: 13;sid: 20091261; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UPack Alt Stub -> Dwing] binary file"; flow:established,to_server; content: "|60E809000000C3F60000E90602000033C95E870EE3F42BF18BDEAD2BD8AD|";sid: 20091262; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack v0.10 - v0.12 Beta -> Dwing] binary file"; flow:established,to_server; content: "|BE4801|";content: "|95A533C0|"; distance: 5; within: 4;sid: 20091263; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack V0.10-V0.11 -> Dwing] binary file"; flow:established,to_server; content: "|BE|";content: "|AD8BF895A533C033C9AB48ABF7D8B1|"; distance: 3; within: 15;content: "|F3ABC1E0|"; distance: 15; within: 4;content: "|B5|"; distance: 4; within: 1;content: "|F3ABAD509751AD87F5588D54865CFFD5725A2C|"; distance: 1; within: 19;content: "|73|"; distance: 19; within: 1;content: "|B0|"; distance: 1; within: 1;content: "|3C|"; distance: 1; within: 1;content: "|72022C|"; distance: 1; within: 3;content: "|500FB65FFFC1E3|"; distance: 3; within: 7;content: "|B3|"; distance: 7; within: 1;content: "|8D1C5B8D|"; distance: 1; within: 4;content: "|B0|"; distance: 7; within: 1;content: "|67E3298BD72B560C8A2A33D284E90F95C652FEC68AD08D1493FFD5|"; distance: 1; within: 27;sid: 20091264; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack v0.1x - v0.2x -> Dwing] binary file"; flow:established,to_server; content: "|BE8801|";content: "|AD8BF895|"; distance: 4; within: 4;sid: 20091265; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack v0.2 Beta -> Dwing] binary file"; flow:established,to_server; content: "|BE8801|";content: "|AD8BF895A533C033|"; distance: 4; within: 8;sid: 20091266; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack v0.21 Beta -> Dwing] binary file"; flow:established,to_server; content: "|BE8801|";content: "|AD8BF8|"; distance: 4; within: 3;content: "|33|"; distance: 5; within: 1;sid: 20091267; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack v0.22 ~ v0.23 Beta -> Dwing] binary file"; flow:established,to_server; content: "|6A07BE88014000AD8BF85995F3A5|";sid: 20091268; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack v0.24 ~ v0.28 Alpha -> Dwing] binary file"; flow:established,to_server; content: "|BE88014000AD|";content: "|95AD91F3A5AD|"; distance: 7; within: 6;sid: 20091269; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack v0.29 beta -> Dwing] binary file"; flow:established,to_server; content: "|E9|";content: "|42794477696E6740000000504500004C0102|"; distance: 3; within: 18;content: "|29|"; distance: 28; within: 1;sid: 20091270; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack v0.30 beta -> Dwing] binary file"; flow:established,to_server; content: "|E9|";content: "|42794477696E6740000000504500004C0102|"; distance: 3; within: 18;content: "|30|"; distance: 28; within: 1;sid: 20091271; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack v0.31 beta -> Dwing] binary file"; flow:established,to_server; content: "|E9|";content: "|42794477696E6740000000504500004C0102|"; distance: 3; within: 18;content: "|31|"; distance: 28; within: 1;sid: 20091272; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack v0.32 beta -> Dwing] binary file"; flow:established,to_server; content: "|E9|";content: "|42794477696E6740000000504500004C0102|"; distance: 3; within: 18;content: "|32|"; distance: 28; within: 1;sid: 20091273; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack v0.33 ~ v0.34 Beta -> Dwing] binary file"; flow:established,to_server; content: "|59F3A583C8FF8BDFAB40AB40|";sid: 20091274; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack V0.36 -> Dwing] binary file"; flow:established,to_server; content: "|0B01|";content: "|1810000010000000|"; distance: 9; within: 8;content: "|0010000000020000|"; distance: 12; within: 8;content: "|00000000|"; distance: 14; within: 4;content: "|000000000A0000000000000000000000|"; distance: 20; within: 16;content: "|14000000|"; distance: 18; within: 4;content: "|47657450726F634164647265737300FF7608FF760CBE1C01|"; distance: 36; within: 24;sid: 20091275; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack V0.36 -> Dwing] binary file"; flow:established,to_server; content: "|BE|";content: "|FF36E9C3000000|"; distance: 3; within: 7;sid: 20091276; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack v0.36 beta -> Dwing] binary file"; flow:established,to_server; content: "|BEE011|";content: "|FF36E9C30000004801|"; distance: 4; within: 9;content: "|0B014B45524E454C33322E444C4C|"; distance: 10; within: 14;sid: 20091277; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack v0.36 beta -> Dwing] binary file"; flow:established,to_server; content: "|BEE011|";content: "|FF36E9C30000004801|"; distance: 4; within: 9;content: "|0B014B45524E454C33322E444C4C|"; distance: 10; within: 14;content: "|47657450726F6341646472657373|"; distance: 95; within: 14;content: "|828EFEFFFF588B4E405FE3|"; distance: 41; within: 11;sid: 20091278; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack V0.37 -> Dwing] binary file"; flow:established,to_server; content: "|0B01|";content: "|1810000010000000|"; distance: 9; within: 8;content: "|0010000000020000|"; distance: 12; within: 8;content: "|00000000|"; distance: 14; within: 4;content: "|000000000A0000000000000000000000|"; distance: 20; within: 16;content: "|14000000|"; distance: 18; within: 4;content: "|47657450726F63416464726573730000|"; distance: 24; within: 16;sid: 20091279; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack V0.37 -> Dwing] binary file"; flow:established,to_server; content: "|60E809000000|";content: "|33C95E870E|"; distance: 10; within: 5;sid: 20091280; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack V0.37 -> Dwing] binary file"; flow:established,to_server; content: "|BE|";content: "|AD50FF|"; distance: 3; within: 3;content: "|EB|"; distance: 4; within: 1;sid: 20091281; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack v0.37 beta -> Dwing] binary file"; flow:established,to_server; content: "|BEB011|";content: "|AD50FF7634EB7C4801|"; distance: 4; within: 9;content: "|0B014C6F61644C696272617279410000181000001000000000|"; distance: 10; within: 25;content: "|0000|"; distance: 26; within: 2;content: "|00100000000200000400000000003700040000000000000000|"; distance: 3; within: 25;content: "|0002000000000000|"; distance: 26; within: 8;sid: 20091282; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack v0.37 beta -> Dwing] binary file"; flow:established,to_server; content: "|BEB011|";content: "|AD50FF7634EB7C4801|"; distance: 4; within: 9;content: "|0B014C6F61644C696272617279410000181000001000000000|"; distance: 10; within: 25;content: "|0000|"; distance: 26; within: 2;content: "|00100000000200000400000000003700040000000000000000|"; distance: 3; within: 25;content: "|0002000000000000|"; distance: 26; within: 8;content: "|0000|"; distance: 8; within: 2;content: "|0000|"; distance: 2; within: 2;content: "|0000|"; distance: 2; within: 2;content: "|000000100000100000000000000A0000000000000000000000EE|"; distance: 3; within: 26;content: "|1400000000|"; distance: 27; within: 5;content: "|00FF7638AD508B3EBEF0|"; distance: 8; within: 10;content: "|6A2759F3A5FF760483C8FF8BDFABEB1C0000000047657450726F63416464726573730000|"; distance: 11; within: 36;content: "|00000040AB40B104F3ABC1E00AB5|"; distance: 38; within: 14;content: "|F3AB8B7E0C5751E9|"; distance: 14; within: 8;content: "|E3B104D3E003E88D531833C0554051D3E08BEA91FF564C33D259D1E813D2E2FA5D03EA4559896B08568BF72BF5F3A4AC5EB180AA3B7E340F828EFEFFFF585F59E31B8A074704183C0273F78B073C|"; distance: 10; within: 78;content: "|75F1B0000FC80346382BC7ABE2E55E5D59515946AD85C0741F|"; distance: 78; within: 25;sid: 20091283; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack v0.38 beta -> Dwing] binary file"; flow:established,to_server; content: "|BEB011|";content: "|AD50FF7634EB7C4801|"; distance: 4; within: 9;content: "|0B014C6F61644C696272617279410000181000001000000000|"; distance: 10; within: 25;content: "|0000|"; distance: 26; within: 2;content: "|00100000000200000400000000003800040000000000000000|"; distance: 3; within: 25;content: "|0002000000000000|"; distance: 26; within: 8;sid: 20091284; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack v0.38 beta -> Dwing] binary file"; flow:established,to_server; content: "|BEB011|";content: "|AD50FF7634EB7C4801|"; distance: 4; within: 9;content: "|0B014C6F61644C696272617279410000181000001000000000|"; distance: 10; within: 25;content: "|0000|"; distance: 26; within: 2;content: "|00100000000200000400000000003800040000000000000000|"; distance: 3; within: 25;content: "|0002000000000000|"; distance: 26; within: 8;content: "|0000|"; distance: 8; within: 2;content: "|0000|"; distance: 2; within: 2;content: "|0000|"; distance: 2; within: 2;content: "|000000100000100000000000000A0000000000000000000000EE|"; distance: 3; within: 26;content: "|1400000000|"; distance: 27; within: 5;content: "|00FF7638AD508B3EBEF0|"; distance: 8; within: 10;content: "|6A2759F3A5FF760483C8FF8BDFABEB1C0000000047657450726F63416464726573730000|"; distance: 11; within: 36;content: "|00000040AB40B104F3ABC1E00AB5|"; distance: 38; within: 14;content: "|F3AB8B7E0C5751E9|"; distance: 14; within: 8;content: "|E3B104D3E003E88D531833C0554051D3E08BEA91FF564C33D259D1E813D2E2FA5D03EA4559896B08568BF72BF5F3A4AC5EB180AA3B7E340F8297FEFFFF585F59E31B8A074704183C0273F78B073C|"; distance: 10; within: 78;content: "|75F1B0000FC80346382BC7ABE2E55E5D59515946AD85C0741F|"; distance: 78; within: 25;sid: 20091285; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack v0.399 -> Dwing] binary file"; flow:established,to_server; content: "|0B014C6F61644C696272617279410000181000001000000000|";content: "|000000400000100000000200000400000000003A00040000000000000000|"; distance: 26; within: 30;content: "|000002000000000000|"; distance: 31; within: 9;content: "|0000000000100000|"; distance: 9; within: 8;content: "|00000000100000100000000000000A0000000000000000000000EE|"; distance: 8; within: 27;content: "|001400000000|"; distance: 28; within: 6;content: "|00|"; distance: 7; within: 1;content: "|0000FF7638AD508B3EBEF0|"; distance: 2; within: 11;content: "|006A2759F3A5FF760483C8FF8BDFABEB1C0000000047657450726F63416464726573730000|"; distance: 12; within: 37;content: "|00|"; distance: 38; within: 1;content: "|00000040AB40B104F3ABC1E00AB5|"; distance: 1; within: 14;sid: 20091286; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack v0.399 -> Dwing] binary file"; flow:established,to_server; content: "|BEB011|";content: "|AD50FF7634EB7C4801|"; distance: 4; within: 9;content: "|0B014C6F61644C696272617279410000181000001000000000|"; distance: 10; within: 25;content: "|0000|"; distance: 26; within: 2;content: "|00100000000200000400000000003A00040000000000000000|"; distance: 3; within: 25;content: "|0002000000000000|"; distance: 26; within: 8;sid: 20091287; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack v0.399 -> Dwing] binary file"; flow:established,to_server; content: "|BEB011|";content: "|AD50FF7634EB7C4801|"; distance: 4; within: 9;content: "|0B014C6F61644C696272617279410000181000001000000000|"; distance: 10; within: 25;content: "|0000|"; distance: 26; within: 2;content: "|00100000000200000400000000003A00040000000000000000|"; distance: 3; within: 25;content: "|0002000000000000|"; distance: 26; within: 8;content: "|0000|"; distance: 8; within: 2;content: "|0000100000|"; distance: 2; within: 5;content: "|000000100000100000000000000A0000000000000000000000EE|"; distance: 6; within: 26;content: "|1400000000|"; distance: 27; within: 5;content: "|0000FF7638AD508B3EBEF0|"; distance: 7; within: 11;content: "|6A2759F3A5FF760483C8FF8BDFABEB1C0000000047657450726F63416464726573730000|"; distance: 12; within: 36;content: "|00000040AB40B104F3ABC1E00AB5|"; distance: 38; within: 14;content: "|F3AB8B7E0C5751E9|"; distance: 14; within: 8;content: "|5610E2E3B104D3E003E88D531833C0554051D3E08BEA91FF564C9959D1E813D2E2FA5D03EA4559896B08568BF72BF5F3A4AC5EB180AA3B|"; distance: 10; within: 55;sid: 20091288; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack_Patch -> Dwing] binary file"; flow:established,to_server; content: "|813A0000000200000000|";sid: 20091289; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack_Patch or any Version -> Dwing] binary file"; flow:established,to_server; content: "|60E809000000|";content: "|00E90602|"; distance: 7; within: 4;sid: 20091290; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upack_Unknown (DLL ???) -> Dwing] binary file"; flow:established,to_server; content: "|60E80900000017CD0000E90602|";sid: 20091291; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UPX + ECLiPSE layer] binary file"; flow:established,to_server; content: "|B8|";content: "|B9|"; distance: 3; within: 1;content: "|33D2EB010F56EB010FE803000000EB010FEB010F5EEB01|"; distance: 3; within: 23;sid: 20091292; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UPX 0.50 - 0.70] binary file"; flow:established,to_server; content: "|60E8000000005883E83D|";sid: 20091293; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UPX 0.72] binary file"; flow:established,to_server; content: "|60E80000000083CDFF31DB5E|";sid: 20091294; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UPX 2.90 [LZMA] (Delphi stub) -> Markus Oberhumer, Laszlo Molnar & John Reiser] binary file"; flow:established,to_server; content: "|60BE|";content: "|8DBE|"; distance: 4; within: 2;content: "|C787|"; distance: 4; within: 2;content: "|5783CDFF89E58D9C24|"; distance: 6; within: 9;content: "|31C05039DC75FB46465368|"; distance: 11; within: 11;content: "|5783C3045368|"; distance: 13; within: 6;content: "|5683C304|"; distance: 8; within: 4;sid: 20091295; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser] binary file"; flow:established,to_server; content: "|60BE|";content: "|8DBE|"; distance: 4; within: 2;content: "|5783CDFF89E58D9C24|"; distance: 4; within: 9;content: "|31C05039DC75FB46465368|"; distance: 11; within: 11;content: "|5783C3045368|"; distance: 13; within: 6;content: "|5683C3045350C703|"; distance: 8; within: 8;content: "|9090|"; distance: 10; within: 2;sid: 20091296; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser] binary file"; flow:established,to_server; content: "|60BE|";content: "|8DBE|"; distance: 4; within: 2;content: "|5783CDFFEB109090909090908A064688074701DB75078B1E83EEFC11DB72EDB80100000001DB75078B1E83EEFC11DB11C001DB|"; distance: 4; within: 51;sid: 20091297; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UPX 2.93 - 3.00 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser] binary file"; flow:established,to_server; content: "|60BE|";content: "|8DBE|"; distance: 4; within: 2;content: "|5789E58D9C24|"; distance: 4; within: 6;content: "|31C05039DC75FB46465368|"; distance: 8; within: 11;content: "|5783C3045368|"; distance: 13; within: 6;content: "|5683C3045350C703030002009090909090|"; distance: 8; within: 17;sid: 20091298; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UPX Alternative stub] binary file"; flow:established,to_server; content: "|01DB078B1E83EEFC11DBEDB80100000001DB078B1E83EEFC11DB11C001DB730B|";sid: 20091299; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UPX Modified stub] binary file"; flow:established,to_server; content: "|79070FB707475047B95748F2AE55FF9684|";content: "|000009C07407890383C304EBD8FF9688|"; distance: 17; within: 16;content: "|000061E9|"; distance: 16; within: 4;content: "|FF|"; distance: 5; within: 1;sid: 20091300; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UPX Modified Stub b -> Farb-rausch Consumer Consulting] binary file"; flow:established,to_server; content: "|60BE|";content: "|8DBE|"; distance: 4; within: 2;content: "|5783CDFFFCB28031DBA4B302E86D00000073F631C9E864000000731C31C0E85B0000007323B30241B010E84F00000010C073F7753FAAEBD4E84D00000029D97510E842000000EB28AC|"; distance: 4; within: 73;sid: 20091301; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UPX Modified Stub c -> Farb-rausch Consumer Consulting] binary file"; flow:established,to_server; content: "|60BE|";content: "|8DBE|"; distance: 4; within: 2;content: "|5783CDFFFCB280E8000000005B83C366A4FFD373FB31C9FFD3731431C0FFD3731D41B010FFD310C073FA753CAAEBE2E84A00000049E210E840000000EB28ACD1E8744511C9EB1C9148|"; distance: 4; within: 73;sid: 20091302; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UPX Modifier v0.1x] binary file"; flow:established,to_server; content: "|50BE|";content: "|8DBE|"; distance: 4; within: 2;content: "|5783CD|"; distance: 4; within: 3;sid: 20091303; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UPX Protector v1.0x] binary file"; flow:established,to_server; content: "|EBEC|";content: "|8A064688074701DB7507|"; distance: 4; within: 10;sid: 20091304; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UPX v1.03 - v1.04] binary file"; flow:established,to_server; content: "|8A064688074701DB75078B1E83EEFC11DB8A0772EBB80100000001DB75078B1E83EEFC11DB11C001DB73|";content: "|75|"; distance: 42; within: 1;content: "|8B1E83EEFC|"; distance: 1; within: 5;sid: 20091305; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UPX v1.03 - v1.04 Modified] binary file"; flow:established,to_server; content: "|01DB|";content: "|078B1E83EEFC11DB8A07|"; distance: 2; within: 10;content: "|EBB80100000001DB|"; distance: 10; within: 8;content: "|078B1E83EEFC11DB11C001DB73EF|"; distance: 8; within: 14;sid: 20091306; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upx v1.2 -> Marcus & Lazlo] binary file"; flow:established,to_server; content: "|60BE|";content: "|8DBE|"; distance: 4; within: 2;content: "|5783CDFFEB05A401DB75078B1E83EEFC11DB72F231C04001DB75078B1E83EEFC11DB11C001DB75078B1E83EEFC11DB73E631C983|"; distance: 4; within: 52;sid: 20091307; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Upx-Lock 1.0 - 1.2 --> CyberDoom / Team-X & BoB / BobSoft] binary file"; flow:established,to_server; content: "|60E8000000005D81ED4812400060E82B03000061|";sid: 20091308; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UPX-SCRAMBLER 3.06 -> ?OnT?oL] binary file"; flow:established,to_server; content: "|E8000000005983C10751C3C3BE|";content: "|83EC04893424B9800000008136|"; distance: 15; within: 13;content: "|50B80400000050033424585883E903E2E9EBD6|"; distance: 15; within: 19;sid: 20091309; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UPX-Scrambler RC v1.x] binary file"; flow:established,to_server; content: "|9061BE|";content: "|8DBE|"; distance: 5; within: 2;content: "|5783CDFF|"; distance: 4; within: 4;sid: 20091310; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UPX-Shit v0.1 -> 500mhz] binary file"; flow:established,to_server; content: "|E8000000005E83C614AD89C7AD89C1AD300747E2FBADFFE0C300|";content: "|00|"; distance: 27; within: 1;content: "|00|"; distance: 2; within: 1;content: "|01|"; distance: 2; within: 1;content: "|005550582D536869742076302E31202D207777772E626C61636B6C6F6769632E6E6574202D20636F6465206279|"; distance: 2; within: 45;sid: 20091311; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UPX-Shit v0.1 -> 500mhz] binary file"; flow:established,to_server; content: "|E8000000005E83C614AD89C7AD89C1AD300747E2FBADFFE0C300|";content: "|00|"; distance: 27; within: 1;content: "|00|"; distance: 2; within: 1;content: "|005550582D536869742076302E31202D207777772E626C61636B6C6F6769632E6E6574202D20636F6465206279|"; distance: 4; within: 45;sid: 20091312; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UPX-Shit v0.1 -> 500mhz] binary file"; flow:established,to_server; content: "|E8|";content: "|5E83C6|"; distance: 3; within: 3;content: "|AD89C7AD89C1AD300747E2|"; distance: 3; within: 11;content: "|ADFFE0C3|"; distance: 11; within: 4;sid: 20091313; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UPXcrypter -> archphase/NWC] binary file"; flow:established,to_server; content: "|BF|";content: "|0081FF|"; distance: 2; within: 3;content: "|007410812F|"; distance: 4; within: 5;content: "|00000083C704BB05|"; distance: 5; within: 8;content: "|00FFE3BE|"; distance: 9; within: 4;content: "|00FFE600000000|"; distance: 5; within: 7;sid: 20091314; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UPXFreak v0.1 (Borland Delphi) -> HMX0101] binary file"; flow:established,to_server; content: "|BE|";content: "|83C601FFE6000000|"; distance: 3; within: 8;content: "|0003000000|"; distance: 9; within: 5;content: "|001000000000|"; distance: 7; within: 6;content: "|0000|"; distance: 8; within: 2;content: "|F6|"; distance: 2; within: 1;content: "|00B24F4500|"; distance: 1; within: 5;content: "|F9|"; distance: 5; within: 1;content: "|00EF4F4500|"; distance: 1; within: 5;content: "|F6|"; distance: 5; within: 1;content: "|008CD14200|"; distance: 1; within: 5;content: "|56|"; distance: 5; within: 1;content: "|00|"; distance: 1; within: 1;content: "|00|"; distance: 2; within: 1;content: "|00|"; distance: 2; within: 1;content: "|00|"; distance: 2; within: 1;content: "|24|"; distance: 1; within: 1;content: "|00|"; distance: 1; within: 1;content: "|00|"; distance: 2; within: 1;sid: 20091315; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UPXFreak v0.1 (Borland Delphi) -> HMX0101] binary file"; flow:established,to_server; content: "|BE|";content: "|83C601FFE6000000|"; distance: 3; within: 8;content: "|0003000000|"; distance: 9; within: 5;content: "|001000000000|"; distance: 7; within: 6;content: "|0000|"; distance: 8; within: 2;content: "|F6|"; distance: 2; within: 1;content: "|00B24F4500|"; distance: 1; within: 5;content: "|F9|"; distance: 5; within: 1;content: "|00EF4F4500|"; distance: 1; within: 5;content: "|F6|"; distance: 5; within: 1;content: "|008CD14200|"; distance: 1; within: 5;content: "|56|"; distance: 5; within: 1;content: "|00|"; distance: 1; within: 1;content: "|00|"; distance: 2; within: 1;content: "|00|"; distance: 2; within: 1;content: "|00|"; distance: 2; within: 1;content: "|24|"; distance: 1; within: 1;content: "|00|"; distance: 1; within: 1;content: "|0034504500|"; distance: 2; within: 5;content: "|00FFFF0000|"; distance: 6; within: 5;content: "|24|"; distance: 5; within: 1;content: "|00|"; distance: 1; within: 1;content: "|24|"; distance: 1; within: 1;content: "|00|"; distance: 1; within: 1;content: "|00400000C00000|"; distance: 2; within: 7;content: "|0000|"; distance: 9; within: 2;content: "|000000|"; distance: 2; within: 3;content: "|1E|"; distance: 3; within: 1;content: "|00|"; distance: 1; within: 1;content: "|F7|"; distance: 1; within: 1;content: "|00A64E4300|"; distance: 1; within: 5;content: "|56|"; distance: 5; within: 1;content: "|00ADD14200|"; distance: 1; within: 5;content: "|F7|"; distance: 5; within: 1;content: "|00A1D24200|"; distance: 1; within: 5;content: "|56|"; distance: 5; within: 1;content: "|000B4D4300|"; distance: 1; within: 5;content: "|F7|"; distance: 5; within: 1;content: "|00|"; distance: 1; within: 1;content: "|F7|"; distance: 1; within: 1;content: "|00|"; distance: 1; within: 1;content: "|56|"; distance: 1; within: 1;content: "|00|"; distance: 1; within: 1;content: "|000000|"; distance: 3; within: 3;content: "|77|"; distance: 6; within: 1;content: "|00|"; distance: 2; within: 1;content: "|00|"; distance: 2; within: 1;content: "|77|"; distance: 2; within: 1;content: "|0000|"; distance: 2; within: 2;content: "|00|"; distance: 3; within: 1;content: "|0000|"; distance: 4; within: 2;content: "|00|"; distance: 3; within: 1;content: "|00|"; distance: 6; within: 1;content: "|00000000|"; distance: 3; within: 4;content: "|00|"; distance: 5; within: 1;sid: 20091316; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UPXFreak V0.1 -> HMX0101] binary file"; flow:established,to_server; content: "|BE|";content: "|83C601FFE60000|"; distance: 3; within: 7;sid: 20091317; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[UPXShit 0.06] binary file"; flow:established,to_server; content: "|B8|";content: "|4300B915000000803408|"; distance: 2; within: 10;content: "|E2FAE9D6FFFFFF|"; distance: 10; within: 7;sid: 20091318; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[USERNAME v3.00] binary file"; flow:established,to_server; content: "|FB2E|";content: "|2E|"; distance: 4; within: 1;content: "|2E|"; distance: 3; within: 1;content: "|2E|"; distance: 3; within: 1;content: "|8CC82BC18BC82E|"; distance: 3; within: 7;content: "|2E|"; distance: 9; within: 1;content: "|33C08ED8060E07FC33F6|"; distance: 3; within: 10;sid: 20091319; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[VBOX v4.2 MTE] binary file"; flow:established,to_server; content: "|8CE00BC58CE00BC403C5740074008BC5|";sid: 20091320; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[VcAsm Protector -> VcAsm] binary file"; flow:established,to_server; content: "|558BEC6AFF68|";content: "|68|"; distance: 8; within: 1;content: "|64A1000000005064892500000000E803000000C7840058EB01E983C00750C3|"; distance: 3; within: 31;sid: 20091321; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[VcAsm Protector V1.0X-> VcAsm] binary file"; flow:established,to_server; content: "|558BEC6AFF68|";content: "|68|"; distance: 8; within: 1;content: "|64A1000000005064892500000000E803000000|"; distance: 3; within: 19;sid: 20091322; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vcasm Protector V1.X -> vcasm] binary file"; flow:established,to_server; content: "|EB|";content: "|5B5650726F746563745D|"; distance: 1; within: 10;sid: 20091323; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vcasm-Protector 1.0] binary file"; flow:established,to_server; content: "|558BEC6AFF68|";content: "|0068|"; distance: 7; within: 2;content: "|0064A1000000005064892500000000E803000000C7840058EB01E983C00750C3FF35E803000000C7840058EB01E983C00750C3FF35E807000000C78383C013EB0B58EB02CD2083|"; distance: 3; within: 71;sid: 20091324; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vcasm-Protector 1.0e -> vcasm] binary file"; flow:established,to_server; content: "|EB0A5B5650726F746563745D|";sid: 20091325; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vcasm-Protector 1.1 - 1.2 -> vcasm] binary file"; flow:established,to_server; content: "|EB0B5B5650726F746563745D|";sid: 20091326; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[vfp&exeNc V5.00 -> Wang JianGuo] binary file"; flow:established,to_server; content: "|60E8000000005D|";content: "|5064FF350000000064892500000000CC|"; distance: 13; within: 16;sid: 20091327; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[vfp&exeNc v6.00 -> Wang JianGuo] binary file"; flow:established,to_server; content: "|60E8010000006358E8010000007A582D0D1040008D90C110400052508D80491040005D508D85651040005064FF350000000064892500000000CC|";sid: 20091328; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Video-Lan-Client] binary file"; flow:established,to_server; content: "|5589E583EC08|";content: "|FFFF|"; distance: 13; within: 2;sid: 20091329; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Video-Lan-Client -> (UnknownCompiler)] binary file"; flow:established,to_server; content: "|5589E583EC08|";content: "|FFFF|"; distance: 13; within: 2;content: "|00|"; distance: 11; within: 1;content: "|00|"; distance: 4; within: 1;sid: 20091330; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Virogen Crypt v0.75] binary file"; flow:established,to_server; content: "|9C55E8EC00000087D55D6087D580BD1527400001|";sid: 20091331; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Virogen`s PE Shrinker v0.14] binary file"; flow:established,to_server; content: "|9C55E8|";content: "|87D55D6087D58D|"; distance: 5; within: 7;content: "|8D|"; distance: 9; within: 1;content: "|5756AD0BC074|"; distance: 3; within: 6;sid: 20091332; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[VOB ProtectCD] binary file"; flow:established,to_server; content: "|5F81EF|";content: "|BE|"; distance: 5; within: 1;content: "|40|"; distance: 2; within: 1;content: "|8B87|"; distance: 1; within: 2;content: "|03C657568CA7|"; distance: 4; within: 6;content: "|FF108987|"; distance: 8; within: 4;content: "|5E5F|"; distance: 6; within: 2;sid: 20091333; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[VProtector 1.0X -> vcasm] binary file"; flow:established,to_server; content: "|558BEC6AFF68|";content: "|68|"; distance: 8; within: 1;content: "|64A1000000005064892500000000E803000000C7840058EB01E983C00750C3FF35E803000000C7840058EB01E983C00750C3FF35E807000000C78383C013EB0B58EB02CD2083C002EB01E950C3E8B904000000E81F000000EBFAE816000000E9EBF8000058EB090F25E8F2FFFFFF0FB94975F1EB05EBF9EBF0D6EB010F31F0EB0C33C8EB03EB090F59740575F851EBF1E8160000008B5C240C8BA3C4000000648F050000000083C404EB1464FF35000000006489250000000033C999F7F1E9E8050000|"; distance: 3; within: 195;sid: 20091334; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[VProtector 1.1X -> vcasm] binary file"; flow:established,to_server; content: "|EB0B5B5650726F746563745D00E8240000008B4424048B003D0400008075088B642408EB0458EB0CE9648F050000000074F375F1EB2464FF3500000000EB12FF9C74037501E9810C24000100009D90EBF464892500000000EBE6E8160000008B5C240C8BA3C4000000648F050000000083C404EB1464FF35000000006489250000000033C999F7F1E9E803000000C7840058EB01E983C00750C3FF35E8160000008B5C240C8BA3C4000000648F050000000083C404EB1464FF35000000006489250000000033C999F7F1E9E803000000C7840058EB01E983C00750C3|";sid: 20091335; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[vprotector 1.2 -> vcasm] binary file"; flow:established,to_server; content: "|EB0B5B5650726F746563745D00E8240000008B4424048B003D0400008075088B642408EB0458EB0CE9648F050000000074F375F1EB2464FF3500000000EB12FF9C74037501E9810C24000100009D90EBF464892500|";sid: 20091336; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[vprotector 1.2 -> vcasm] binary file"; flow:established,to_server; content: "|EB0B5B5650726F746563745D00E8240000008B4424048B003D0400008075088B642408EB0458EB0CE9648F050000000074F375F1EB2464FF3500000000EB12FF9C74037501E9810C24000100009D90EBF464892500000000EBE6E8160000008B5C240C8BA3C4000000648F050000000083C404EB1464FF35000000006489250000000033C999F7F1E9E803000000C7840058EB01E983C00750C3FF35E8160000008B5C240C8BA3C4000000648F050000000083C404EB1464FF35000000006489250000000033C999F7F1E9E803000000C7840058EB01E983C00750C3FF3533F6E8100000008B642408648F050000000058EB13C78364FF350000000064892500000000ADCD20E8050000000F01EB05E8EBFB000083C404E8080000000F0183C0|";sid: 20091337; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[VProtector 1.3X -> vcasm] binary file"; flow:established,to_server; content: "|E9B9160000558BEC81EC74040000576800000000680000C21468FFFF000068|";content: "|9C81|"; distance: 33; within: 2;content: "|9D54FF14246800000000680000C21068|"; distance: 7; within: 16;content: "|9C81|"; distance: 18; within: 2;content: "|9D54FF1424680000000068|"; distance: 7; within: 11;content: "|9C81|"; distance: 13; within: 2;content: "|9D54FF1424680000000068FFFFC21068|"; distance: 7; within: 16;content: "|9C81|"; distance: 18; within: 2;content: "|9D54FF1424680000000068|"; distance: 7; within: 11;content: "|9C81|"; distance: 13; within: 2;content: "|9D54FF14246800000000680000C21468FFFF000068|"; distance: 7; within: 21;content: "|9C81|"; distance: 23; within: 2;content: "|9D54FF1424680000000068|"; distance: 7; within: 11;content: "|9C81|"; distance: 13; within: 2;content: "|9D54FF14246800000000|"; distance: 7; within: 10;sid: 20091338; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[VProtector V1.0 [Build 2004.12.13] test! -> vcasm] binary file"; flow:established,to_server; content: "|558BEC6AFF681A894000685689400064A1000000005064892500000000E803000000C7840058EB01E983C00750|";sid: 20091339; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[VProtector V1.0A -> vcasm] binary file"; flow:established,to_server; content: "|558BEC6AFF688A8E400068C68E400064A1000000005064892500000000E803000000C7840058EB01E983C00750|";sid: 20091340; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[VProtector V1.0B -> vcasm] binary file"; flow:established,to_server; content: "|558BEC6AFF68CA374100680638410064A1000000005064892500000000E803000000C7840058EB01E983C00750|";sid: 20091341; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[VProtector V1.0D -> vcasm] binary file"; flow:established,to_server; content: "|558BEC6AFF68CA314100680632410064A1000000005064892500000000E803000000C7840058EB01E983C00750|";sid: 20091342; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[VProtector V1.0E -> vcasm] binary file"; flow:established,to_server; content: "|EB0A5B5650726F746563745DE8240000008B4424048B003D0400008075088B642408EB0458EB0CE9648F050000000074F375F1EB2464FF3500000000|";sid: 20091343; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[VProtector V1.1 -> vcasm] binary file"; flow:established,to_server; content: "|B81AED4100B9ECEB41005051E874000000E8516A00005883E810B9B3000000|";sid: 20091344; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[VProtector V1.1A -> vcasm] binary file"; flow:established,to_server; content: "|EB0B5B5650726F746563745D00E8240000008B4424048B003D0400008075088B642408EB0458EB0CE9648F0500000000|";sid: 20091345; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vterminal V1.0X -> Lei Peng] binary file"; flow:established,to_server; content: "|E8000000005805|";content: "|9C50C20400|"; distance: 9; within: 5;sid: 20091346; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: ACME (Clonewar Mutant)] binary file"; flow:established,to_server; content: "|FCAD3DFFFF7420E6428AC4E642E4610C03E661ADB9401FE2FE|";sid: 20091347; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: ARCV.4] binary file"; flow:established,to_server; content: "|E800005D81ED060181FC4F50740B8DB68601BF000157A4EB111E06|";sid: 20091348; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: August 16th (Iron Maiden)] binary file"; flow:established,to_server; content: "|BA790203D7B41ACD21B82435CD215F57899D4E028C855002|";sid: 20091349; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Backfont.900] binary file"; flow:established,to_server; content: "|E8|";content: "|B430CD213C03|"; distance: 2; within: 6;content: "|B8|"; distance: 7; within: 1;content: "|BA|"; distance: 2; within: 1;content: "|CD2181FA|"; distance: 2; within: 4;content: "|BA|"; distance: 6; within: 1;content: "|8CC0488EC08ED880|"; distance: 2; within: 8;content: "|5A|"; distance: 9; within: 1;content: "|03|"; distance: 2; within: 1;content: "|408ED880|"; distance: 2; within: 4;content: "|5A|"; distance: 5; within: 1;content: "|83|"; distance: 2; within: 1;sid: 20091350; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Caz.1204] binary file"; flow:established,to_server; content: "|E8|";content: "|5E83EE031E06B8FFFFCD2F3C10|"; distance: 2; within: 13;sid: 20091351; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: CIH Version 1.2 TTIT (! WIN95CIH !)] binary file"; flow:established,to_server; content: "|558D|";content: "|33DB648703E8|"; distance: 3; within: 6;content: "|5B8D|"; distance: 8; within: 2;sid: 20091352; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Compiler] binary file"; flow:established,to_server; content: "|8CC383C3102E011E|";content: "|022E031E|"; distance: 8; within: 4;content: "|02531E|"; distance: 4; within: 3;sid: 20091353; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Danish tiny] binary file"; flow:established,to_server; content: "|33C9B44ECD217302FF|";content: "|BA|"; distance: 9; within: 1;content: "|00B8|"; distance: 1; within: 2;content: "|3DCD21|"; distance: 2; within: 3;sid: 20091354; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Doom.666] binary file"; flow:established,to_server; content: "|E8|";content: "|5E83EE|"; distance: 2; within: 3;content: "|B8CF7BCD213DCF7B|"; distance: 3; within: 8;content: "|0E1F81C6|"; distance: 9; within: 4;content: "|BF|"; distance: 5; within: 1;content: "|B9|"; distance: 2; within: 1;content: "|FCF3A4061F06B8|"; distance: 2; within: 7;content: "|50CBB448BB2C00CD21|"; distance: 8; within: 9;sid: 20091355; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Eddie.1028] binary file"; flow:established,to_server; content: "|E8|";content: "|5EFC83|"; distance: 2; within: 3;content: "|81|"; distance: 4; within: 1;content: "|4D5A|"; distance: 2; within: 2;content: "|FA8BE681C4|"; distance: 3; within: 5;content: "|FB3B|"; distance: 6; within: 2;content: "|5006561EB8FE4BCD2181FFBB55|"; distance: 4; within: 13;content: "|07|"; distance: 14; within: 1;content: "|07B449CD21BBFFFFB448CD21|"; distance: 2; within: 12;sid: 20091356; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Eddie.1530] binary file"; flow:established,to_server; content: "|E8|";content: "|5E81EE|"; distance: 2; within: 3;content: "|FC2E|"; distance: 4; within: 2;content: "|4D5A|"; distance: 4; within: 2;content: "|FA8BE681C4|"; distance: 3; within: 5;content: "|FB3B|"; distance: 6; within: 2;content: "|2E|"; distance: 4; within: 1;content: "|5006561E33C0501FC4|"; distance: 3; within: 9;content: "|2E|"; distance: 10; within: 1;content: "|2E|"; distance: 3; within: 1;sid: 20091357; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Eddie.1800] binary file"; flow:established,to_server; content: "|E8|";content: "|5E81EE|"; distance: 2; within: 3;content: "|FC2E|"; distance: 4; within: 2;content: "|4D5A|"; distance: 4; within: 2;content: "|FA8BE681C4|"; distance: 3; within: 5;content: "|FB3B|"; distance: 6; within: 2;content: "|5006561E8BFE33C0508ED8C4|"; distance: 4; within: 12;content: "|2E|"; distance: 13; within: 1;content: "|2E|"; distance: 3; within: 1;sid: 20091358; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Eddie.2000] binary file"; flow:established,to_server; content: "|E8|";content: "|5E81EE|"; distance: 2; within: 3;content: "|FC2E|"; distance: 4; within: 2;content: "|2E|"; distance: 4; within: 1;content: "|4D5A|"; distance: 3; within: 2;content: "|FA8BE681C4|"; distance: 3; within: 5;content: "|FB3B|"; distance: 6; within: 2;content: "|5006561E8BFE33C0508ED8C5|"; distance: 4; within: 12;content: "|B430CD21|"; distance: 13; within: 4;sid: 20091359; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Eddie.2100] binary file"; flow:established,to_server; content: "|E8|";content: "|4F4F0EE8|"; distance: 2; within: 4;content: "|47471EFF|"; distance: 5; within: 4;content: "|CBE8|"; distance: 5; within: 2;content: "|84C0|"; distance: 3; within: 2;content: "|505356571E06B451CD218EC3|"; distance: 3; within: 12;content: "|8BF2B42FCD21AC|"; distance: 15; within: 7;sid: 20091360; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Eddie.based.1745] binary file"; flow:established,to_server; content: "|E8|";content: "|5E81EE|"; distance: 2; within: 3;content: "|FC|"; distance: 4; within: 1;content: "|2E|"; distance: 1; within: 1;content: "|4D5A|"; distance: 3; within: 2;content: "|FA|"; distance: 3; within: 1;content: "|8BE681|"; distance: 1; within: 3;content: "|FB|"; distance: 4; within: 1;content: "|3B|"; distance: 1; within: 1;content: "|5006|"; distance: 3; within: 2;content: "|561E8BFE33C0|"; distance: 2; within: 6;content: "|508ED8|"; distance: 6; within: 3;sid: 20091361; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Einstein] binary file"; flow:established,to_server; content: "|0042CD217231B96E0333D2B440CD2172193BC17515B80042|";sid: 20091362; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Explosion.1000] binary file"; flow:established,to_server; content: "|E8|";content: "|5E1E065081|"; distance: 2; within: 5;content: "|56FCB82135CD212E|"; distance: 6; within: 8;content: "|2E|"; distance: 10; within: 1;content: "|26|"; distance: 3; within: 1;content: "|74|"; distance: 4; within: 1;content: "|8CD8488ED8|"; distance: 1; within: 5;sid: 20091363; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: FaxFree.Topo] binary file"; flow:established,to_server; content: "|FA0633C08EC0B8|";content: "|26|"; distance: 8; within: 1;content: "|508CC826|"; distance: 3; within: 4;content: "|50CC589D5826|"; distance: 6; within: 6;content: "|5826|"; distance: 8; within: 2;content: "|07FB|"; distance: 4; within: 2;sid: 20091364; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Gotcha.879] binary file"; flow:established,to_server; content: "|E8|";content: "|5B81EB|"; distance: 2; within: 3;content: "|9CFC2E|"; distance: 4; within: 3;content: "|8CD805|"; distance: 6; within: 3;content: "|2E|"; distance: 4; within: 1;content: "|502E|"; distance: 3; within: 2;content: "|8BC305|"; distance: 5; within: 3;content: "|8BF0BF0001B92000F3A40EB8000150B8DADACD21|"; distance: 4; within: 20;sid: 20091365; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Grazie.883] binary file"; flow:established,to_server; content: "|1E0E1F5006BF7003B41ABA7003CD21B447B200BE3204CD21|";sid: 20091366; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: GRUNT.2.Family] binary file"; flow:established,to_server; content: "|48E2F7C3515352E8DDFF5A5B59C3B90000E2FEC3|";sid: 20091367; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: GRUNT.4.Family] binary file"; flow:established,to_server; content: "|E81C008D9E4101403E8B961403B9EA0087DBF7D0311783C302E2F7C3|";sid: 20091368; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Hafen.1641] binary file"; flow:established,to_server; content: "|E8|";content: "|01|"; distance: 2; within: 1;content: "|CECC25|"; distance: 2; within: 3;content: "|25|"; distance: 4; within: 1;content: "|25|"; distance: 2; within: 1;content: "|4051D4|"; distance: 2; within: 3;content: "|CC47CA|"; distance: 4; within: 3;content: "|468ACC4488CC|"; distance: 4; within: 6;sid: 20091369; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Hafen.809] binary file"; flow:established,to_server; content: "|E8|";content: "|1C|"; distance: 2; within: 1;content: "|81EE|"; distance: 1; within: 2;content: "|501E068CC88ED80633C08EC026|"; distance: 3; within: 13;content: "|073D|"; distance: 14; within: 2;sid: 20091370; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Haryanto] binary file"; flow:established,to_server; content: "|81EB2A018B0F1E5B03CB0E51B9100151CB|";sid: 20091371; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Heloween.1172] binary file"; flow:established,to_server; content: "|E8|";content: "|5E81EE|"; distance: 2; within: 3;content: "|5650060E1F8CC001|"; distance: 4; within: 8;content: "|01|"; distance: 9; within: 1;content: "|80|"; distance: 2; within: 1;content: "|8B|"; distance: 3; within: 1;content: "|A3|"; distance: 2; within: 1;content: "|8A|"; distance: 2; within: 1;content: "|A2|"; distance: 2; within: 1;content: "|B8|"; distance: 2; within: 1;content: "|CD213D|"; distance: 2; within: 3;sid: 20091372; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Horse.1776] binary file"; flow:established,to_server; content: "|E8|";content: "|5D83|"; distance: 2; within: 2;content: "|061E26|"; distance: 3; within: 3;content: "|BF|"; distance: 5; within: 1;content: "|1E0E1F8BF701EEB9|"; distance: 2; within: 8;content: "|FCF3A61F1E07|"; distance: 9; within: 6;sid: 20091373; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Hymn.1865] binary file"; flow:established,to_server; content: "|E8|";content: "|5E83EE4CFC2E|"; distance: 2; within: 6;content: "|4D5A|"; distance: 8; within: 2;content: "|FA8BE681|"; distance: 3; within: 4;content: "|FB3B|"; distance: 5; within: 2;content: "|2E|"; distance: 4; within: 1;content: "|5006561E0E1FB800C5CD21|"; distance: 3; within: 11;sid: 20091374; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Igor] binary file"; flow:established,to_server; content: "|1EB8CD7BCD2181FBCD7B7503E9870033DB0E1F8C|";sid: 20091375; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Involuntary.1349] binary file"; flow:established,to_server; content: "|BA|";content: "|B9|"; distance: 2; within: 1;content: "|8CDD|"; distance: 2; within: 2;content: "|8CC8|"; distance: 2; within: 2;content: "|8ED88EC033F68BFEFC|"; distance: 2; within: 9;content: "|AD|"; distance: 10; within: 1;content: "|33C2AB|"; distance: 1; within: 3;sid: 20091376; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: KBDflags.1024] binary file"; flow:established,to_server; content: "|8BEC2E892E2403BC00048CD52E892E22|";sid: 20091377; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Keypress.1212] binary file"; flow:established,to_server; content: "|E8|";content: "|E8|"; distance: 2; within: 1;content: "|E8|"; distance: 2; within: 1;content: "|E8|"; distance: 2; within: 1;content: "|E8|"; distance: 3; within: 1;content: "|E8|"; distance: 3; within: 1;content: "|EA|"; distance: 3; within: 1;content: "|1E33DB8EDBBB|"; distance: 3; within: 6;sid: 20091378; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Kuku.448] binary file"; flow:established,to_server; content: "|AE75EDE2F8893E|";content: "|BA|"; distance: 8; within: 1;content: "|0E07BF|"; distance: 2; within: 3;content: "|EB|"; distance: 4; within: 1;sid: 20091379; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Kuku.886] binary file"; flow:established,to_server; content: "|061E508CC88ED8BA7003B82425CD21|";content: "|90B42FCD2153|"; distance: 17; within: 6;sid: 20091380; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Modification of Hi.924] binary file"; flow:established,to_server; content: "|505351521E069CB82135CD2153BB|";content: "|26|"; distance: 15; within: 1;content: "|49485B|"; distance: 2; within: 3;sid: 20091381; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: MTE (non-encrypted)] binary file"; flow:established,to_server; content: "|F7D980E1FE7502494997A3|";content: "|03C124FE750248|"; distance: 12; within: 7;sid: 20091382; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Ncu-Li.1688] binary file"; flow:established,to_server; content: "|0E1EB855AACD213D494C74|";content: "|0E0E1F07E8|"; distance: 11; within: 5;sid: 20091383; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Necropolis] binary file"; flow:established,to_server; content: "|50FCAD33C2AB8BD0E2F8|";sid: 20091384; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Necropolis.1963] binary file"; flow:established,to_server; content: "|B430CD213C03|";content: "|B80012CD2F3CFFB8|"; distance: 7; within: 8;content: "|B44ABB4001CD21|"; distance: 10; within: 7;content: "|FA0E17BC|"; distance: 8; within: 4;content: "|E8|"; distance: 5; within: 1;content: "|FBA1|"; distance: 2; within: 2;content: "|0BC0|"; distance: 3; within: 2;sid: 20091385; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Noon.1163] binary file"; flow:established,to_server; content: "|E8|";content: "|5B5056B4CBCD213C07|"; distance: 2; within: 9;content: "|81|"; distance: 10; within: 1;content: "|2E|"; distance: 2; within: 1;content: "|4D5A|"; distance: 2; within: 2;content: "|BF000189DEFC|"; distance: 3; within: 6;sid: 20091386; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: November 17.768] binary file"; flow:established,to_server; content: "|E8|";content: "|5E81EE|"; distance: 2; within: 3;content: "|5033C08ED8803E|"; distance: 4; within: 7;content: "|0E1F|"; distance: 8; within: 2;content: "|FC|"; distance: 3; within: 1;sid: 20091387; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Number One] binary file"; flow:established,to_server; content: "|F9073C536D696C653EE8|";sid: 20091388; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Phoenix.927] binary file"; flow:established,to_server; content: "|E800005E81C6|";content: "|BF0001B90400F3A4E8|"; distance: 7; within: 9;sid: 20091389; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Predator.2448] binary file"; flow:established,to_server; content: "|0E1FBF|";content: "|B8|"; distance: 4; within: 1;content: "|B9|"; distance: 2; within: 1;content: "|49|"; distance: 2; within: 1;content: "|2AC14F4F|"; distance: 3; within: 4;content: "|F9CC|"; distance: 5; within: 2;sid: 20091390; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Quake.518] binary file"; flow:established,to_server; content: "|1E068CC88ED8|";content: "|B82135CD2181|"; distance: 9; within: 6;sid: 20091391; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: SK] binary file"; flow:established,to_server; content: "|CD20B80300CD1051E800005E83EE09|";sid: 20091392; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Slowload] binary file"; flow:established,to_server; content: "|03D6B440CD21B8024233D233C9CD218BD6B97801|";sid: 20091393; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Sonik Youth] binary file"; flow:established,to_server; content: "|8A1602008A0732C2880743FEC281FB|";sid: 20091394; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Spanz] binary file"; flow:established,to_server; content: "|E800005E81EE|";content: "|8D94|"; distance: 7; within: 2;content: "|B41ACD21C784|"; distance: 3; within: 6;sid: 20091395; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: SYP] binary file"; flow:established,to_server; content: "|478BC2051E00528BD0B8023DCD218BD85A|";sid: 20091396; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[VX: Tibs/Zhelatin "StormWorm" variant] binary file"; flow:established,to_server; content: "|FF74241C588D80|";content: "|7704506862343504E8|"; distance: 8; within: 9;sid: 20091397; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: TravJack.883] binary file"; flow:established,to_server; content: "|EB|";content: "|9C9E26|"; distance: 1; within: 3;content: "|5104|"; distance: 4; within: 2;content: "|7D|"; distance: 2; within: 1;content: "|00|"; distance: 1; within: 1;content: "|2E|"; distance: 1; within: 1;content: "|8CC88EC08ED880|"; distance: 3; within: 7;content: "|74|"; distance: 9; within: 1;content: "|8A|"; distance: 1; within: 1;content: "|BB|"; distance: 2; within: 1;content: "|8A|"; distance: 2; within: 1;content: "|32C288|"; distance: 1; within: 3;content: "|FEC24381|"; distance: 3; within: 4;sid: 20091398; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Trivial.25] binary file"; flow:established,to_server; content: "|B44EFEC6CD21B8|";content: "|3DBA|"; distance: 7; within: 2;content: "|00CD2193B440CD|"; distance: 2; within: 7;sid: 20091399; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Trivial.46] binary file"; flow:established,to_server; content: "|B44EB120BA|";content: "|CD21BA|"; distance: 6; within: 3;content: "|B8|"; distance: 4; within: 1;content: "|3DCD21|"; distance: 1; within: 3;sid: 20091400; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Trojan.Telefoon] binary file"; flow:established,to_server; content: "|601EE83B01BFCC012E033ECA012EC705|";sid: 20091401; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: Uddy.2617] binary file"; flow:established,to_server; content: "|2E|";content: "|2E|"; distance: 3; within: 1;content: "|2E|"; distance: 3; within: 1;content: "|8CC88ED88C|"; distance: 2; within: 5;content: "|2B|"; distance: 6; within: 1;content: "|03|"; distance: 2; within: 1;content: "|A3|"; distance: 2; within: 1;content: "|A1|"; distance: 2; within: 1;content: "|A3|"; distance: 2; within: 1;content: "|A1|"; distance: 2; within: 1;content: "|A3|"; distance: 2; within: 1;content: "|8CC82B|"; distance: 2; within: 3;content: "|03|"; distance: 4; within: 1;content: "|A3|"; distance: 2; within: 1;content: "|B8AB9CCD2F3D7698|"; distance: 2; within: 8;sid: 20091402; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: VCL] binary file"; flow:established,to_server; content: "|ACB90080F2AEB90400ACAE75|";content: "|E2FA89|"; distance: 12; within: 3;sid: 20091403; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: VCL (encrypted)] binary file"; flow:established,to_server; content: "|01B9|";content: "|8134|"; distance: 3; within: 2;content: "|4646E2F8C3|"; distance: 3; within: 5;sid: 20091404; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: VCL (encrypted)] binary file"; flow:established,to_server; content: "|01B9|";content: "|8135|"; distance: 3; within: 2;content: "|4747E2F8C3|"; distance: 3; within: 5;sid: 20091405; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: VirusConstructor(IVP).based] binary file"; flow:established,to_server; content: "|E9|";content: "|E8|"; distance: 2; within: 1;content: "|5D|"; distance: 2; within: 1;content: "|81ED|"; distance: 3; within: 2;content: "|E8|"; distance: 5; within: 1;content: "|81FC|"; distance: 2; within: 2;content: "|8D|"; distance: 4; within: 1;content: "|BF|"; distance: 2; within: 1;content: "|57A4A5|"; distance: 2; within: 3;sid: 20091406; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: VirusConstructor.based] binary file"; flow:established,to_server; content: "|BB|";content: "|B9|"; distance: 2; within: 1;content: "|2E|"; distance: 2; within: 1;content: "|4343|"; distance: 3; within: 2;content: "|8BECCC8B|"; distance: 3; within: 4;content: "|81|"; distance: 5; within: 1;content: "|061EB8|"; distance: 2; within: 3;content: "|CD213D|"; distance: 4; within: 3;content: "|8CD8488ED8|"; distance: 5; within: 5;sid: 20091407; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: VirusConstructor.based] binary file"; flow:established,to_server; content: "|E8|";content: "|5D81|"; distance: 2; within: 2;content: "|061EE8|"; distance: 3; within: 3;content: "|E8|"; distance: 4; within: 1;content: "|2E|"; distance: 3; within: 1;content: "|B44ABBFFFFCD2183|"; distance: 4; within: 8;content: "|B44ACD21|"; distance: 9; within: 4;sid: 20091408; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: XPEH.4768] binary file"; flow:established,to_server; content: "|E8|";content: "|5B81|"; distance: 2; within: 2;content: "|5056572E|"; distance: 3; within: 4;content: "|2E|"; distance: 6; within: 1;content: "|B8010050B8|"; distance: 4; within: 5;content: "|50E8|"; distance: 6; within: 2;sid: 20091409; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Vx: XRCV.1015] binary file"; flow:established,to_server; content: "|E8|";content: "|5E83|"; distance: 2; within: 2;content: "|53511E06B499CD2180FC21|"; distance: 3; within: 11;content: "|33C0508CD8488EC01FA1|"; distance: 13; within: 10;content: "|8B|"; distance: 11; within: 1;sid: 20091410; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[W32.Jeefo (PE File Infector)] binary file"; flow:established,to_server; content: "|5589E583EC0883C4F46A02A1C8|";content: "|FFD0E8|"; distance: 14; within: 3;content: "|C9C3|"; distance: 5; within: 2;sid: 20091411; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WARNING -> TROJAN -> ADinjector] binary file"; flow:established,to_server; content: "|9061BE002044008DBE00F0FBFFC7879CE004006AF08A5E5783CDFFEB0E|";sid: 20091412; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WARNING -> TROJAN -> HuiGeZi] binary file"; flow:established,to_server; content: "|558BEC81C4|";content: "|FEFFFF53565733C08985|"; distance: 5; within: 10;content: "|FEFFFF|"; distance: 10; within: 3;sid: 20091413; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WARNING -> TROJAN -> RobinPE] binary file"; flow:established,to_server; content: "|606A006A206A026A006A0368000000|";sid: 20091414; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WARNING -> TROJAN -> XiaoHui] binary file"; flow:established,to_server; content: "|609CE8000000005DB8|";content: "|8540002D|"; distance: 9; within: 4;content: "|854000|"; distance: 4; within: 3;sid: 20091415; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Warning! may be SimbyOZ polycryptor by 3xpl01t ver 2.xx (25.03.2007 22:00)] binary file"; flow:established,to_server; content: "|57578D7C240450B800D01713AB585FC30000|";sid: 20091416; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WebCops [DLL] -> LINK Data Security] binary file"; flow:established,to_server; content: "|A8BE58DCD6CCC4634A0FE002BBCEF35C5023FB62E73D2B|";sid: 20091417; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WebCops [EXE] -> LINK Data Security] binary file"; flow:established,to_server; content: "|EB0305EB02EBFC55EB03EB0405EBFBEB53E80400000072|";sid: 20091418; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Werus Crypter 1.0 - by Kas] binary file"; flow:established,to_server; content: "|BBE8124000803305E97DFFFFFF|";sid: 20091419; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WIBU-Key V4.10A -> http://wibu.com/us/] binary file"; flow:established,to_server; content: "|F705|";content: "|FF0000007512|"; distance: 4; within: 6;sid: 20091420; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Wind of Crypt 1.0 - by DarkPressure] binary file"; flow:established,to_server; content: "|558BEC83C4EC53|";content: "|8945ECB864400010E828EAFFFF33C05568CE51001064|"; distance: 9; within: 22;content: "|206A0068800000006A036A006A0168000000808D55EC33C0E8F6DBFFFF8B45ECE812E7FFFF50E83CEAFFFF8BD883FBFF0F84A60000006A0053E841EAFFFF8BF081EE005E00006A006A0068005E000053E852EAFFFFB8F49700108BD6E82EE7FFFFB8F89700108BD6E822E7FFFF8BC6E8ABD8FFFF8BF86A0068F097001056A1F49700105053E805EAFFFF53E8CFE9FFFFB8FC970010BAE8510010E874EAFFFFA1F497001085C0740583E8048B0050B9F8970010B8FC9700108B15F4970010E8D8EAFFFFB8FC970010E85AEBFFFF8BCE8B15F89700108BC7E8EBE9FFFF8BC785C07405E8E4EBFFFF33C05A595964891068D55100108D45ECE8BBE5FFFFC3E9A9DFFFFFEBF05F5E5BE8B7E4FFFF000000FFFFFFFF0A000000635A6C5630556C6B704D|"; distance: 24; within: 289;sid: 20091421; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Winkript v1.0] binary file"; flow:established,to_server; content: "|33C08BB800|";content: "|8B9004|"; distance: 6; within: 3;content: "|85FF741B33C950EB0C8A0439C0C804341B880439413BCA72F058|"; distance: 4; within: 26;sid: 20091422; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WinKript v1.0 -> Mr. Crimson] binary file"; flow:established,to_server; content: "|33C08BB800|";content: "|8B9004|"; distance: 6; within: 3;content: "|85FF741B33C950EB0C8A0439C0C804341B880439413BCA72F05883C008EBD561E9|"; distance: 4; within: 33;content: "|00000000000000000000000000000000000000000000000000000000000000000000|"; distance: 35; within: 34;sid: 20091423; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WinRAR 32-bit SFX Module] binary file"; flow:established,to_server; content: "|E9|";content: "|000000000000909090|"; distance: 2; within: 9;content: "|00|"; distance: 12; within: 1;content: "|00|"; distance: 1; within: 1;content: "|FF|"; distance: 3; within: 1;sid: 20091424; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WinUpack v0.39 final (relocated image base) -> By Dwing (c)2005 (h2)] binary file"; flow:established,to_server; content: "|60E809000000|";content: "|00E90602000033C95E870EE3F42BF18BDEAD2BD8AD03C35097AD91F3A55EAD5691011EADE2FBAD8D6E10015D008D7D1CB5|"; distance: 7; within: 49;content: "|F3AB5EAD53505197588D54855CFF1672572C037302B0003C0772|"; distance: 49; within: 26;sid: 20091425; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WinUpack v0.39 final -> By Dwing (c)2005 (h1)] binary file"; flow:established,to_server; content: "|BEB011|";content: "|AD50FF7634EB7C4801|"; distance: 4; within: 9;content: "|0B014C6F61644C696272617279410000181000001000000000|"; distance: 10; within: 25;content: "|0000|"; distance: 26; within: 2;content: "|00100000000200000400000000003900040000000000000000|"; distance: 3; within: 25;content: "|0002000000000000|"; distance: 26; within: 8;sid: 20091426; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WinZip (32-bit) 6.x] binary file"; flow:established,to_server; content: "|FF15FC814000B12238087402B120408038007410|";sid: 20091427; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WinZip 32-bit SFX v6.x module] binary file"; flow:established,to_server; content: "|FF15|";content: "|00B12238087402B120408038007410380874064080380075F680380074014033C9|"; distance: 3; within: 33;content: "|FF15|"; distance: 35; within: 2;sid: 20091428; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WinZip 32-bit SFX v8.x module] binary file"; flow:established,to_server; content: "|53FF15|";content: "|00B3223818740380C3FE8A48014033D23ACA740A3ACB74068A480140EBF23810740140|"; distance: 4; within: 35;content: "|FF15|"; distance: 37; within: 2;sid: 20091429; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WinZip Self-Extractor 2.2 personal edition -> WinZip Computing] binary file"; flow:established,to_server; content: "|53FF1558704000B3223818740380C3FE4033D28A083ACA74103ACB7407408A083ACA75F5381074014052505252FF155C70400050E815FBFFFF50FF158C7040005B|";sid: 20091430; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Wise Installer Stub] binary file"; flow:established,to_server; content: "|558BEC81EC780500005356BE04010000578D8594FDFFFF5633DB5053FF15342040008D8594FDFFFF56508D8594FDFFFF50FF15302040008B3D2C20400053536A03536A018D8594FDFFFF680000008050FFD783F8FF|";sid: 20091431; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Wise Installer Stub] binary file"; flow:established,to_server; content: "|558BEC81EC|";content: "|0400005356576A|"; distance: 5; within: 7;content: "|FF15|"; distance: 10; within: 2;content: "|4000|"; distance: 3; within: 2;content: "|80|"; distance: 30; within: 1;content: "|20|"; distance: 1; within: 1;sid: 20091432; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Wise Installer Stub v1.10.1029.1] binary file"; flow:established,to_server; content: "|558BEC81EC400F00005356576A04FF15F4304000FF15743040008A088945E880F92275488A4801408945E833F684C9740E80F92274098A4801408945E8EBEE8038227504408945E880382075094080382074FA8945|";sid: 20091433; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WWPACK v3.00, v3.01 (Extractable)] binary file"; flow:established,to_server; content: "|B8|";content: "|8CCA03D08CC981C1|"; distance: 2; within: 8;content: "|516A|"; distance: 9; within: 2;content: "|06068CD383|"; distance: 2; within: 5;content: "|536A|"; distance: 6; within: 2;content: "|FC|"; distance: 2; within: 1;sid: 20091434; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WWPACK v3.00, v3.01 (Relocations pack)] binary file"; flow:established,to_server; content: "|BE|";content: "|BA|"; distance: 2; within: 1;content: "|BF|"; distance: 2; within: 1;content: "|B9|"; distance: 2; within: 1;content: "|8CCD8EDD81ED|"; distance: 2; within: 6;content: "|06068BDD2BDA8BD3FC|"; distance: 7; within: 9;sid: 20091435; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WWPACK v3.02, v3.02a (Extractable)] binary file"; flow:established,to_server; content: "|B8|";content: "|8CCA03D08CC981C1|"; distance: 2; within: 8;content: "|5133C9B1|"; distance: 9; within: 4;content: "|510606BB|"; distance: 4; within: 4;content: "|538CD3|"; distance: 5; within: 3;sid: 20091436; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WWPACK v3.02, v3.02a, v3.04 (Relocations pack)] binary file"; flow:established,to_server; content: "|BE|";content: "|BF|"; distance: 2; within: 1;content: "|B9|"; distance: 2; within: 1;content: "|8CCD81ED|"; distance: 2; within: 4;content: "|8BDD81EB|"; distance: 5; within: 4;content: "|8BD3FCFA1E8EDB011533C02EAC|"; distance: 5; within: 13;sid: 20091437; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WWPACK v3.03] binary file"; flow:established,to_server; content: "|B8|";content: "|8CCA03D08CC981C1|"; distance: 2; within: 8;content: "|51B9|"; distance: 9; within: 2;content: "|510606BB|"; distance: 3; within: 4;content: "|53|"; distance: 5; within: 1;sid: 20091438; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WWPACK v3.05c4 (Extr. Passw.check. Vir. shield)] binary file"; flow:established,to_server; content: "|0305C01AB8|";content: "|8CCA03D08CC981C1|"; distance: 6; within: 8;content: "|51B9|"; distance: 9; within: 2;content: "|510606B1|"; distance: 3; within: 4;content: "|518CD3|"; distance: 4; within: 3;sid: 20091439; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WWPACK v3.05c4 (Extractable + Password checking)] binary file"; flow:established,to_server; content: "|0305801AB8|";content: "|8CCA03D08CC981C1|"; distance: 6; within: 8;content: "|51B9|"; distance: 9; within: 2;content: "|510606B1|"; distance: 3; within: 4;content: "|518CD3|"; distance: 4; within: 3;sid: 20091440; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WWPACK v3.05c4 (Extractable + Virus Shield)] binary file"; flow:established,to_server; content: "|0305401AB8|";content: "|8CCA03D08CC981C1|"; distance: 6; within: 8;content: "|51B9|"; distance: 9; within: 2;content: "|510606B1|"; distance: 3; within: 4;content: "|518CD3|"; distance: 4; within: 3;sid: 20091441; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WWPACK v3.05c4 (Extractable)] binary file"; flow:established,to_server; content: "|0305001AB8|";content: "|8CCA03D08CC981C1|"; distance: 6; within: 8;content: "|51B9|"; distance: 9; within: 2;content: "|510606B1|"; distance: 3; within: 4;content: "|518CD3|"; distance: 4; within: 3;sid: 20091442; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WWPACK v3.05c4 (Modified)] binary file"; flow:established,to_server; content: "|B8|";content: "|8CCA03D08CC981C1|"; distance: 2; within: 8;content: "|51B9|"; distance: 9; within: 2;content: "|510606B1|"; distance: 3; within: 4;content: "|518CD3|"; distance: 4; within: 3;sid: 20091443; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WWPACK v3.05c4 (Unextr. Passw.check. Vir. shield)] binary file"; flow:established,to_server; content: "|0305C01BB8|";content: "|8CCA03D08CC981C1|"; distance: 6; within: 8;content: "|51B9|"; distance: 9; within: 2;content: "|510606B1|"; distance: 3; within: 4;content: "|518CD3|"; distance: 4; within: 3;sid: 20091444; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WWPACK v3.05c4 (Unextractable + Password checking)] binary file"; flow:established,to_server; content: "|0305801BB8|";content: "|8CCA03D08CC981C1|"; distance: 6; within: 8;content: "|51B9|"; distance: 9; within: 2;content: "|510606B1|"; distance: 3; within: 4;content: "|518CD3|"; distance: 4; within: 3;sid: 20091445; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WWPACK v3.05c4 (Unextractable + Virus Shield)] binary file"; flow:established,to_server; content: "|0305401BB8|";content: "|8CCA03D08CC981C1|"; distance: 6; within: 8;content: "|51B9|"; distance: 9; within: 2;content: "|510606B1|"; distance: 3; within: 4;content: "|518CD3|"; distance: 4; within: 3;sid: 20091446; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WWPACK v3.05c4 (Unextractable)] binary file"; flow:established,to_server; content: "|0305001BB8|";content: "|8CCA03D08CC981C1|"; distance: 6; within: 8;content: "|51B9|"; distance: 9; within: 2;content: "|510606B1|"; distance: 3; within: 4;content: "|518CD3|"; distance: 4; within: 3;sid: 20091447; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WWPack32 v1.00, v1.11, v1.12, v1.20] binary file"; flow:established,to_server; content: "|53558BE833DBEB600D0A0D0A57575061636B3332|";sid: 20091448; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[WWPack32 v1.x] binary file"; flow:established,to_server; content: "|53558BE833DBEB60|";sid: 20091449; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[X-Hider 1.0 -> GlobaL] binary file"; flow:established,to_server; content: "|558BEC83C4EC33C08945ECB854204444E8DFF8FFFF33C055680821444464FF306489208D55ECB81C214444E8E0F9FFFF8B55ECB840|";content: "|44E88BF5FFFF6A006A006A026A006A016800000040A140|"; distance: 54; within: 23;content: "|44E87EF6FFFF50E84CF9FFFF6A0050E84CF9FFFFA328|"; distance: 24; within: 22;content: "|44E8CEFEFFFF33C05A5959648910680F2144448D45ECE8F1F4FFFFC3E9BBF2FFFFEBF0E8FCF3FFFFFFFFFFFF0E000000633A5C303030303030312E64617400|"; distance: 23; within: 63;sid: 20091450; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[X-PEOR v0.99b] binary file"; flow:established,to_server; content: "|E8000000005D8BCD81ED7A29400089AD0F6D4000|";sid: 20091451; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[X-PEOR v0.99b] binary file"; flow:established,to_server; content: "|E8|";content: "|5D8BCD81ED7A2940|"; distance: 3; within: 8;content: "|89AD0F6D40|"; distance: 8; within: 5;sid: 20091452; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[XCR v0.12] binary file"; flow:established,to_server; content: "|609CE8|";content: "|8BDD5D81ED|"; distance: 5; within: 5;content: "|899D|"; distance: 7; within: 2;sid: 20091453; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[XCR v0.13] binary file"; flow:established,to_server; content: "|937108|";content: "|8BD878E2|"; distance: 7; within: 4;content: "|9C33C3|"; distance: 6; within: 3;content: "|6079CE|"; distance: 5; within: 3;content: "|E801|"; distance: 5; within: 2;content: "|83C404E8ABFFFFFF|"; distance: 4; within: 8;content: "|2BE8|"; distance: 10; within: 2;content: "|03C5FF30|"; distance: 4; within: 4;content: "|C6|"; distance: 6; within: 1;content: "|EB|"; distance: 1; within: 1;sid: 20091454; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[XJ / XPAL -> LiNSoN] binary file"; flow:established,to_server; content: "|558BEC6AFF68|";content: "|400068|"; distance: 7; within: 3;content: "|400064A100000000506489250000000083EC44535657669C|"; distance: 4; within: 24;sid: 20091455; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[XPack 1.52 - 1.64] binary file"; flow:established,to_server; content: "|8BECFA33C08ED0BC|";content: "|2E|"; distance: 9; within: 1;content: "|2E|"; distance: 3; within: 1;content: "|EB|"; distance: 3; within: 1;sid: 20091456; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[XPack 1.67] binary file"; flow:established,to_server; content: "|B88CD3153375813EE80F009AE8F9FF9A9CEB019A5980CD01519DEB|";sid: 20091457; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[xPEP 0.3x -> xIkUg] binary file"; flow:established,to_server; content: "|555356515257E816000000|";sid: 20091458; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Xtreme-Protector v1.05] binary file"; flow:established,to_server; content: "|E9|";content: "|0000000000000000|"; distance: 2; within: 8;sid: 20091459; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Xtreme-Protector v1.06] binary file"; flow:established,to_server; content: "|B8|";content: "|00B975|"; distance: 2; within: 3;content: "|005051E805000000E94A010000608B7424248B7C2428FCB2808A0646880747BB0200000002D275058A164612D273EA02D275058A164612D2734F33C002D275058A164612D20F83DF00000002|"; distance: 4; within: 76;sid: 20091460; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[XXPack 0.1 -> bagie] binary file"; flow:established,to_server; content: "|E8040000008360EB0C5DEB054555EB04B8EBF900C3E8000000005DEB010081ED5E1F4000EB0283098DB5EF1F4000EB028309BAA3110000EB006800|";content: "|C3|"; distance: 60; within: 1;sid: 20091461; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[y0da's Crypter v1.0] binary file"; flow:established,to_server; content: "|60E8000000005D81EDE71A4000E8A1000000E8D1000000E885010000F785|";sid: 20091462; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[y0da's Crypter v1.1] binary file"; flow:established,to_server; content: "|60E8000000005D81ED8A1C4000B99E0000008DBD4C2340008BF733|";sid: 20091463; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[y0da's Crypter v1.2] binary file"; flow:established,to_server; content: "|60E8000000005D81EDF31D4000B97B0900008DBD3B1E40008BF7AC|";content: "|AAE2CC|"; distance: 51; within: 3;sid: 20091464; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[y0da's Crypter v1.x / Modified] binary file"; flow:established,to_server; content: "|60E8000000005D81ED|";content: "|B9|"; distance: 11; within: 1;content: "|00008DBD|"; distance: 2; within: 4;content: "|8BF7AC|"; distance: 6; within: 3;sid: 20091465; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[yoda's Crypter 1.3 -> Ashkbiz Danehkar] binary file"; flow:established,to_server; content: "|558BEC53565760E8000000005D81ED6C284000B95D34400081E9C62840008BD581C2C62840008D3A8BF733C0EB0490EB01C2AC|";sid: 20091466; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[yoda's Protector 1.02 - 1.03 -> Ashkbiz Danehkar] binary file"; flow:established,to_server; content: "|E803000000EB01|";content: "|BB55000000E803000000EB01|"; distance: 7; within: 12;content: "|E88F000000E803000000EB01|"; distance: 12; within: 12;content: "|E882000000E803000000EB01|"; distance: 12; within: 12;content: "|E8B8000000E803000000EB01|"; distance: 12; within: 12;content: "|E8AB0000|"; distance: 12; within: 4;sid: 20091467; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[yoda's Protector 1.02 -> Ashkibiz Danehlar] binary file"; flow:established,to_server; content: "|E803000000EB01|";content: "|BB55000000E803000000EB01|"; distance: 7; within: 12;content: "|E88F000000E803000000EB01|"; distance: 12; within: 12;content: "|E882000000E803000000EB01|"; distance: 12; within: 12;content: "|E8B8000000E803000000EB01|"; distance: 12; within: 12;content: "|E8AB000000E803000000EB01|"; distance: 12; within: 12;content: "|83FB55E803000000EB01|"; distance: 12; within: 10;content: "|75|"; distance: 10; within: 1;sid: 20091468; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[yoda's Protector 1.0x -> Ashkbiz Danehkar] binary file"; flow:established,to_server; content: "|558BEC535657E803000000EB01|";sid: 20091469; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[yoda's Protector v1.01 -> Ashkbiz Danehkar] binary file"; flow:established,to_server; content: "|558BEC535657E803000000EB01|";content: "|E886000000E803000000EB01|"; distance: 13; within: 12;content: "|E879000000E803000000EB01|"; distance: 12; within: 12;content: "|E8A4000000E803000000EB01|"; distance: 12; within: 12;content: "|E897000000E803000000EB01|"; distance: 12; within: 12;content: "|E82D000000E803000000EB01|"; distance: 12; within: 12;content: "|60E800000000|"; distance: 12; within: 6;sid: 20091470; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[yoda's Protector V1.01 -> Ashkbiz Danehkar] binary file"; flow:established,to_server; content: "|558BEC535657E803000000EB01|";content: "|E886000000E803000000EB01|"; distance: 13; within: 12;content: "|E879000000E803000000EB01|"; distance: 12; within: 12;content: "|E8A4000000E803000000EB01|"; distance: 12; within: 12;content: "|E897000000E803000000EB01|"; distance: 12; within: 12;content: "|E82D000000E803000000EB01|"; distance: 12; within: 12;content: "|60E8000000005D81EDD5E441008BD581C223E5410052E801000000C3C3E803000000EB01|"; distance: 12; within: 36;content: "|E80E000000E8D1FFFFFFC3E803000000EB01|"; distance: 36; within: 18;content: "|33C064FF30648920CCC3E803000000EB01|"; distance: 18; within: 17;content: "|33C064FF30648920CCC3|"; distance: 17; within: 10;sid: 20091471; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[yoda's Protector V1.02 -> Ashkbiz Danehkar] binary file"; flow:established,to_server; content: "|E803000000EB01|";content: "|BB55000000E803000000EB01|"; distance: 7; within: 12;content: "|E88F000000E803000000EB01|"; distance: 12; within: 12;content: "|E882000000E803000000EB01|"; distance: 12; within: 12;content: "|E8B8000000E803000000EB01|"; distance: 12; within: 12;content: "|E8AB000000E803000000EB01|"; distance: 12; within: 12;content: "|83FB55E803000000EB01|"; distance: 12; within: 10;content: "|752EE803000000EB01|"; distance: 10; within: 9;content: "|C360E8000000005D81ED233F42008BD581C2723F420052E801000000C3C3E803000000EB01|"; distance: 9; within: 37;content: "|E80E000000E8D1FFFFFFC3E803000000EB01|"; distance: 37; within: 18;content: "|33C064FF30648920CCC3E803000000EB01|"; distance: 18; within: 17;content: "|33C064FF306489204BCCC3E803000000EB01|"; distance: 17; within: 18;content: "|33DBB93A66420081E91D4042008BD581C21D4042008D3A8BF733C0E803000000EB01|"; distance: 18; within: 34;content: "|E817000000909090E9C31F000033C064FF3064892043CCC3|"; distance: 34; within: 24;sid: 20091472; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[yoda's Protector V1.03.1 -> Ashkbiz Danehkar] binary file"; flow:established,to_server; content: "|E803000000EB01|";content: "|BB55000000E803000000EB01|"; distance: 7; within: 12;content: "|E88F000000E803000000EB01|"; distance: 12; within: 12;content: "|E882000000E803000000EB01|"; distance: 12; within: 12;content: "|E8B8000000E803000000EB01|"; distance: 12; within: 12;content: "|E8AB000000E803000000EB01|"; distance: 12; within: 12;content: "|83FB55E803000000EB01|"; distance: 12; within: 10;content: "|752EE803000000EB01|"; distance: 10; within: 9;content: "|C360E8000000005D81ED747242008BD581C2C372420052E801000000C3C3E803000000EB01|"; distance: 9; within: 37;content: "|E80E000000E8D1FFFFFFC3E803000000EB01|"; distance: 37; within: 18;content: "|33C064FF30648920CCC3E803000000EB01|"; distance: 18; within: 17;content: "|33C064FF306489204BCCC3E803000000EB01|"; distance: 17; within: 18;content: "|33DBB93FA9420081E96E7342008BD581C26E7342008D3A8BF733C0E803000000EB01|"; distance: 18; within: 34;content: "|E817000000909090E9982E000033C064FF3064892043CCC3|"; distance: 34; within: 24;sid: 20091473; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[yoda's Protector V1.03.2 -> Ashkbiz Danehkar] binary file"; flow:established,to_server; content: "|E803000000EB01|";content: "|BB55000000E803000000EB01|"; distance: 7; within: 12;content: "|E88F000000E803000000EB01|"; distance: 12; within: 12;content: "|E882000000E803000000EB01|"; distance: 12; within: 12;content: "|E8B8000000E803000000EB01|"; distance: 12; within: 12;content: "|E8AB000000E803000000EB01|"; distance: 12; within: 12;content: "|83FB55E803000000EB01|"; distance: 12; within: 10;content: "|752EE803000000EB01|"; distance: 10; within: 9;content: "|C360E8000000005D81ED947342008BD581C2E373420052E801000000C3C3E803000000EB01|"; distance: 9; within: 37;content: "|E80E000000E8D1FFFFFFC3E803000000EB01|"; distance: 37; within: 18;content: "|33C064FF30648920CCC3E803000000EB01|"; distance: 18; within: 17;content: "|33C064FF306489204BCCC3E803000000EB01|"; distance: 17; within: 18;content: "|33DBB9BFA4420081E98E7442008BD581C28E7442008D3A8BF733C0E803000000EB01|"; distance: 18; within: 34;content: "|E817000000909090E96329000033C064FF3064892043CCC3|"; distance: 34; within: 24;sid: 20091474; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[Yoda's Protector v1.03.2 Beta2 -> Ashkbiz Danehkar] binary file"; flow:established,to_server; content: "|E803000000EB01|";content: "|BB55000000E803000000EB01|"; distance: 7; within: 12;content: "|E88F000000E803000000EB01|"; distance: 12; within: 12;content: "|E882000000E803000000EB01|"; distance: 12; within: 12;content: "|E8B8000000|"; distance: 12; within: 5;sid: 20091475; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[yoda's Protector v1.03.3 (.exe,.scr,.com) -> Ashkbiz Danehkar] binary file"; flow:established,to_server; content: "|E803000000EB01|";content: "|BB55000000E803000000EB01|"; distance: 7; within: 12;content: "|E88E000000E803000000EB01|"; distance: 12; within: 12;content: "|E881000000E803000000EB01|"; distance: 12; within: 12;content: "|E8B7000000E803000000EB01|"; distance: 12; within: 12;content: "|E8AA000000E803000000EB01|"; distance: 12; within: 12;content: "|83FB55E803000000EB01|"; distance: 12; within: 10;content: "|75|"; distance: 10; within: 1;sid: 20091476; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[yoda's Protector V1.03.3 -> Ashkbiz Danehkar] binary file"; flow:established,to_server; content: "|E803000000EB01|";content: "|BB55000000E803000000EB01|"; distance: 7; within: 12;content: "|E88E000000E803000000EB01|"; distance: 12; within: 12;content: "|E881000000E803000000EB01|"; distance: 12; within: 12;content: "|E8B7000000E803000000EB01|"; distance: 12; within: 12;content: "|E8AA000000E803000000EB01|"; distance: 12; within: 12;content: "|83FB55E803000000EB01|"; distance: 12; within: 10;content: "|752DE803000000EB01|"; distance: 10; within: 9;content: "|60E8000000005D81ED07E240008BD581C256E2400052E801000000C3C3E803000000EB01|"; distance: 9; within: 36;content: "|E80E000000E8D1FFFFFFC3E803000000EB01|"; distance: 36; within: 18;content: "|33C064FF30648920CCC3E803000000EB01|"; distance: 18; within: 17;content: "|33C064FF306489204BCCC3|"; distance: 17; within: 11;sid: 20091477; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[yoda's Protector v1.0b -> Ashkbiz Danehkar] binary file"; flow:established,to_server; content: "|558BEC53565760E8000000005D81ED4C324000E803000000EB01|";content: "|B9EA47400081E9E93240008BD581C2E93240008D3A8BF733C0E80400000090EB01|"; distance: 26; within: 33;content: "|E803000000EB01|"; distance: 33; within: 7;sid: 20091478; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[yzpack 1.12 -> UsAr] binary file"; flow:established,to_server; content: "|5A52456083EC188BEC8BFC33C0648B4030780C8B400C8B701CAD8B4008EB098B403483C07C8B403CABE9|";content: "|B409BA00001FCD21B8014CCD2140000000504500004C010200|"; distance: 44; within: 25;content: "|0000000000000000E000|"; distance: 27; within: 10;content: "|0B01|"; distance: 11; within: 2;content: "|0000|"; distance: 4; within: 2;sid: 20091479; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[YZPack 1.2 --> UsAr] binary file"; flow:established,to_server; content: "|4D5A52456083EC188BEC8BFC33C0648B4030780C8B400C8B701CAD8B4008EB098B403483C07C8B403CABE9|";sid: 20091480; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[yzpack 2.0 -> UsAr] binary file"; flow:established,to_server; content: "|25|";content: "|6187CC5545455581EDCA00000055A4B302FF142473F833C9FF1424731833C0FF1424731FB30241B010FF142412C073F9753CAAEBDCFF5424042BCB750FFF542408EB27ACD1E8743013C9EB1B9148C1E008ACFF5424083D007D0000730A80FC05730683F87F77024141958BC5B301568BF72BF0F3A45EEB99BD|"; distance: 3; within: 121;content: "|FF6528|"; distance: 123; within: 3;sid: 20091481; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[yzpack V1.1 -> UsAr] binary file"; flow:established,to_server; content: "|6033C08D480750E2FD8BEC648B4030780C8B400C8B701CAD8B4008EB098B40348D407C8B403C894504E8F3070000608B5D048B733C8B74337803F3568B762003F333C9499241AD03C35233FF0FB61038F2|";sid: 20091482; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ZCode Win32/PE Protector v1.01] binary file"; flow:established,to_server; content: "|E912000000|";content: "|E9FBFFFFFFC368|"; distance: 11; within: 7;content: "|64FF35|"; distance: 9; within: 3;sid: 20091483; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ZealPack 1.0 -> Zeal] binary file"; flow:established,to_server; content: "|C745F400004000C745F0|";content: "|8B45F405|"; distance: 12; within: 4;content: "|8945F4C745FC00000000EB098B4DFC83C101894DFC8B55FC3B55F07D228B45F40345FC8A08884DF80FBE55F883F20F8855F88B45F40345FC8A4DF88808EBCDFF65F4|"; distance: 6; within: 66;sid: 20091484; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[ZipWorxSecureEXE v2.5 -> ZipWORX Technologies LLC] binary file"; flow:established,to_server; content: "|E9B8000000|";content: "|0000000000|"; distance: 11; within: 5;content: "|005365637572654558452045786563757461626C652046696C652050726F746563746F720D0A436F70797269676874286329203230|"; distance: 10; within: 53;sid: 20091485; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH]] binary file"; flow:established,to_server; content: "|60EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB0181E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB0181E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C4082B042474047502EB02EB018183C404E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C4083DFF0F0000EB0168EB02CD20EB01E8761BEB0168EB02CD20EB01E8CC66B8FE0074047502EB02EB018166E764E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C4082B042474047502EB02EB0181|";sid: 20091486; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v0.1 -> emadicius] binary file"; flow:established,to_server; content: "|60EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB0181E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB0181E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C4082B042474047502EB02EB018183C404E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C4083DFF0F0000EB0168EB02CD20EB01E8761BEB0168EB02CD20EB01E8CC66B8FE0074047502EB02EB018166E764E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C408|";sid: 20091487; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v0.31a] binary file"; flow:established,to_server; content: "|60D1CB0FCAC1CAE0D1CA0FC8EB01F10FC0C9D2D10FC1C0D3DAC0D6A8EB01DED0EC0FC1CBD0CF0FC1D1D2DB0FC8EB01BCC0E9C6C1D0910FCBEB01730FCA87D987D2D0CF87D90FC8EB01C1EB01A286CAD0E10FC0CB0FCAC0C7910FCBC1D90C86F986D7D1D9EB01A5EB0111EB011D0FC1C20FCB0FC1C2EB01A1C0E9FD0FC1D1EB01E30FCA87D9EB01F30FCB87C20FC0F9D0F7EB012F0FC9C0DCC4EB01350FCAD3D186C8EB01010FC0F587C8D0DEEB0195EB01E1EB01FDEB01EC87D30FCBC1DB35D3E20FC886E286ECC1FB12D2EE0FC9D2F60FCA87C3C1D3B3EB01BFD1CB87C90FCA0FC1DBEB0144C0CAF20FC1D10FCBEB01D3EB05E8EB044000EBFAE80A000000|";sid: 20091488; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v0.32a (fake .BJFNT 1.3) -> emadicius] binary file"; flow:established,to_server; content: "|EB033A4D3A1EEB02CD209CEB02CD20EB02CD2060EB02C705EB02CD20E803000000E9EB04584050C3619D1FEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C4082B042474047502EB02EB01|";sid: 20091489; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v0.32a (fake ASPack 2.11d) -> emadicius] binary file"; flow:established,to_server; content: "|60E802000000EB095D5581ED39394400C361EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF|";sid: 20091490; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v0.32a (fake ASPack 2.12) -> emadicius] binary file"; flow:established,to_server; content: "|60E803000000E9EB045D4555C3E801000000EB5DBBEDFFFFFF03DD81EB00A002EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF|";sid: 20091491; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v0.32a (fake EXE32Pack 1.3x) -> emadicius] binary file"; flow:established,to_server; content: "|3BC074028183553BC074028183533BC97401BC563BD27402818557E8000000003BDB74019083C414EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF|";sid: 20091492; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v0.32a (fake Microsoft Visual C++) -> emadicius] binary file"; flow:established,to_server; content: "|558BEC6AFF68CA374100680638410064A1000000005064892500000000648F050000000083C40C5DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C4082B042474047502EB02EB01|";sid: 20091493; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v0.32a (fake MSVC++ 6.0 DLL) -> emadicius] binary file"; flow:established,to_server; content: "|558BEC538B5D08568B750C578B7D1085F65F5E5B5DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF|";sid: 20091494; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v0.32a (fake MSVC++ 7.0 DLL Method 3) -> emadicius] binary file"; flow:established,to_server; content: "|558BEC538B5D08568B750C5E5B5DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF|";sid: 20091495; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v0.32a (fake MSVC++ DLL Method 4) -> emadicius] binary file"; flow:established,to_server; content: "|558BEC5657BF010000008B750C85F65F5E5DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF|";sid: 20091496; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v0.32a (fake Neolite 2.0) -> emadicius] binary file"; flow:established,to_server; content: "|E9A6000000B07B4000786040007C60400000000000B03F0000126240004E656F4C6974652045786563757461626C652046696C6520436F6D70726573736F720D0A436F707972696768742028632920313939382C31393939204E656F576F727820496E630D0A506F7274696F6E7320436F707972696768742028632920313939372D31393939204C65652048617369756B0D0A416C6C205269676874732052657365727665642E00000000EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C4082B042474047502EB02EB01|";sid: 20091497; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v0.32a (fake nSPack 1.3) -> emadicius] binary file"; flow:established,to_server; content: "|9C60E8000000005DB8B38540002DAC8540002BE88DB5D3FEFFFF8B0683F80074118DB5DFFEFFFF8B0683F8010F84F1010000619DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C4082B042474047502EB02EB01|";sid: 20091498; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v0.32a (fake PC-Guard 4.xx) -> emadicius] binary file"; flow:established,to_server; content: "|FC5550E8000000005DEB01E360E803000000D2EB0B58EB014840EB0135FFE0E761585DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF|";sid: 20091499; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v0.32a (fake PE Crypt 1.02) -> emadicius] binary file"; flow:established,to_server; content: "|E8000000005B83EB05EB04524E442185C07302F70550E808000000EAFF58EB18EB010FEB02CD20EB03EACD205858EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF|";sid: 20091500; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v0.32a (fake PE Lock NT 2.04) -> emadicius] binary file"; flow:established,to_server; content: "|EB03CD20C71EEB03CD20EA9CEB02EB01EB01EB60EB03CD20EBEB01EBE803000000E9EB04584050C3EB03CD20EBEB03CD2003619D83C404EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF|";sid: 20091501; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v0.32a (fake PEBundle 0.2 - 3.x) -> emadicius] binary file"; flow:established,to_server; content: "|9C60E80200000033C08BC483C004938BE38B5BFC81EB0730400087DD619DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF|";sid: 20091502; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v0.32a (fake PEBundle 2.0x - 2.4x) -> emadicius] binary file"; flow:established,to_server; content: "|9C60E80200000033C08BC483C004938BE38B5BFC81EB0730400087DD83BD9C38400001619DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF|";sid: 20091503; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v0.32a (fake PECompact 1.4x) -> emadicius] binary file"; flow:established,to_server; content: "|EB06682EA80000C39C60E80200000033C08BC483C004938BE38B5BFC81EB3F904000619DEB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF|";sid: 20091504; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v0.32a (fake PESHiELD 0.25) -> emadicius] binary file"; flow:established,to_server; content: "|60E82B0000000D0A0D0A0D0A5265676973744172656420746F3A204E4F4E2D434F4D4D45524349414C21210D0A0D0A0D005861EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF|";sid: 20091505; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v0.32a (fake PEtite 2.1) -> emadicius] binary file"; flow:established,to_server; content: "|B8005040006A0068BB21400064FF350000000064892500000000669C605083C40461669D648F050000000083C408EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF|";sid: 20091506; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v0.32a (fake PEX 0.99) -> emadicius] binary file"; flow:established,to_server; content: "|60E801000000E883C404E801000000E95D81EDFF22400061EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C4082B042474047502EB02EB01|";sid: 20091507; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v0.32a (fake SVKP 1.11) -> emadicius] binary file"; flow:established,to_server; content: "|60E8000000005D81ED0600000064A02300000083C50661EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C4082B042474047502EB02EB01|";sid: 20091508; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v0.32a (fake UPX 0.89.6 - 1.02 / 1.05 - 1.24) -> emadicius] binary file"; flow:established,to_server; content: "|60BE00908B008DBE0080B4FF5783CDFFEB3A9090909090908A064688074701DB75078B1E83EEFC11DB72EDB80100000001DB75078B1E83EEFC11DB11C001DB730B75198B1E83EEFC11DB7210586190EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF|";sid: 20091509; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v0.32a (fake WWPack32 1.x) -> emadicius] binary file"; flow:established,to_server; content: "|53558BE833DBEB600D0A0D0A57575061636B3332206465636F6D7072657373696F6E20726F7574696E652076657273696F6E20312E31320D0A28632920313939382050696F747220576172657A616B20616E6420526166616C20576965727A6269636B690D0A0D0A5D5B90EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF|";sid: 20091510; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v0.32a (fake yoda's cryptor 1.2) -> emadicius] binary file"; flow:established,to_server; content: "|60E8000000005D81EDF31D4000B97B0900008DBD3B1E40008BF7AC902C8AC0C078900462EB010061EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF|";sid: 20091511; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v0.32a -> emadicius] binary file"; flow:established,to_server; content: "|E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018174047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C4082B042474047502EB02EB018183C404E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C4083DFFFFFF00EB0168EB02CD20EB01E8761BEB0168EB02CD20EB01E8CC66B8FE0074047502EB02EB018166E76474047502EB02EB0181E80A000000E8EB0C|";sid: 20091512; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "[[MSLRH] v32a -> emadicius] binary file"; flow:established,to_server; content: "|EB05E8EB044000EBFAE80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB0181E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB018150E802000000295A586BC003E802000000295A83C4045874047502EB02EB01810F31500F31E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C4082B042474047502EB02EB018183C404E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C4083DFF0F0000EB0168EB02CD20EB01E8761BEB0168EB02CD20EB01E8CC66B8FE0074047502EB02EB018166E764E80A000000E8EB0C0000E8F6FFFFFFE8F2FFFFFF83C40874047502EB02EB01810F31500F31|";sid: 20091513; rev:1;)
-------------- next part --------------
;  By BoB / Team PEiD ..
;  1832 Signatures in list ..

[!EP (ExE Pack) V1.0 -> Elite Coding Group]
signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10
ep_only = true

[!EPack 1.4 lite (final) - by 6aHguT]
signature = 33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8
ep_only = true

[$pirit v1.5]
signature = ?? ?? ?? 5B 24 55 50 44 FB 32 2E 31 5D
ep_only = true

[$PIRIT v1.5]
signature = B4 4D CD 21 E8 ?? ?? FD E8 ?? ?? B4 51 CD 21
ep_only = true

[* PseudoSigner 0.1 --> Anorganix]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90
ep_only = true

[* PseudoSigner 0.1 [32Lite 0.03] --> Anorganix]
signature = 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ?? ?? ?? ?? E9
ep_only = true

[* PseudoSigner 0.1 [ACProtect 1.09] --> Anorganix]
signature = 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true

[* PseudoSigner 0.1 [Armadillo 3.00] --> Anorganix]
signature = 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9
ep_only = true

[* PseudoSigner 0.1 [ASPack 2.xx Heuristic] --> Anorganix]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95
ep_only = true

[* PseudoSigner 0.1 [ASProtect] --> Anorganix]
signature = 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9
ep_only = true

[* PseudoSigner 0.1 [Borland Delphi 3.0] --> Anorganix]
signature = 55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true

[* PseudoSigner 0.1 [Borland Delphi 5.0 KOL/MCK] --> Anorganix]
signature = 55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90
ep_only = true

[* PseudoSigner 0.1 [Borland Delphi 6.0 - 7.0] --> Anorganix]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53 8B D8 33 C0 A3 09 09 09 00 6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00 33 C0 A3 09 09 09 00 33 C0 A3 09 09 09 00 E8
ep_only = true

[* PseudoSigner 0.1 [CD-Cops II] --> Anorganix]
signature = 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 E9
ep_only = true

[* PseudoSigner 0.1 [Code-Lock] --> Anorganix]
signature = 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B E9
ep_only = true

[* PseudoSigner 0.1 [CodeSafe 2.0] --> Anorganix]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9
ep_only = true

[* PseudoSigner 0.1 [Crunch/PE Heuristic] --> Anorganix]
signature = 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9
ep_only = true

[* PseudoSigner 0.1 [DEF 1.0] --> Anorganix]
signature = BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 E9
ep_only = true

[* PseudoSigner 0.1 [DxPack 1.0] --> Anorganix]
signature = 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9
ep_only = true

[* PseudoSigner 0.1 [ExeSmasher] --> Anorganix]
signature = 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B E9
ep_only = true

[* PseudoSigner 0.1 [FSG 1.0] --> Anorganix]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9
ep_only = true

[* PseudoSigner 0.1 [FSG 1.31] --> Anorganix]
signature = BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9
ep_only = true

[* PseudoSigner 0.1 [Gleam 1.00] --> Anorganix]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF E9
ep_only = true

[* PseudoSigner 0.1 [JDPack 1.x / JDProtect 0.9] --> Anorganix]
signature = 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 E9
ep_only = true

[* PseudoSigner 0.1 [LCC Win32 1.x] --> Anorganix]
signature = 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 E9
ep_only = true

[* PseudoSigner 0.1 [LCC Win32 DLL] --> Anorganix]
signature = 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ?? ?? ?? ?? E9
ep_only = true

[* PseudoSigner 0.1 [Lockless Intro Pack] --> Anorganix]
signature = 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD E9
ep_only = true

[* PseudoSigner 0.1 [LTC 1.3] --> Anorganix]
signature = 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9
ep_only = true

[* PseudoSigner 0.1 [Macromedia Flash Projector 6.0] --> Anorganix]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C E9
ep_only = true

[* PseudoSigner 0.1 [MEW 11 SE 1.0] --> Anorganix]
signature = E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 E9
ep_only = true

[* PseudoSigner 0.1 [Microsoft Visual Basic 5.0 - 6.0] --> Anorganix]
signature = 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9
ep_only = true

[* PseudoSigner 0.1 [Microsoft Visual Basic 6.0 DLL] --> Anorganix]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 5A 68 90 90 90 90 68 90 90 90 90 52 E9 90 90 FF
ep_only = true

[* PseudoSigner 0.1 [Microsoft Visual C++ 5.0+ (MFC)] --> Anorganix]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 E9
ep_only = true

[* PseudoSigner 0.1 [Microsoft Visual C++ 6.0 (Debug Version)] --> Anorganix]
signature = 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90
ep_only = true

[* PseudoSigner 0.1 [Microsoft Visual C++ 6.20] --> Anorganix]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B
ep_only = true

[* PseudoSigner 0.1 [Microsoft Visual C++ 7.0 DLL] --> Anorganix]
signature = 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 ?? ?? ?? ?? E9
ep_only = true

[* PseudoSigner 0.1 [MinGW GCC 2.x] --> Anorganix]
signature = 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 E9
ep_only = true

[* PseudoSigner 0.1 [Morphine 1.2] --> Anorganix]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true

[* PseudoSigner 0.1 [Neolite 2.0] --> Anorganix]
signature = E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true

[* PseudoSigner 0.1 [NorthStar PE Shrinker 1.3] --> Anorganix]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9
ep_only = true

[* PseudoSigner 0.1 [Pack Master 1.0 (PEX Clone)] --> Anorganix]
signature = 60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true

[* PseudoSigner 0.1 [PE Intro 1.0] --> Anorganix]
signature = 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A E9
ep_only = true

[* PseudoSigner 0.1 [PE Pack 0.99] --> Anorganix]
signature = 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A E9
ep_only = true

[* PseudoSigner 0.1 [PE Protect 0.9] --> Anorganix]
signature = 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 E9
ep_only = true

[* PseudoSigner 0.1 [PECompact 1.4+] --> Anorganix]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 EB 06 68 90 90 90 90 C3 9C 60 E8 02 90 90 90 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81
ep_only = true

[* PseudoSigner 0.1 [PENightMare 2 Beta] --> Anorganix]
signature = 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A E9
ep_only = true

[* PseudoSigner 0.1 [PENinja 1.31] --> Anorganix]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9
ep_only = true

[* PseudoSigner 0.1 [PESHiELD 0.25] --> Anorganix]
signature = 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9
ep_only = true

[* PseudoSigner 0.1 [PEtite 2.x (level 0)] --> Anorganix]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 B8 00 90 90 00 6A 00 68 90 90 90 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 03 00 68
ep_only = true

[* PseudoSigner 0.1 [PEX 0.99] --> Anorganix]
signature = 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 E9
ep_only = true

[* PseudoSigner 0.1 [REALBasic] --> Anorganix]
signature = 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9
ep_only = true

[* PseudoSigner 0.1 [Ste at lth PE 1.01] --> Anorganix]
signature = 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 BA ?? ?? ?? ?? FF E2 BA E0 10 40 00 B8 68 24 1A 40 89 02 83 C2 03 B8 40 00 E8 EE 89 02 83 C2 FD FF E2 2D 3D 5B 20 48 69 64 65 50 45 20 5D 3D 2D 90 00 00 00
ep_only = true

[* PseudoSigner 0.1 [UPX 0.6] --> Anorganix]
signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9
ep_only = true

[* PseudoSigner 0.1 [VBOX 4.3 MTE] --> Anorganix]
signature = 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 E9
ep_only = true

[* PseudoSigner 0.1 [Video-Lan-Client] --> Anorganix]
signature = 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 E9
ep_only = true

[* PseudoSigner 0.1 [VOB ProtectCD 5] --> Anorganix]
signature = 36 3E 26 8A C0 60 E8 00 00 00 00 E9
ep_only = true

[* PseudoSigner 0.1 [WATCOM C/C++ EXE] --> Anorganix]
signature = E9 00 00 00 00 90 90 90 90 57 41 E9
ep_only = true

[* PseudoSigner 0.1 [XCR 0.11] --> Anorganix]
signature = 60 8B F0 33 DB 83 C3 01 83 C0 01 E9
ep_only = true

[* PseudoSigner 0.1 [Yoda's Protector 1.02] --> Anorganix]
signature = E8 03 00 00 00 EB 01 90 90 E9
ep_only = true

[* PseudoSigner 0.2 [.BJFNT 1.1b] --> Anorganix]
signature = EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 90
ep_only = true

[* PseudoSigner 0.2 [.BJFNT 1.2] --> Anorganix]
signature = EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00
ep_only = true

[* PseudoSigner 0.2 [32Lite 0.03] --> Anorganix]
signature = 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68
ep_only = true

[* PseudoSigner 0.2 [Armadillo 3.00] --> Anorganix]
signature = 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85
ep_only = true

[* PseudoSigner 0.2 [ASProtect] --> Anorganix]
signature = 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD
ep_only = true

[* PseudoSigner 0.2 [Borland C++ 1999] --> Anorganix]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 ?? ?? ?? ?? A3
ep_only = true

[* PseudoSigner 0.2 [Borland C++ DLL (Method 2)] --> Anorganix]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90
ep_only = true

[* PseudoSigner 0.2 [Borland Delphi DLL] --> Anorganix]
signature = 55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00
ep_only = true

[* PseudoSigner 0.2 [Borland Delphi Setup Module] --> Anorganix]
signature = 55 8B EC 83 C4 90 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 00 00 00 00
ep_only = true

[* PseudoSigner 0.2 [CD-Cops II] --> Anorganix]
signature = 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01
ep_only = true

[* PseudoSigner 0.2 [Code-Lock] --> Anorganix]
signature = 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B
ep_only = true

[* PseudoSigner 0.2 [CodeSafe 2.0] --> Anorganix]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85
ep_only = true

[* PseudoSigner 0.2 [Crunch/PE Heuristic] --> Anorganix]
signature = 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00
ep_only = true

[* PseudoSigner 0.2 [DEF 1.0] --> Anorganix]
signature = BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01
ep_only = true

[* PseudoSigner 0.2 [DxPack 1.0] --> Anorganix]
signature = 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00
ep_only = true

[* PseudoSigner 0.2 [ExeSmasher] --> Anorganix]
signature = 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B
ep_only = true

[* PseudoSigner 0.2 [FSG 1.0] --> Anorganix]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B
ep_only = true

[* PseudoSigner 0.2 [FSG 1.31] --> Anorganix]
signature = BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80
ep_only = true

[* PseudoSigner 0.2 [Gleam 1.00] --> Anorganix]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF
ep_only = true

[* PseudoSigner 0.2 [JDPack 1.x / JDProtect 0.9] --> Anorganix]
signature = 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01
ep_only = true

[* PseudoSigner 0.2 [LCC Win32 1.x] --> Anorganix]
signature = 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50
ep_only = true

[* PseudoSigner 0.2 [LCC Win32 DLL] --> Anorganix]
signature = 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1
ep_only = true

[* PseudoSigner 0.2 [Lockless Intro Pack] --> Anorganix]
signature = 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD
ep_only = true

[* PseudoSigner 0.2 [Macromedia Flash Projector 6.0] --> Anorganix]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C
ep_only = true

[* PseudoSigner 0.2 [MEW 11 SE 1.0] --> Anorganix]
signature = E9 09 00 00 00 00 00 00 02 00 00 00 0C 90
ep_only = true

[* PseudoSigner 0.2 [Microsoft Visual Basic 5.0 - 6.0] --> Anorganix]
signature = 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00
ep_only = true

[* PseudoSigner 0.2 [Microsoft Visual C++ 7.0 DLL] --> Anorganix]
signature = 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84
ep_only = true

[* PseudoSigner 0.2 [MinGW GCC 2.x] --> Anorganix]
signature = 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45
ep_only = true

[* PseudoSigner 0.2 [NorthStar PE Shrinker 1.3] --> Anorganix]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00
ep_only = true

[* PseudoSigner 0.2 [PE Intro 1.0] --> Anorganix]
signature = 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A
ep_only = true

[* PseudoSigner 0.2 [PE Pack 0.99] --> Anorganix]
signature = 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A
ep_only = true

[* PseudoSigner 0.2 [PE Protect 0.9] --> Anorganix]
signature = 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3
ep_only = true

[* PseudoSigner 0.2 [PENightMare 2 Beta] --> Anorganix]
signature = 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A
ep_only = true

[* PseudoSigner 0.2 [PESHiELD 0.25] --> Anorganix]
signature = 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC
ep_only = true

[* PseudoSigner 0.2 [PEX 0.99] --> Anorganix]
signature = 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01
ep_only = true

[* PseudoSigner 0.2 [REALBasic] --> Anorganix]
signature = 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01
ep_only = true

[* PseudoSigner 0.2 [UPX 0.6] --> Anorganix]
signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00
ep_only = true

[* PseudoSigner 0.2 [VBOX 4.3 MTE] --> Anorganix]
signature = 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0
ep_only = true

[* PseudoSigner 0.2 [Video-Lan-Client] --> Anorganix]
signature = 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01
ep_only = true

[* PseudoSigner 0.2 [VOB ProtectCD 5] --> Anorganix]
signature = 36 3E 26 8A C0 60 E8 00 00 00 00
ep_only = true

[* PseudoSigner 0.2 [Watcom C/C++ DLL] --> Anorganix]
signature = 53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1
ep_only = true

[* PseudoSigner 0.2 [WATCOM C/C++ EXE] --> Anorganix]
signature = E9 00 00 00 00 90 90 90 90 57 41
ep_only = true

[* PseudoSigner 0.2 [XCR 0.11] --> Anorganix]
signature = 60 8B F0 33 DB 83 C3 01 83 C0 01
ep_only = true

[* PseudoSigner 0.2 [Yoda's Protector 1.02] --> Anorganix]
signature = E8 03 00 00 00 EB 01 90 90
ep_only = true

[* PseudoSigner 0.2 [ZCode 1.01] --> Anorganix]
signature = E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 00 00 00 00
ep_only = true

[* [MSLRH] v0.1 -> emadicius]
signature = 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8
ep_only = false

[* [MSLRH] V0.31 -> emadicius]
signature = 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1
ep_only = true

[* [MSLRH] v0.31a]
signature = 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F
ep_only = false

[* [MSLRH] v0.32a -> emadicius]
signature = E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8
ep_only = false

[* [MSLRH] v0.32a -> emadicius]
signature = EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03
ep_only = false

[*** Protector v1.1.11 (DDeM->PE Engine v0.9, DDeM->CI v0.9.2)]
signature = 53 51 56 E8 00 00 00 00 5B 81 EB 08 10 00 00 8D B3 34 10 00 00 B9 F3 03 00 00 BA 63 17 2A EE 31 16 83 C6 04
ep_only = true

[.BJFnt v1.1b]
signature = EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56
ep_only = true

[.BJFnt v1.2 RC]
signature = EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB
ep_only = true

[.BJFnt v1.3]
signature = EB ?? 3A ?? ?? 1E EB ?? CD 20 9C EB ?? CD 20 EB ?? CD 20 60 EB
ep_only = true

[.NET DLL -> Microsoft]
signature = 00 00 00 00 00 00 00 00 5F 43 6F 72 44 6C 6C 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 ?? 00 00 FF 25
ep_only = false

[.NET executable -> Microsoft]
signature = 00 00 00 00 00 00 00 00 5F 43 6F 72 45 78 65 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 00 00 00 FF 25
ep_only = false

[32Lite v0.03a]
signature = 60 06 FC 1E 07 BE ?? ?? ?? ?? 6A 04 68 ?? 10 ?? ?? 68
ep_only = true

[624 (Six to Four) v1.0]
signature = 50 55 4C 50 83 ?? ?? FC BF ?? ?? BE ?? ?? B5 ?? 57 F3 A5 C3 33 ED
ep_only = true

[Aase Crypter - by santasdad]
signature = 55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF 68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00 10 68 0C 43 ?? ?? ?? ?? DF FF FF 50 E8 0E DF FF FF A3 94 66 00 10 83 3D 94 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 38 43 00 10 6A 00 E8 15 DF FF FF 68 48 43 00 10 68 0C 43 00 10 E8 D6 DE FF FF 50 E8 D8 DE FF FF A3 A0 66 00 10 83 3D A0 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 58 43 00 10 6A 00 E8 DF DE FF FF 68 6C 43 00 10 68 0C 43 00 10 E8 A0 DE FF FF 50 E8 A2 DE FF FF
ep_only = false

[ABC Cryptor 1.0 - by ZloY]
signature = 68 FF 64 24 F0 68 58 58 58 58 90 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8
ep_only = false

[AcidCrypt]
signature = 60 B9 ?? ?? ?? 00 BA ?? ?? ?? 00 BE ?? ?? ?? 00 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB
ep_only = true

[AcidCrypt]
signature = BE ?? ?? ?? ?? 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB
ep_only = true

[ACProtect 1.09g -> Risco software Inc.]
signature = 60 F9 50 E8 01 00 00 00 7C 58 58 49 50 E8 01 00 00 00 7E 58 58 79 04 66 B9 B8 72 E8 01 00 00 00 7A 83 C4 04 85 C8 EB 01 EB C1 F8 BE 72 03 73 01 74 0F 81 01 00 00 00 F9 EB 01 75 F9 E8 01 00 00
ep_only = true

[ACProtect 1.4x -> RISCO soft]
signature = 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70
ep_only = false

[ACProtect v1.35 -> risco software Inc. & Anticrack Software]
signature = 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 47 65 74 50 72 6F 63
ep_only = false

[ACProtect V1.3X -> risco]
signature = 60 50 E8 01 00 00 00 75 83
ep_only = true

[ACProtect v1.41]
signature = 60 76 03 77 01 7B 74 03 75 01 78 47 87 EE E8 01 00 00 00 76 83 C4 04 85 EE EB 01 7F 85 F2 EB 01 79 0F 86 01 00 00 00 FC EB 01 78 79 02 87 F2 61 51 8F 05 19 38 01 01 60 EB 01 E9 E9 01 00 00 00
ep_only = true

[ACProtect V1.4X -> risco]
signature = 60 E8 01 00 00 00 7C 83 04 24 06 C3
ep_only = true

[ACProtect v1.90g -> Risco software Inc.]
signature = 60 0F 87 02 00 00 00 1B F8 E8 01 00 00 00 73 83 04 24 06 C3
ep_only = true

[ACProtect V2.0 -> risco]
signature = 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? C3 C3
ep_only = true

[ACProtect/UltraProtect 1.0X-2.0X -> RiSco]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00
ep_only = false

[ActiveMARK 5.x -> Trymedia Systems,Inc.]
signature = 20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67
ep_only = false

[ActiveMARK[TM] R5.31.1140 -> Trymedia]
signature = 79 11 7F AB 9A 4A 83 B5 C9 6B 1A 48 F9 27 B4 25
ep_only = true

[AdFlt2]
signature = 68 00 01 9C 0F A0 0F A8 60 FD 6A 00 0F A1 BE ?? ?? AD
ep_only = true

[Ady's Glue 1.10]
signature = 2E ?? ?? ?? ?? 0E 1F BF ?? ?? 33 DB 33 C0 AC
ep_only = true

[Ady`s Glue v0.10]
signature = 2E 8C 06 ?? ?? 0E 07 33 C0 8E D8 BE ?? ?? BF ?? ?? FC B9 ?? ?? 56 F3 A5 1E 07 5F
ep_only = true

[AHPack 0.1 -> FEUERRADER]
signature = 60 68 54 ?? ?? 00 B8 48 ?? ?? 00 FF 10 68 B3 ?? ?? 00 50 B8 44 ?? ?? 00 FF 10 68 00
ep_only = true

[AHpack 0.1 -> FEUERRADER]
signature = 60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41
ep_only = true

[AHTeam EP Protector 0.3 (fake ASPack 2.12) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB
ep_only = true

[AHTeam EP Protector 0.3 (fake ASProtect 1.0) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 01 00 00 00 90 5D 81 ED 00 00 00 00 BB 00 00 00 00 03 DD 2B 9D
ep_only = true

[AHTeam EP Protector 0.3 (fake Borland Delphi 6.0-7.0) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 8B D8 33 C0 A3 00 00 00 00 6A 00 E8 00 00 00 FF A3 00 00 00 00 A1 00 00 00 00 A3 00 00 00 00 33 C0 A3 00 00 00 00 33 C0 A3 00 00 00 00 E8
ep_only = true

[AHTeam EP Protector 0.3 (fake k.kryptor 9/kryptor a) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 ?? ?? ?? ?? 5E B9 00 00 00 00 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9
ep_only = true

[AHTeam EP Protector 0.3 (fake Microsoft Visual C++ 7.0) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 89 65 00 8B F4 89 3E 56 FF 15 ?? ?? ?? ?? 8B 4E ?? 89 0D ?? ?? ?? 00 8B 46 00 A3
ep_only = true

[AHTeam EP Protector 0.3 (fake PCGuard 4.03-4.15) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01
ep_only = true

[AHTeam EP Protector 0.3 (fake PE Lock NT 2.04) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB
ep_only = true

[AHTeam EP Protector 0.3 (fake PE-Crypt 1.02) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44
ep_only = true

[AHTeam EP Protector 0.3 (fake PESHiELD 2.x) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04
ep_only = true

[AHTeam EP Protector 0.3 (fake PEtite 2.2) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 B8 00 00 00 00 68 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50
ep_only = true

[AHTeam EP Protector 0.3 (fake Spalsher 1.x-3.x) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 9C 60 8B 44 24 24 E8 00 00 00 00 5D 81 ED 00 00 00 00 50 E8 ED 02 00 00 8C C0 0F 84
ep_only = true

[AHTeam EP Protector 0.3 (fake Stone's PE Encryptor 2.0) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 51 52 56 57 55 E8 00 00 00 00 5D 81 ED 42 30 40 00 FF 95 32 35 40 00 B8 37 30 40 00 03 C5 2B 85 1B 34 40 00 89 85 27 34 40 00 83
ep_only = true

[AHTeam EP Protector 0.3 (fake SVKP 1.3x) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 00 00 00 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00
ep_only = true

[AHTeam EP Protector 0.3 (fake tElock 0.61) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08 F3 EB FF E0 83 C0 28 50 E8 00 00 00 00 5E B3 33 8D 46 0E 8D 76 31 28 18 F8 73 00 C3 8B FE B9 3C 02
ep_only = true

[AHTeam EP Protector 0.3 (fake VIRUS/I-Worm Hybris) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 EB 16 A8 54 00 00 47 41 42 4C 4B 43 47 43 00 00 00 00 00 00 52 49 53 00 FC 68 4C 70 40 00 FF 15
ep_only = true

[AHTeam EP Protector 0.3 (fake VOB ProtectCD) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 5F 81 EF 00 00 00 00 BE 00 00 40 00 8B 87 00 00 00 00 03 C6 57 56 8C A7 00 00 00 00 FF 10 89 87 00 00 00 00 5E 5F
ep_only = true

[AHTeam EP Protector 0.3 (fake Xtreme-Protector 1.05) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E8 00 00 00 00 5D 81 00 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8
ep_only = true

[AHTeam EP Protector 0.3 (fake ZCode 1.01) -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35
ep_only = true

[AI1 Creator 1 Beta 2 - by MZ]
signature = E8 FE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00
ep_only = false

[AINEXE v2.1]
signature = A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 36 A3 ?? ?? 05 ?? ?? 36 A3 ?? ?? 2E A1 ?? ?? 8A D4 B1 04 D2 EA FE C9
ep_only = true

[AINEXE v2.30]
signature = 0E 07 B9 ?? ?? BE ?? ?? 33 FF FC F3 A4 A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8
ep_only = true

[Alex Protector 1.0 beta 2 by Alex]
signature = 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25
ep_only = false

[Alex Protector v0.4 beta 1 by Alex]
signature = 60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68
ep_only = false

[Alex Protector v1.0 -> Alex]
signature = 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B
ep_only = true

[Alloy 4.x -> PGWare LLC]
signature = 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68
ep_only = true

[Alloy v1.x.2000]
signature = 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95 46 23 40 ?? 0B
ep_only = true

[Aluwain v8.09]
signature = 8B EC 1E E8 ?? ?? 9D 5E
ep_only = true

[ANDpakk2 0.06 -> Dmitry Andreev]
signature = 60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3
ep_only = false

[ANDpakk2 0.18 - by Dmitry "AND" Andreev]
signature = FC BE D4 00 40 00 BF 00 ?? ?? 00 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3
ep_only = true

[Anskya Binder v1.1 -> Anskya]
signature = BE ?? ?? ?? 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11
ep_only = true

[Anskya NTPacker Generator -> Anskya]
signature = 55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70 FC FF FF 5B E8 F2 F6 FF FF 00 00 48 45 41 52 54
ep_only = false

[Anslym Crypter]
signature = 55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B D8 85 DB 0F 84 B6 02 00 00 53 A1 60 56 05 10 50 E8 F2 48 FB FF 8B F0 85 F6 0F 84 A0 02 00 00 E8 F3
ep_only = true

[Anslym FUD Crypter]
signature = 55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A
ep_only = true

[Anti007 V2.6 -> LiuXingPing]
signature = 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 57 72 69 74 65 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00
ep_only = false

[Anticrack Software Protector v1.09 (ACProtect)]
signature = 60 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 04 24 06 C3 ?? ?? ?? ?? ?? 00
ep_only = true

[AntiDote 1.0 Beta -> SIS-Team]
signature = E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 66 8B 41 06 89 54 24 14 8D 68 FF 85 ED 7C 37 33 C0
ep_only = true

[AntiDote 1.0 Demo / 1.2 -> SIS-Team]
signature = 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C
ep_only = false

[AntiDote 1.2 Beta (Demo) -> SIS-Team]
signature = 68 69 D6 00 00 E8 C6 FD FF FF 68 69 D6 00 00 E8 BC FD FF FF 83 C4 08 E8 A4 FF FF FF 84 C0 74 2F 68 04 01 00 00 68 B0 21 60 00 6A 00 FF 15 08 10 60 00 E8 29 FF FF FF 50 68 88 10 60 00 68 78 10 60 00 68 B0 21 60 00 E8 A4 FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 90 90 90 90 90 90 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0
ep_only = true

[AntiDote 1.2.Demo -> SIS-Team]
signature = E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08 61 0F 1D 1D 2A 01 87 35 4C 07 39 0B
ep_only = false

[AntiDote 1.2.DLL.Demo -> SIS-Team]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF
ep_only = false

[AntiDote 1.2/1.4 SE DLL -> SIS-Team]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC 11 DB
ep_only = true

[AntiDote 1.4 SE -> SIS-Team]
signature = 68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 00 6A 00 FF 15 08 10 60 00 68 90 03 00 00 E8 68 FD FF FF 68 69 D6 00 00 E8 5E FD FF FF 50 E8 58 FD FF FF 50 E8 52 FD FF FF E8 DD FE FF FF 50 68 A4 10 60 00 68 94 10 60 00 68 10 22 60 00 E8 58 FD FF FF 83 C4 20 33 C0 C2 10 00 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3
ep_only = true

[AntiVirus Vaccine v.1.03]
signature = FA 33 DB B9 ?? ?? 0E 1F 33 F6 FC AD 35 ?? ?? 03 D8 E2
ep_only = true

[aPack v0.62]
signature = 1E 06 8C C8 8E D8 ?? ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B6
ep_only = true

[aPack v0.82]
signature = 1E 06 8C CB BA ?? ?? 03 DA 8D ?? ?? ?? FC 33 F6 33 FF 48 4B 8E C0 8E DB
ep_only = true

[aPack v0.98 -m]
signature = 1E 06 8C C8 8E D8 05 ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B2 ?? BD ?? ?? 33 C9 50 A4 BB ?? ?? 3B F3 76
ep_only = false

[aPack v0.98b (DS&ES not saved)]
signature = 8C CB BA ?? ?? 03 DA FC 33 F6 33 FF 4B 8E DB 8D ?? ?? ?? 8E C0 B9 ?? ?? F3 A5 4A 75
ep_only = false

[aPack v0.98b -> Jibz]
signature = 93 07 1F 05 ?? ?? 8E D0 BC ?? ?? EA
ep_only = false

[APatch GUI v1.1]
signature = 52 31 C0 E8 FF FF FF FF
ep_only = true

[Apex 3.0 alpha -> 500mhz]
signature = 5F B9 14 00 00 00 51 BE 00 10 40 00 B9 00 ?? ?? 00 8A 07 30 06 46 E2 FB 47 59 E2 EA 68 ?? ?? ?? 00 C3
ep_only = false

[APEX_C (BLT Apex 4.0) -> 500mhz]
signature = 68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3
ep_only = true

[Apex_c beta -> 500mhz]
signature = 68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[App Encryptor -> Silent Team]
signature = 60 E8 00 00 00 00 5D 81 ED 1F 1F 40 00 B9 7B 09 00 00 8D BD 67 1F 40 00 8B F7 AC
ep_only = true

[App Protector -> Silent Team]
signature = E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A
ep_only = true

[ARC-SFX Archive]
signature = 8C C8 8C DB 8E D8 8E C0 89 ?? ?? ?? 2B C3 A3 ?? ?? 89 ?? ?? ?? BE ?? ?? B9 ?? ?? BF ?? ?? BA ?? ?? FC AC 32 C2 8A D8
ep_only = true

[ARM Protector 0.1 - by SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4
ep_only = true

[ARM Protector 0.3 - by SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 13 24 40 00 EB 02 83 09 8D B5 A4 24 40 00 EB 02 83 09 BA 4B 15 00 00 EB 01 00 8D 8D EF 39 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4
ep_only = false

[ARM Protector v0.1 by SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0
ep_only = false

[ARM Protector v0.2-> SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 09 20 40 00 EB 02 83 09 8D B5 9A 20 40 00 EB 02 83 09 BA 0B 12 00 00 EB 01 00 8D 8D A5 32 40 00
ep_only = true

[Armadillo 3.00a -> Silicon Realms Toolworks]
signature = 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F
ep_only = true

[Armadillo 3.X-5.X -> Silicon Realms Toolworks]
signature = 60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 60 33 C9 75 02 EB 15 EB 33
ep_only = true

[Armadillo 4.30a -> Silicon Realms Toolworks]
signature = 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43
ep_only = false

[Armadillo 4.40 -> Silicon Realms Toolworks]
signature = 31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8
ep_only = false

[Armadillo 5.0 Dll -> Silicon Realms Toolworks]
signature = 83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 20 15 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 D7 23 00 00 59 89 7D FC FF 75 08 E8 EC 53 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 2B C5 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 19 ED FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 7D 22 00 00 59 C3
ep_only = true

[Armadillo 5.00 -> Silicon Realms Toolworks]
signature = E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 48 11 00 00 59 89 7D FC FF 75 08 E8 01 49 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 66 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 AF F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 EE 0F 00 00 59 C3
ep_only = true

[Armadillo v1.60a]
signature = 55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.71]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1
ep_only = true

[Armadillo v1.72 - v1.73]
signature = 55 8B EC 6A FF 68 E8 C1 ?? ?? 68 F4 86 ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58
ep_only = true

[Armadillo v1.77]
signature = 55 8B EC 6A FF 68 B0 71 40 00 68 6C 37 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.80]
signature = 55 8B EC 6A FF 68 E8 C1 00 00 68 F4 86 00 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.82]
signature = 55 8B EC 6A FF 68 E0 C1 40 00 68 74 81 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.83]
signature = 55 8B EC 6A FF 68 E0 C1 40 00 68 64 84 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.84]
signature = 55 8B EC 6A FF 68 E8 C1 40 00 68 F4 86 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.90]
signature = 55 8B EC 6A FF 68 10 F2 40 00 68 64 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.90a]
signature = 55 8B EC 64 FF 68 10 F2 40 00 68 14 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.90b1]
signature = 55 8B EC 6A FF 68 E0 C1 40 00 68 04 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.90b2]
signature = 55 8B EC 6A FF 68 F0 C1 40 00 68 A4 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.90b3]
signature = 55 8B EC 6A FF 68 08 E2 40 00 68 94 95 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.90b4]
signature = 55 8B EC 6A FF 68 08 E2 40 00 68 B4 96 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.90c]
signature = 55 8B EC 6A FF 68 10 F2 40 00 68 74 9D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v1.9x]
signature = 55 8B EC 6A FF 68 98 ?? ?? ?? 68 10 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15
ep_only = true

[Armadillo v1.xx - v2.xx]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6
ep_only = true

[Armadillo v2.00]
signature = 55 8B EC 6A FF 68 00 02 41 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v2.00b2-2.00b3]
signature = 55 8B EC 6A FF 68 00 F2 40 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v2.01]
signature = 55 8B EC 6A FF 68 08 02 41 00 68 04 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v2.10b2]
signature = 55 8B EC 6A FF 68 18 12 41 00 68 24 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v2.20]
signature = 55 8B EC 6A FF 68 10 12 41 00 68 F4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v2.20b1]
signature = 55 8B EC 6A FF 68 30 12 41 00 68 A4 A5 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58
ep_only = true

[Armadillo v2.50]
signature = 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0
ep_only = true

[Armadillo v2.50b3]
signature = 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0
ep_only = true

[Armadillo v2.51]
signature = 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20
ep_only = true

[Armadillo v2.52]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? E0 ?? ?? ?? ?? 68 D4 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 38
ep_only = true

[Armadillo v2.52]
signature = 55 8B EC 6A FF 68 E0 ?? ?? ?? 68 D4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 38
ep_only = true

[Armadillo v2.52 beta2]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? B0 ?? ?? ?? ?? 68 60 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 24
ep_only = true

[Armadillo v2.52b2]
signature = 55 8B EC 6A FF 68 B0 ?? ?? ?? 68 60 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 24
ep_only = true

[Armadillo v2.53]
signature = 55 8B EC 6A FF 68 40 ?? ?? ?? 68 54 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC
ep_only = true

[Armadillo v2.53]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 40 ?? ?? ?? ?? 68 54 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 58 33 D2 8A D4 89
ep_only = true

[Armadillo v2.53b3]
signature = 55 8B EC 6A FF 68 D8 ?? ?? ?? 68 14 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15
ep_only = true

[Armadillo v2.5x - v2.6x]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC
ep_only = true

[Armadillo v2.60]
signature = 55 8B EC 6A FF 68 D0 ?? ?? ?? 68 34 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 68 ?? ?? ?? 33 D2 8A D4 89 15 84
ep_only = true

[Armadillo v2.60a]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 94 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 B4
ep_only = true

[Armadillo v2.60b1]
signature = 55 8B EC 6A FF 68 50 ?? ?? ?? 68 74 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 FC
ep_only = true

[Armadillo v2.60b2]
signature = 55 8B EC 6A FF 68 90 ?? ?? ?? 68 24 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 60 ?? ?? ?? 33 D2 8A D4 89 15 3C
ep_only = true

[Armadillo v2.60c]
signature = 55 8B EC 6A FF 68 40 ?? ?? ?? 68 F4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 F4
ep_only = true

[Armadillo v2.61]
signature = 55 8B EC 6A FF 68 28 ?? ?? ?? 68 E4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 0C
ep_only = true

[Armadillo v2.65b1]
signature = 55 8B EC 6A FF 68 38 ?? ?? ?? 68 40 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 F4
ep_only = true

[Armadillo v2.75a]
signature = 55 8B EC 6A FF 68 68 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24
ep_only = true

[Armadillo v2.85]
signature = 55 8B EC 6A FF 68 68 ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24
ep_only = true

[Armadillo v2.xx (CopyMem II)]
signature = 6A ?? 8B B5 ?? ?? ?? ?? C1 E6 04 8B 85 ?? ?? ?? ?? 25 07 ?? ?? 80 79 05 48 83 C8 F8 40 33 C9 8A 88 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 81 E2 07 ?? ?? 80 79 05 4A 83 CA F8 42 33 C0 8A 82
ep_only = true

[Armadillo v3.00]
signature = 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9
ep_only = true

[Armadillo v3.00a]
signature = 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB
ep_only = true

[Armadillo v3.01, v3.05]
signature = 60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F
ep_only = true

[Armadillo v3.10]
signature = 55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1
ep_only = true

[Armadillo v3.xx]
signature = 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58
ep_only = true

[Armadillo v4.00.0053 -> Silicon Realms Toolworks]
signature = 55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1
ep_only = true

[Armadillo v4.10 -> Silicon Realms Toolworks]
signature = 55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5
ep_only = true

[Armadillo v4.20 -> Silicon Realms Toolworks]
signature = 55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5
ep_only = true

[Armadillo v4.30 - v4.40 -> Silicon Realms Toolworks]
signature = 55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24
ep_only = true

[Armadillo v4.30 - v4.40 -> Silicon Realms Toolworks]
signature = 60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08
ep_only = true

[AsCrypt v0.1 -> SToRM - #1]
signature = 81 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? E2 ?? EB
ep_only = false

[AsCrypt v0.1 -> SToRM - #2]
signature = 80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 83 ?? ?? E2
ep_only = false

[AsCrypt v0.1 -> SToRM - #3]
signature = 80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 51 ?? ?? ?? 01 00 00 00 83 ?? ?? E2
ep_only = false

[AsCrypt v0.1 -> SToRM - #4]
signature = 80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 E2
ep_only = false

[AsCrypt v0.1 -> SToRM - #5]
signature = 83 ?? ?? E2 ?? ?? E2 ?? FF
ep_only = false

[ASDPack 2.0 -> asd]
signature = 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8D 49 00 1F 01 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 90
ep_only = false

[ASDPack 2.0 -> asd]
signature = 5B 43 83 7B 74 00 0F 84 08 00 00 00 89 43 14 E9
ep_only = false

[ASDPack 2.0 -> asd]
signature = 8B 44 24 04 56 57 53 E8 CD 01 00 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00
ep_only = true

[ASDPack v1.0 -> asd]
signature = 55 8B EC 56 53 E8 5C 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ?? ?? ?? 00 00 00 00 00 00 00 40 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 ?? 00 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5B 81 EB E6 1D 40 00 83 7D 0C 01 75 11 55 E8 4F 01 00 00 E8 6A 01 00 00 5D E8 2C 00 00 00 8B B3 1A 1E 40 00 03 B3 FA 1D 40 00 8B 76 0C AD 0B C0 74 0D FF 75 10 FF 75 0C FF 75 08 FF D0 EB EE B8 01 00 00 00 5B 5E C9 C2 0C 00 55 6A 00 FF 93 20 21 40 00 89 83 FA 1D 40 00 6A 40 68 00 10 00 00 FF B3 02 1E 40 00 6A 00 FF 93 2C 21 40 00 89 83 06 1E 40 00 8B 83 F2 1D 40 00 03 83 FA 1D 40 00 50 FF B3 06 1E 40 00 50 E8 6D 01 00 00 5F
ep_only = false

[ASPack v1.00b -> Alexey Solodovnikov]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED 92 1A 44 ?? B8 8C 1A 44 ?? 03 C5 2B 85 CD 1D 44 ?? 89 85 D9 1D 44 ?? 80 BD C4 1D 44
ep_only = true

[ASPack v1.01b -> Alexey Solodovnikov]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED D2 2A 44 ?? B8 CC 2A 44 ?? 03 C5 2B 85 A5 2E 44 ?? 89 85 B1 2E 44 ?? 80 BD 9C 2E 44
ep_only = true

[ASPack v1.02a -> Alexey Solodovnikov]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED 3E D9 43 ?? B8 38 ?? ?? ?? 03 C5 2B 85 0B DE 43 ?? 89 85 17 DE 43 ?? 80 BD 01 DE 43 ?? ?? 75 15 FE 85 01 DE 43 ?? E8 1D ?? ?? ?? E8 79 02 ?? ?? E8 12 03 ?? ?? 8B 85 03 DE 43 ?? 03 85 17 DE 43 ?? 89 44 24 1C 61 FF
ep_only = true

[ASPack v1.02b -> Alexey Solodovnikov]
signature = 60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5
ep_only = true

[ASPack v1.02b -> Alexey Solodovnikov]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED 96 78 43 ?? B8 90 78 43 ?? 03 C5 2B 85 7D 7C 43 ?? 89 85 89 7C 43 ?? 80 BD 74 7C 43
ep_only = true

[ASPack v1.03b -> Alexey Solodovnikov]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED AE 98 43 ?? B8 A8 98 43 ?? 03 C5 2B 85 18 9D 43 ?? 89 85 24 9D 43 ?? 80 BD 0E 9D 43
ep_only = true

[ASPack v1.04b -> Alexey Solodovnikov]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 12 9D ?? 89 85 1E 9D ?? ?? 80 BD 08 9D
ep_only = true

[ASPack v1.05b -> Alexey Solodovnikov]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89 85 C1 3E 44 ?? 80 BD AC 3E 44
ep_only = true

[ASPack v1.061b -> Alexey Solodovnikov]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED EA A8 43 ?? B8 E4 A8 43 ?? 03 C5 2B 85 78 AD 43 ?? 89 85 84 AD 43 ?? 80 BD 6E AD 43
ep_only = true

[ASPack v1.07b (DLL) -> Alexey Solodovnikov]
signature = 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5
ep_only = true

[ASPack v1.07b -> Alexey Solodovnikov]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 0B DE ?? 89 85 17 DE ?? ?? 80 BD 01 DE
ep_only = true

[ASPack v1.08.01 -> Alexey Solodovnikov]
signature = 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 00 BB 10 ?? 44 00 03 DD 2B 9D
ep_only = true

[ASPack v1.08.01 -> Alexey Solodovnikov]
signature = 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 ?? BB 10 ?? 44 ?? 03 DD 2B 9D
ep_only = true

[ASPack v1.08.01 -> Alexey Solodovnikov]
signature = 60 EB ?? 5D EB ?? FF ?? ?? ?? ?? ?? E9
ep_only = true

[ASPack v1.08.02 -> Alexey Solodovnikov]
signature = 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ED 23 6A 44 00 BB 10 ?? 44 00 03 DD 2B 9D 72
ep_only = true

[ASPack v1.08.03 -> Alexey Solodovnikov]
signature = 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD
ep_only = true

[ASPack v1.08.03 -> Alexey Solodovnikov]
signature = 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E
ep_only = true

[ASPack v1.08.03 -> Alexey Solodovnikov]
signature = 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD
ep_only = true

[ASPack v1.08.03 -> Alexey Solodovnikov]
signature = 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E
ep_only = true

[ASPack v1.08.04 -> Alexey Solodovnikov]
signature = 60 E8 41 06 00 00 EB 41
ep_only = true

[ASPack v1.08.x -> Alexey Solodovnikov]
signature = 60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 00 BB 10 6A 44 00 03 DD 2B 9D 2A
ep_only = true

[ASPack v2.000 -> Alexey Solodovnikov]
signature = 60 E8 70 05 00 00 EB 4C
ep_only = true

[ASPack v2.001 -> Alexey Solodovnikov]
signature = 60 E8 72 05 00 00 EB 4C
ep_only = true

[ASPack v2.1 -> Alexey Solodovnikov]
signature = 60 E8 72 05 00 00 EB 33 87 DB 90 00
ep_only = true

[ASPack v2.11b -> Alexey Solodovnikov]
signature = 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 3D 04 00 00
ep_only = true

[ASPack v2.11c -> Alexey Solodovnikov]
signature = 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 59 04 00 00
ep_only = true

[ASPack v2.11d -> Alexey Solodovnikov]
signature = 60 E8 02 00 00 00 EB 09 5D 55
ep_only = true

[ASPack v2.12 -> Alexey Solodovnikov]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01
ep_only = true

[ASPack v2.12 -> Alexey Solodovnikov]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB
ep_only = true

[ASPack v2.xx -> Alexey Solodovnikov]
signature = A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95
ep_only = true

[ASPack v2.xx -> Alexey Solodovnikov]
signature = A8 03 ?? ?? 61 75 08 B8 01 ?? ?? ?? C2 0C ?? 68 ?? ?? ?? ?? C3 8B 85 26 04 ?? ?? 8D 8D 3B 04 ?? ?? 51 50 FF 95
ep_only = true

[ASPR Stripper v2.x unpacked]
signature = BB ?? ?? ?? ?? E9 ?? ?? ?? ?? 60 9C FC BF ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 AA 9D 61 C3 55 8B EC
ep_only = true

[ASProtect 1.33 - 2.1 Registered -> Alexey Solodovnikov]
signature = 68 01 ?? ?? ?? E8 01 00 00 00 C3 C3
ep_only = true

[ASProtect SKE 2.1x (dll) -> Alexey Solodovnikov]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[ASProtect SKE 2.1x (exe) -> Alexey Solodovnikov]
signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[ASProtect v1.0]
signature = 60 E8 01 ?? ?? ?? 90 5D 81 ED ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D
ep_only = true

[ASProtect v1.1]
signature = 60 E9 ?? 04 ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? EE
ep_only = true

[ASProtect v1.1 MTE]
signature = 60 E9 ?? ?? ?? ?? 91 78 79 79 79 E9
ep_only = true

[ASProtect v1.1 MTEc]
signature = 90 60 E8 1B ?? ?? ?? E9 FC
ep_only = true

[ASProtect v1.2 -> Alexey Solodovnikov (h1)]
signature = 90 60 E8 1B 00 00 00 E9 FC 8D B5 0F 06 00 00 8B FE B9 97 00 00 00 AD 35 78 56 34 12 AB 49 75 F6 EB 04 5D 45 55 C3 E9 ?? ?? ?? 00
ep_only = false

[ASProtect v1.23 RC1]
signature = 68 01 ?? ?? 00 E8 01 00 00 00 C3 C3
ep_only = true

[ASProtect v1.23 RC4 build 08.07 (dll) -> Alexey Solodovnikov]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[ASProtect v1.23 RC4 build 08.07 (exe) -> Alexey Solodovnikov]
signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[ASProtect v1.2x]
signature = 00 00 68 01 ?? ?? ?? C3 AA
ep_only = true

[ASProtect v1.2x (New Strain)]
signature = 68 01 ?? ?? ?? E8 01 ?? ?? ?? C3 C3
ep_only = true

[ASProtect v2.0]
signature = 68 01 ?? 40 00 E8 01 00 00 00 C3 C3
ep_only = false

[ASProtect V2.X DLL -> Alexey Solodovnikov]
signature = 60 E8 03 00 00 00 E9 ?? ?? 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ?? ?? ?? ?? 03 DD
ep_only = true

[ASProtect v?.? -> If you know this version, post on PEiD board (h2)]
signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[ASProtect vx.x]
signature = 60 ?? ?? ?? ?? ?? 90 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 03 DD
ep_only = true

[ass - crypter -> by santasdad]
signature = 55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 ?? ?? ?? ?? 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B D8 53 E8 DC EA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 F0 97 00 10 E8 C9 E7 FF FF B8 F0 97 00 10 E8 B7 E7 FF FF 8B CF 8B D6 E8 EE EA FF FF 53 E8 98 EA FF FF 8D 4D EC BA 9C 51 00 10 A1 F0 97 00 10 E8 22 EB FF FF 8B 55 EC B8 F0 97 00 10 E8 89 E6 FF FF B8 F0 97 00 10 E8 7F E7 FF FF E8 6E EC FF FF 33 C0 5A 59 59 64 89 10 68 7F 51 00 10 8D 45 EC E8 11 E6 FF FF C3 E9 FF DF FF FF EB F0 5F 5E 5B E8 0D E5 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 1C 00 00 00 45 4E 54 45 52 20 59 4F 55 52 20 4F 57 4E 20 50 41 53 53 57 4F 52 44 20 48 45 52 45
ep_only = true

[AverCryptor 1.0 -> os1r1s]
signature = 60 E8 00 00 00 00 5D 81 ED 75 17 40 00 8B BD 9C 18 40 00 8B 8D A4 18 40 00 B8 BC 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 A0 18 40 00 33 C0 51 33 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 A0 18 40 00 8B 85 A8 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 BC 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 98 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3
ep_only = true

[AverCryptor 1.02 beta -> os1r1s]
signature = 60 E8 00 00 00 00 5D 81 ED 0C 17 40 00 8B BD 33 18 40 00 8B 8D 3B 18 40 00 B8 51 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 37 18 40 00 33 C0 51 33 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 37 18 40 00 8B 85 3F 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 51 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 2F 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3
ep_only = true

[AVPACK v1.20]
signature = 50 1E 0E 1F 16 07 33 F6 8B FE B9 ?? ?? FC F3 A5 06 BB ?? ?? 53 CB
ep_only = true

[AZProtect 0001 - by AlexZ aka AZCRC]
signature = EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 BE 00 ?? ?? 00 BF 00 00 40 00 EB 17 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00 FF 25 ?? ?? ?? 00 8B C6 03 C7 8B F8 57 55 8B EC 05 7F 00 00 00 50 E8 E5 FF FF FF BA 8C ?? ?? 00 89 02 E9 1A 01 00 00 ?? 00 00 00 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 47 65 74 56 6F 6C 75 6D 65 49 6E 66 6F 72 6D 61 74 69 6F 6E 41 00 4D 65 73 73 61 67 65 42 6F 78 41 00 45 78 69 74 50 72 6F 63 65 73 73 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41
ep_only = true

[AZProtect 0001 - by AlexZ aka AZCRC]
signature = FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83 FB 08 72 05 33 DB 43 EB 01 43 33 C0 8A 04 31 8A 24 13 2A C4 88 04 31 E2 E6 5E 5B C9 C2 0C
ep_only = false

[bambam 0.01 -> bedrock]
signature = 6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0
ep_only = true

[bambam 0.04 -> bedrock]
signature = BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 C0 09 00 00
ep_only = true

[BamBam v0.01 -> Bedrock]
signature = 6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1
ep_only = false

[beria v0.07 public WIP --> symbiont]
signature = 83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0
ep_only = true

[BeRo Tiny Pascal -> BeRo]
signature = E9 ?? ?? ?? ?? 20 43 6F 6D 70 69 6C 65 64 20 62 79 3A 20 42 65 52 6F 54 69 6E 79 50 61 73 63 61 6C 20 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 32 30 30 36 2C 20 42 65 6E 6A 61 6D 69 6E 20 27 42 65 52 6F 27 20 52 6F 73 73 65 61 75 78 20
ep_only = true

[BeRoEXEPacker V1.00 -> BeRo]
signature = BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74 0B AB 83 C3 04 EB D8 83 C6 14 EB AA 61 C3
ep_only = false

[BeRoEXEPacker v1.00 DLL [LZBRR] -> BeRo / Farbrausch]
signature = 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10
ep_only = true

[BeRoEXEPacker v1.00 DLL [LZBRS] -> BeRo / Farbrausch]
signature = 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33
ep_only = true

[BeRoEXEPacker v1.00 DLL [LZMA] -> BeRo / Farbrausch]
signature = 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8
ep_only = true

[BeRoEXEPacker v1.00 [LZBRR] -> BeRo / Farbrausch]
signature = 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10
ep_only = true

[BeRoEXEPacker v1.00 [LZBRS] -> BeRo / Farbrausch]
signature = 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33
ep_only = true

[BeRoEXEPacker v1.00 [LZMA] -> BeRo / Farbrausch]
signature = 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8
ep_only = true

[BlackEnergy DDoS Bot Crypter]
signature = 55 ?? ?? 81 EC 1C 01 00 00 53 56 57 6A 04 BE 00 30 00 00 56 FF 35 00 20 11 13 6A 00 E8 ?? 03 00 00 ?? ?? 83 C4 10 ?? FF 89 7D F4 0F
ep_only = true

[Blade Joiner v1.5]
signature = 55 8B EC 81 C4 E4 FE FF FF 53 56 57 33 C0 89 45 F0 89 85
ep_only = true

[BlindSpot 1.0 -> s134k]
signature = 55 8B EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD FF FF 68 00 01 00 00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD FF FF 68 00 00 00 80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15 1C 10 40 00 8D 45 F8 8B 1D 18 10 40 00 56 50 6A 34 FF 35 90 12 40 00 FF 75 FC FF D3 85 C0 0F 84 7F 01 00 00 39 75 F8 0F 84 76 01 00 00 A1 90 12 40 00 66 8B 40 30 66 3D 01 00 75 14 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 14 10 40 00 EB 2C 66 3D 02 00 75 14 8D 85 E4 FE FF FF 50 68 04 01 00 00 FF 15 10 10 40 00 EB 12 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 0C 10 40 00 8B 3D 08 10 40 00 8D 85 E4 FE FF FF 68 54 10 40 00 50
ep_only = false

[BobPack v1.00 --> BoB / BobSoft]
signature = 60 E8 00 00 00 00 8B 0C 24 89 CD 83 E9 06 81 ED ?? ?? ?? ?? E8 3D 00 00 00 89 85 ?? ?? ?? ?? 89 C2 B8 5D 0A 00 00 8D 04 08 E8 E4 00 00 00 8B 70 04 01 D6 E8 76 00 00 00 E8 51 01 00 00 E8 01 01
ep_only = true

[BobSoft Mini Delphi -> BoB / BobSoft]
signature = 55 8B EC 83 C4 F0 53 56 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8
ep_only = true

[BobSoft Mini Delphi -> BoB / BobSoft]
signature = 55 8B EC 83 C4 F0 53 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8 ?? ?? ?? ?? E8
ep_only = true

[BobSoft Mini Delphi -> BoB / BobSoft]
signature = 55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8
ep_only = true

[BopCrypt v1.0]
signature = 60 BD ?? ?? ?? ?? E8 ?? ?? 00 00
ep_only = true

[CD-Cops II]
signature = 53 60 BD ?? ?? ?? ?? 8D 45 ?? 8D 5D ?? E8 ?? ?? ?? ?? 8D
ep_only = true

[CDS SS 1.0 beta1 -> CyberDoom]
signature = 60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8 4E 40 00 E8 D7 03 00 00 0B C0 0F 84 A9 02 00 00 E8 F9 02 00 00 89 85 94 4E 40 00 8D 85 12 4D 40 00 50
ep_only = true

[CDS SS v1.0 Beta 1 -> CyberDoom / Team-X]
signature = 60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8
ep_only = true

[Celsius Crypt 2.1 -> Z3r0]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 84 92 44 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 84 92 44 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D C4 92 44 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D AC 92 44 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 77 C2 00 00 90 90 90 90 90 90 90 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3
ep_only = true

[Celsius Crypt 2.1 -> Z3r0]
signature = 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3
ep_only = false

[CERBERUS v2.0]
signature = 9C 2B ED 8C ?? ?? 8C ?? ?? FA E4 ?? 88 ?? ?? 16 07 BF ?? ?? 8E DD 9B F5 B9 ?? ?? FC F3 A5
ep_only = true

[CExe v1.0a]
signature = 55 8B EC 81 EC 0C 02 ?? ?? 56 BE 04 01 ?? ?? 8D 85 F8 FE FF FF 56 50 6A ?? FF 15 54 10 40 ?? 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16
ep_only = true

[CHECKPRG (c) 1992]
signature = 33 C0 BE ?? ?? 8B D8 B9 ?? ?? BF ?? ?? BA ?? ?? 47 4A 74
ep_only = true

[ChinaProtect -> dummy]
signature = C3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 56 8B ?? ?? ?? 6A 40 68 00 10 00 00 8D ?? ?? 50 6A 00 E8 ?? ?? ?? ?? 89 30 83 C0 04 5E C3 8B 44 ?? ?? 56 8D ?? ?? 68 00 40 00 00 FF 36 56 E8 ?? ?? ?? ?? 68 00 80 00 00 6A 00 56 E8 ?? ?? ?? ?? 5E C3
ep_only = false

[ChSfx (small) v1.1]
signature = BA ?? ?? E8 ?? ?? 8B EC 83 EC ?? 8C C8 BB ?? ?? B1 ?? D3 EB 03 C3 8E D8 05 ?? ?? 89
ep_only = true

[CICompress v1.0]
signature = 6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35
ep_only = true

[CipherWall Self-Extrator/Decryptor (Console) v1.5]
signature = 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4
ep_only = true

[CipherWall Self-Extrator/Decryptor (GUI) v1.5]
signature = 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4
ep_only = true

[Code Virtualizer 1.3.1.0 -> Oreans Technologies]
signature = 60 9C FC E8 00 00 00 00 5F 81 EF ?? ?? ?? ?? 8B C7 81 C7 ?? ?? ?? ?? 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9 01 00 00 00 33 C0 F0 0F B1 4F 30 75 F7 AC
ep_only = false

[Code-Lock vx.x]
signature = 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00
ep_only = true

[CodeCrypt v0.14b]
signature = E9 C5 02 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F
ep_only = true

[CodeCrypt v0.15b]
signature = E9 31 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F
ep_only = true

[CodeCrypt v0.164]
signature = E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F EB 03 FF 1D 34
ep_only = true

[CodeCrypt v0.16b - v0.163b]
signature = E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F
ep_only = true

[codeCrypter 0.31]
signature = 50 58 53 5B 90 BB ?? ?? 40 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC
ep_only = false

[codeCrypter 0.31 -> Tibbar]
signature = 50 58 53 5B 90 BB ?? ?? ?? 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC
ep_only = true

[COP v1.0 (c) 1988]
signature = BF ?? ?? BE ?? ?? B9 ?? ?? AC 32 ?? ?? ?? AA E2 ?? 8B ?? ?? ?? EB ?? 90
ep_only = true

[Copy Protector v2.0]
signature = 2E A2 ?? ?? 53 51 52 1E 06 B4 ?? 1E 0E 1F BA ?? ?? CD 21 1F
ep_only = true

[CopyControl v3.03]
signature = CC 90 90 EB 0B 01 50 51 52 53 54 61 33 61 2D 35 CA D1 07 52 D1 A1 3C
ep_only = true

[CopyMinder -> Microcosm.Ltd]
signature = 83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25
ep_only = true

[CPAV]
signature = E8 ?? ?? 4D 5A B1 01 93 01 00 00 02
ep_only = true

[CrackStop v1.01 (c) Stefan Esser 1997]
signature = B4 48 BB FF FF B9 EB 27 8B EC CD 21 FA FC
ep_only = true

[CreateInstall Stub vx.x]
signature = 55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56
ep_only = true

[CreateInstall v2003.3.5]
signature = 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40
ep_only = false

[Crinkler V0.1-V0.2 -> Rune L.H.Stubbe and Aske Simon Christensen]
signature = B9 ?? ?? ?? ?? 01 C0 68 ?? ?? ?? ?? 6A 00 58 50 6A 00 5F 48 5D BB 03 00 00 00 BE ?? ?? ?? ?? E9
ep_only = true

[Crinkler V0.3-V0.4 -> Rune L.H.Stubbe and Aske Simon Christensen]
signature = B8 00 00 42 00 31 DB 43 EB 58
ep_only = true

[Crunch 5 Fusion 4]
signature = EB 15 03 ?? ?? ?? 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 55 E8
ep_only = false

[Crunch v4.0]
signature = EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24
ep_only = true

[Crunch v5 -> Bit-Arts]
signature = EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00
ep_only = true

[Crunch/PE]
signature = 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85
ep_only = true

[Crunch/PE v1.0.x.x]
signature = 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 09 C6 85
ep_only = true

[Crunch/PE v2.0.x.x]
signature = 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 55 BB ?? ?? ?? ?? 03 DD 53 64 67 FF 36 ?? ?? 64 67 89 26
ep_only = true

[Crunch/PE v3.0.x.x]
signature = EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? FF 74
ep_only = true

[Crunch/PE v4.0]
signature = EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24
ep_only = false

[Cruncher v1.0]
signature = 2E ?? ?? ?? ?? 2E ?? ?? ?? B4 30 CD 21 3C 03 73 ?? BB ?? ?? 8E DB 8D ?? ?? ?? B4 09 CD 21 06 33 C0 50 CB
ep_only = true

[CrypKey v5 - v6]
signature = E8 ?? ?? ?? ?? 58 83 E8 05 50 5F 57 8B F7 81 EF ?? ?? ?? ?? 83 C6 39 BA ?? ?? ?? ?? 8B DF B9 0B ?? ?? ?? 8B 06
ep_only = true

[CrypKey V5.6.X -> Kenonic Controls Ltd.]
signature = E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 00 75 07 6A 00 E8
ep_only = true

[CrypKey V5.6.X DLL -> Kenonic Controls Ltd.]
signature = 8B 1D ?? ?? ?? ?? 83 FB 00 75 0A E8 ?? ?? ?? ?? E8
ep_only = true

[CrypKey V6.1X DLL -> CrypKey (Canada) Inc.]
signature = 83 3D ?? ?? ?? ?? 00 75 34 68 ?? ?? ?? ?? E8
ep_only = true

[CRYPT Version 1.7 (c) Dismember]
signature = 0E 17 9C 58 F6 ?? ?? 74 ?? E9
ep_only = true

[Crypter 3.1 -> SLESH]
signature = 68 FF 64 24 F0 68 58 58 58 58 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68
ep_only = false

[Cryptic 2.0 -> Tughack]
signature = B8 00 00 40 00 BB ?? ?? ?? 00 B9 00 10 00 00 BA ?? ?? ?? 00 03 D8 03 C8 03 D1 3B CA 74 06 80 31 ?? 41 EB F6 FF E3
ep_only = true

[Crypto-Lock v2.02 (Eng) -> Ryan Thian]
signature = 60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47
ep_only = true

[Crypto-Lock v2.02 (Eng) -> Ryan Thian]
signature = 60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0
ep_only = true

[Crypto-Lock v2.02 (Eng) -> Ryan Thian]
signature = 60 BE ?? 90 40 00 8D BE ?? ?? FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0
ep_only = true

[CRYPToCRACk's PE Protector V0.9.2 -> Lukas Fleischer]
signature = E8 01 00 00 00 E8 58 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 37 84 DB 75 33 8B F3 03 ?? ?? 81 3E 50 45 00 00 75 26
ep_only = true

[CRYPToCRACk's PE Protector V0.9.3 -> Lukas Fleischer]
signature = 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1
ep_only = true

[CrypWrap vx.x]
signature = E8 B8 ?? ?? ?? E8 90 02 ?? ?? 83 F8 ?? 75 07 6A ?? E8 ?? ?? ?? ?? FF 15 49 8F 40 ?? A9 ?? ?? ?? 80 74 0E
ep_only = true

[Cygwin32]
signature = 55 89 E5 83 EC 04 83 3D
ep_only = true

[D1NS1G -> D1N]
signature = 18 37 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? 18 37 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 F0 00 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 F0 00 00 60 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[D1S1G v1.1 Beta ++ Scrambled EXE -> D1N]
signature = E8 07 00 00 00 E8 1E 00 00 00 C3 90 58 89 C2 89 C2 25 00 F0 FF FF 50 83 C0 55 8D 00 FF 30 8D 40 04 FF 30 52 C3 8D 40 00 55 8B EC 83 C4 E8 53 56 57 8B 4D 10 8B 45 08 89 45 F8 8B 45 0C 89 45 F4 8D 41 61 8B 38 8D 41 65 8B 00 03 C7 89 45 FC 8D 41 69 8B 00 03 C7 8D 51 6D 8B 12 03 D7 83 C1 71 8B 09 03 CF 2B CA 72 0A 41 87 D1 80 31 FF 41 4A 75 F9 89 45 F0 EB 71 8B
ep_only = false

[D1S1G v1.1 beta --> D1N]
signature = 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 ?? ?? 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00
ep_only = false

[DAEMON Protect v0.6.7]
signature = 60 60 9C 8C C9 32 C9 E3 0C 52 0F 01 4C 24 FE 5A 83 C2 0C 8B 1A 9D 61
ep_only = true

[DalKrypt 1.0 - by DalKiT]
signature = 68 00 10 40 00 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14 03 43 81 FB ?? ?? ?? 00 72 EB FF E7
ep_only = true

[DBPE v1.53]
signature = 9C 55 57 56 52 51 53 9C FA E8 ?? ?? ?? ?? 5D 81 ED 5B 53 40 ?? B0 ?? E8 ?? ?? ?? ?? 5E 83 C6 11 B9 27 ?? ?? ?? 30 06 46 49 75 FA
ep_only = true

[DBPE v2.10]
signature = 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0 7A 01 75 83 C4 04 9D EB 01 75 68 5F 20 40 ?? E8 B0 EF FF FF 72 03 73 01 75 BE
ep_only = true

[DBPE v2.10 -> Ding Boy]
signature = EB 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? EB 58 75 73 65 72 33 32 2E 64 6C 6C ?? 4D 65 73 73 61 67 65 42 6F 78 41 ?? 6B 65 72 6E 65 6C
ep_only = true

[DBPE v2.33 -> Ding Boy]
signature = EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71
ep_only = true

[DBPE vx.xx -> Ding Boy]
signature = EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED
ep_only = true

[DCrypt Private 0.9b -> drmist]
signature = B9 ?? ?? ?? 00 E8 00 00 00 00 58 68 ?? ?? ?? 00 83 E8 0B 0F 18 00 D0 00 48 E2 FB C3
ep_only = true

[DEF 1.0 -> bart/xt]
signature = BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[DEF v1.0]
signature = BE ?? 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46
ep_only = true

[DEF v1.0]
signature = BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? 10 40 00 C3
ep_only = false

[DEF v1.00 (Eng) -> bart/xt]
signature = BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[dePACK -> deNULL]
signature = EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? 00 00 E8 ?? 00 00 00
ep_only = true

[dePACK -> deNULL]
signature = EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? ?? 00 E8 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? D2
ep_only = true

[Dev-C++ 4.9.9.2 -> Bloodshed Software]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D
ep_only = true

[Dev-C++ v4]
signature = 55 89 E5 83 EC 08 83 C4 F4 6A ?? A1 ?? ?? ?? 00 FF D0 E8 ?? FF FF FF
ep_only = false

[Dev-C++ v5]
signature = 55 89 E5 83 EC 14 6A ?? FF 15 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00
ep_only = false

[DIET v1.00, v1.00d]
signature = BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC
ep_only = true

[DIET v1.00d]
signature = FC 06 1E 0E 8C C8 01 ?? ?? ?? BA ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00
ep_only = true

[DIET v1.02b, v1.10a, v1.20]
signature = BE ?? ?? BF ?? ?? B9 ?? ?? 3B FC 72 ?? B4 4C CD 21 FD F3 A5 FC
ep_only = true

[DIET v1.44, v1.45f]
signature = F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 BA ?? ?? 03 D0 52
ep_only = true

[Ding Boy's PE-lock Phantasm v0.8]
signature = 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 0D 39 40 00
ep_only = true

[Ding Boy's PE-lock Phantasm v1.0 / v1.1]
signature = 55 57 56 52 51 53 66 81 C3 EB 02 EB FC 66 81 C3 EB 02 EB FC
ep_only = true

[Ding Boy's PE-lock Phantasm v1.5b3]
signature = 9C 55 57 56 52 51 53 9C FA E8 00 00 00 00 5D 81 ED 5B 53 40 00 B0
ep_only = true

[Ding Boy's PE-lock v0.07]
signature = 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 23 35 40 00
ep_only = true

[diPacker V1.X -> diProtector Software]
signature = 0F 00 2D E9 01 00 A0 E3 68 01 00 EB 8C 00 00 EB 2B 00 00 EB 00 00 20 E0 1C 10 8F E2 8E 20 8F E2 00 30 A0 E3 67 01 00 EB 0F 00 BD E8 00 C0 8F E2 00 F0 9C E5
ep_only = true

[diProtector V1.X -> diProtector Software]
signature = 01 00 A0 E3 14 00 00 EB 00 00 20 E0 44 10 9F E5 03 2A A0 E3 40 30 A0 E3 AE 00 00 EB 30 00 8F E5 00 20 A0 E1 3A 0E 8F E2 00 00 80 E2 1C 10 9F E5 20 30 8F E2 0E 00 00 EB 14 00 9F E5 14 10 9F E5 7F 20 A0 E3 C5 00 00 EB 04 C0 8F E2 00 F0 9C E5
ep_only = true

[DJoin v0.7 public (RC4 encryption) -> drmist]
signature = C6 05 ?? ?? 40 00 00 C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00
ep_only = true

[DJoin v0.7 public (xor encryption) -> drmist]
signature = C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00
ep_only = true

[DotFix Nice Protect 2.1 -> GPcH Soft]
signature = E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 B8 ?? ?? ?? ?? 03 C5 50 B8 ?? ?? ?? ?? 03 C5 FF 10 BB ?? ?? ?? ?? 03 DD 83 C3 0C 53 50 B8 ?? ?? ?? ?? 03 C5 FF 10 6A 40 68 00 10 00 00 FF 74 24 2C 6A 00 FF D0 89 44 24 1C 61 C3
ep_only = false

[DotFix NiceProtect vna]
signature = 60 E8 55 00 00 00 8D BD 00 10 40 00 68 ?? ?? ?? 00 03 3C 24 8B F7 90 68 31 10 40 00 9B DB E3 55 DB 04 24 8B C7 DB 44 24 04 DE C1 DB 1C 24 8B 1C 24 66 AD 51 DB 04 24 90 90 DA 8D 77 10 40 00 DB 1C 24 D1 E1 29
ep_only = true

[Dr.Web Virus-Finding Engine -> InSoft EDV-Systeme]
signature = B8 01 00 00 00 C2 0C 00 8D 80 00 00 00 00 8B D2 8B ?? 24 04
ep_only = true

[DragonArmor -> Orient]
signature = BF 4C ?? ?? 00 83 C9 FF 33 C0 68 34 ?? ?? 00 F2 AE F7 D1 49 51 68 4C ?? ?? 00 E8 11 0A 00 00 83 C4 0C 68 4C ?? ?? 00 FF 15 00 ?? ?? 00 8B F0 BF 4C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF 5C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 5C ?? ?? 00 E8 C0 09 00 00 8B 1D 04 ?? ?? 00 83 C4 0C 68 5C ?? ?? 00 56 FF D3 A3 D4 ?? ?? 00 BF 5C ?? ?? 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 5C ?? ?? 00 8B D1 68 34 ?? ?? 00 C1 E9 02 F3 AB 8B CA 83 E1
ep_only = false

[Dropper Creator V0.1 -> Conflict]
signature = 60 E8 00 00 00 00 5D 8D 05 ?? ?? ?? ?? 29 C5 8D 85 ?? ?? ?? ?? 31 C0 64 03 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09
ep_only = false

[DSHIELD]
signature = 06 E8 ?? ?? 5E 83 EE ?? 16 17 9C 58 B9 ?? ?? 25 ?? ?? 2E
ep_only = true

[Dual's eXe 1.0]
signature = 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00
ep_only = true

[Dual's eXe Encryptor 1.0b -> Dual]
signature = 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 3A 04 00 00 89 28 33 FF 8D 85 80 03 00 00 8D 8D 3A 04 00 00 2B C8 8B 9D 8A 04 00 00 E8 24 02 00 00 8D 9D 58 03 00 00 8D B5 7F 03 00 00 46 80 3E 00 74 24 56 FF 95 58 05 00 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7 50 56 50 FF 95 5C 05 00 00 89 03 58 83 C3 04 EB E3 8D 85 69 02 00 00 FF D0 8D 85 56 04 00 00 50 68 1F 00 02 00 6A 00 8D 85 7A 04 00 00 50
ep_only = true

[dUP 2.x Patcher --> www.diablo2oo2.cjb.net]
signature = 8B CB 85 C9 74 ?? 80 3A 01 74 08 AC AE 75 0A 42 49 EB EF 47 46 42 49 EB E9
ep_only = false

[dUP2 -> diablo2oo2]
signature = E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75 19 BE ?? ?? ?? ?? 68 00 02 00 00 56 68
ep_only = true

[DxPack 1.0]
signature = 60 E8 ?? ?? ?? ?? 5D 8B FD 81 ED ?? ?? ?? ?? 2B B9 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84
ep_only = true

[DxPack V0.86 -> Dxd]
signature = 60 E8 00 00 00 00 5D 8B FD 81 ED 06 10 40 00 2B BD 94 12 40 00 81 EF 06 00 00 00 83 BD 14 13 40 00 01 0F 84 2F 01 00 00
ep_only = true

[DzA Patcher v1.3 Loader]
signature = BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35
ep_only = false

[E language]
signature = E8 06 00 00 00 50 E8 ?? 01 00 00 55 8B EC 81 C4 F0 FE FF FF
ep_only = true

[E.You.Di.Dai-> YueHeiFengGao]
signature = 55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 0F 31 8B D8 0F 31 8B D0 2B D3 C1 EA 10 B8 ?? ?? ?? ?? 0F 6E C0 B8 ?? ?? ?? ?? 0F 6E C8 0F F5 C1 0F 7E C0 0F 77 03 C2 ?? ?? ?? ?? ?? FF E0
ep_only = true

[E2C by DoP]
signature = BE ?? ?? BF ?? ?? B9 ?? ?? FC 57 F3 A5 C3
ep_only = true

[EEXE Version 1.12]
signature = B4 30 CD 21 3C 03 73 ?? BA 1F 00 0E 1F B4 09 CD 21 B8 FF 4C CD 21
ep_only = true

[Elicense System V4.0.0.0 -> ViaTech Inc]
signature = 00 00 00 00 63 79 62 00 65 6C 69 63 65 6E 34 30 2E 64 6C 6C 00 00 00 00
ep_only = false

[Embed PE v1.13 -> cyclotron]
signature = 83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68
ep_only = true

[EmbedPE 1.13 -> cyclotron]
signature = 83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33
ep_only = true

[EmbedPE V1.00-V1.24 -> cyclotron]
signature = 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00
ep_only = false

[EmbedPE v1.24 -> cyclotron]
signature = 83 EC 50 60 68 ?? ?? ?? ?? E8 CB FF 00 00
ep_only = true

[EmbedPE V1.X -> cyclotron]
signature = 83 EC 50 60 68 ?? ?? ?? ?? E8 ?? ?? 00 00
ep_only = true

[EncryptPE 1.2003.3.18-1.2003.5.18 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73
ep_only = true

[EncryptPE 1.2003.5.18 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 79
ep_only = true

[EncryptPE 2.2004.6.16-2.2006.6.30 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73
ep_only = true

[EncryptPE 2.2004.8.10 - 2.2005.3.14 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 7A
ep_only = true

[EncryptPE 2.2006.7.10-2.2006.10.25 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73
ep_only = true

[EncryptPE V2.2006.1.15 -> WFS]
signature = 45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 36 2E 31 2E 31 35
ep_only = false

[EncryptPE V2.2006.7.10 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00
ep_only = true

[EncryptPE V2.2006.7.10 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00
ep_only = true

[EncryptPE V2.2007.04.11 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73
ep_only = true

[EncryptPE V2.2007.4.11 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 00
ep_only = true

[ENIGMA Protector -> Sukhov Vladimir]
signature = 45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31
ep_only = false

[Enigma Protector 1.0X -> Sukhov Vladimir]
signature = 60 E8 00 00 00 00 5D 83 ?? ?? 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 C4 04 EB 02 ?? ?? 60 E8 24 00 00 00 00 00 ?? EB 02 ?? ?? 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 ?? ?? 89 C4 61 EB 2E ?? ?? ?? ?? ?? ?? ?? EB 01 ?? 31 C0 EB 01 ?? 64 FF 30 EB 01 ?? 64 89 20 EB 02 ?? ?? 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 ?? 58 61 EB 01
ep_only = false

[Enigma protector 1.10 (unregistered)]
signature = 60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89
ep_only = false

[Enigma protector 1.10 (unregistered)]
signature = 60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89 E9 51 0B C4 80 BC 7E 35 09 37 E7 C9 3D C9 45 C9 4D 74 92 BA E4 E9 24 6B DF 3E 0E 38 0C 49 10 27 80 51 A1 8E 3A A3 C8 AE 3B 1C 35
ep_only = false

[Enigma protector 1.10/1.11 -> Vladimir Sukhov]
signature = 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31
ep_only = false

[Enigma protector 1.10/1.11 -> Vladimir Sukhov]
signature = 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 B9 3D 1A
ep_only = false

[Enigma protector 1.12 -> Vladimir Sukhov]
signature = 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB 04 ?? ?? ?? ?? B8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 B9 44 1A
ep_only = false

[Enigma Protector 1.1X-1.3X -> Sukhov Vladimir & Serge N. Markin]
signature = 55 8B EC 83 C4 F0 B8 00 10 40 00 E8 01 00 00 00 9A 83 C4 10 8B E5 5D E9
ep_only = false

[Enigma Protector 1.31 Build 20070615 Dll -> Sukhov Vladimir & Serge N. Markin]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 81 ED ?? ?? ?? ?? E9 49 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8A 84 24 28 00 00 00 80 F8 01 0F 84 07 00 00 00 B8 ?? ?? ?? ?? FF E0 E9 04 00 00 00 ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 81 C0 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 30 10 40 49 0F 85 F6 FF FF FF E9 04 00 00 00
ep_only = true

[Enigma Protector 1.X -> Sukhov Vladimir & Serge N. Markin]
signature = 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 52 65 67 43 6C 6F 73 65 4B 65 79 00 00 00 53 79 73 46 72 65 65 53 74 72 69 6E 67 00 00 00 43 72 65 61 74 65 46 6F 6E 74 41 00 00 00 53 68 65 6C 6C 45 78 65 63 75 74 65 41 00 00
ep_only = false

[ENIGMA Protector V1.1-> Sukhov Vladimir]
signature = 60 E8 00 00 00 00 5D 83 ?? ?? 81
ep_only = true

[ENIGMA Protector V1.1-V1.2-> Sukhov Vladimir]
signature = 60 E8 00 00 00 00 5D 83 ED 06 81
ep_only = true

[Enigma Protector v1.12 LITE]
signature = 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31
ep_only = true

[ENIGMA Protector V1.12-> Sukhov Vladimir]
signature = 60 E8 00 00 00 00 5D 83 C5 FA 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31
ep_only = true

[EP v1.0]
signature = 50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1
ep_only = true

[EPW v1.2]
signature = 06 57 1E 56 55 52 51 53 50 2E ?? ?? ?? ?? 8C C0 05 ?? ?? 2E ?? ?? ?? 8E D8 A1 ?? ?? 2E
ep_only = true

[EPW v1.30]
signature = 06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 83 C0 10 2E
ep_only = true

[Escargot 0.1 (final) -> ++Meat]
signature = EB 04 40 30 2E 31 60 68 61 ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 92 ?? ?? ?? 8B 00 FF D0 50 B8 CD ?? ?? ?? 81 38 DE C0 37 13 75 2D 68 C9 ?? ?? ?? 6A 40 68 00 ?? 00 00 68 00 00 ?? ?? B8 96 ?? ?? ?? 8B 00 FF D0 8B 44 24 F0 8B 4C 24 F4 EB 05 49 C6 04 01 40 0B C9 75 F7 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50
ep_only = true

[Escargot 0.1 - by ueMeat]
signature = EB 08 28 65 73 63 30 2E 31 29 60 68 2B ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 5C ?? ?? ?? 8B 00 FF D0 50 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50 B8 54 ?? ?? ?? 8B 00 FF D0 5F 80 3F 00 74 06 C6 07 00 47 EB F5 33 FF 8B 16 0B D2 75 03 8B 56 10 03 D3 03 D7 8B 0A C7 02 00 00 00 00 0B C9 74 4B F7 C1 00 00 00 80 74 14 81 E1 FF FF 00 00 50 51 50 B8 50
ep_only = false

[Escargot V0.1 -> ++Meat]
signature = EB 04 40 30 2E 31 60 68 61
ep_only = true

[Excalibur 1.03 -> forgot]
signature = E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00
ep_only = true

[Excalibur V1.03 -> forgot]
signature = E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39
ep_only = true

[eXcalibur v1.03 -> forgot/us]
signature = E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 20 45 78 63 61 6C 69 62 75 72 20 28 63 29 20 62 79 20 66 6F 72 67 6F 74 2F 75 53 2F 44 46 43 47 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20
ep_only = true

[Exe Guarder v1.8 -> Exeicon.com]
signature = 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89
ep_only = true

[EXE joiner -> Amok]
signature = A1 14 A1 40 00 C1 E0 02 A3 18 A1 40
ep_only = true

[Exe Locker 1.0 -> IonIce]
signature = E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00
ep_only = true

[Exe Locker v1.0 --> IonIce]
signature = E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 3E 8F 85 6C 00 00 00 3E 8F 85 68 00 00 00 3E 8F 85 64 00 00 00 3E 8F 85 60 00 00 00 3E 8F 85 5C 00 00 00 3E 8F 85 58 00 00 00 3E 8F 85 54 00 00
ep_only = true

[EXE Manager Version 3.0 1994 (c) Solar Designer]
signature = B4 30 1E 06 CD 21 2E ?? ?? ?? BF ?? ?? B9 ?? ?? 33 C0 2E ?? ?? 47 E2
ep_only = true

[EXE Packer v7.0 by TurboPower Software]
signature = 1E 06 8C C3 83 ?? ?? 2E ?? ?? ?? ?? B9 ?? ?? 8C C8 8E D8 8B F1 4E 8B FE
ep_only = true

[EXE Shield v0.1b - v0.3b, v0.3 -> SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05
ep_only = true

[EXE Shield V0.5 -> Smoke]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40
ep_only = true

[EXE Shield V0.5 -> Smoke]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90
ep_only = true

[EXE Shield V0.6 -> SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40
ep_only = true

[EXE Shield V0.6 -> SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90
ep_only = true

[Exe Shield v1.7]
signature = EB 06 68 90 1F 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90
ep_only = true

[Exe Shield v2.7]
signature = EB 06 68 F4 86 06 00 C3 9C 60 E8 02 00 00
ep_only = true

[Exe Shield v2.7b]
signature = EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40
ep_only = true

[Exe Shield v2.9]
signature = 60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC ?? ?? ?? F8
ep_only = true

[Exe Shield vx.x]
signature = 65 78 65 73 68 6C 2E 64 6C 6C C0 5D 00
ep_only = true

[Exe Stealth 2.75a -> WebtoolMaster]
signature = EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72
ep_only = true

[EXE Stealth v1.1]
signature = 60 E8 00 00 00 00 5D 81 ED FB 1D 40 00 B9 7B 09 00 00 8B F7 AC
ep_only = true

[EXE Stealth v2.5]
signature = 60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC
ep_only = false

[EXE Stealth v2.7]
signature = EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED D3 26 40
ep_only = true

[EXE Stealth v2.71]
signature = EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED B0 27 40
ep_only = true

[EXE Stealth v2.72]
signature = EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20
ep_only = true

[EXE Stealth v2.73]
signature = EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00 5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02
ep_only = false

[EXE Stealth v2.74]
signature = EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9
ep_only = false

[EXE Stealth v2.74 -> WebToolMaster]
signature = EB 00 EB 17 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 90 E8 00 00 00 00 5D
ep_only = true

[EXE Stealth v2.76 -> WebToolMaster]
signature = EB 65 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 59 4F 55 52 20 41 44 20 48 45 52 45 21 50 69 52 41 43 59 20 69 53 20 41
ep_only = true

[EXE32Pack v1.36]
signature = 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED CC 8D 40
ep_only = true

[EXE32Pack v1.37]
signature = 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED 4C 8E 40
ep_only = true

[EXE32Pack v1.38]
signature = 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED DC 8D 40
ep_only = true

[EXE32Pack v1.39]
signature = 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED EC 8D 40
ep_only = true

[EXE32Pack v1.3x]
signature = 3B ?? 74 02 81 83 55 3B ?? 74 02 81 ?? 53 3B ?? 74 01 ?? ?? ?? ?? ?? 02 81 ?? ?? E8 ?? ?? ?? ?? 3B 74 01 ?? 5D 8B D5 81 ED
ep_only = true

[ExeBundle v3.0 (small loader)]
signature = 00 00 00 00 60 BE 00 F0 40 00 8D BE 00 20 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11
ep_only = true

[ExeBundle v3.0 (standard loader)]
signature = 00 00 00 00 60 BE 00 B0 42 00 8D BE 00 60 FD FF C7 87 B0 E4 02 00 31 3C 4B DF 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB
ep_only = true

[EXECrypt 1.0 -> ReBirth]
signature = 90 90 60 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 4E 28 40 00 8B F7 AC
ep_only = true

[EXECryptor 2.0/2.1 (protected IAT)]
signature = A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00 00 FF FF FF FF B8 ?? ?? ?? D4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41
ep_only = false

[EXECryptor 2.1.17 -> Strongbit/SoftComplete Development]
signature = BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01
ep_only = false

[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h1)]
signature = E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00 00 00 FF FF FF FF 5E C3
ep_only = true

[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h2)]
signature = E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 ?? 00 00 00
ep_only = true

[EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h3)]
signature = 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73
ep_only = false

[EXECryptor 2.2.6 (minimum protection)]
signature = 50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00 89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? ?? C3 BF ?? ?? ?? ?? 81 CB ?? ?? ?? ?? BA ?? ?? ?? ?? 52 E9 ?? ?? ?? 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 34 24 5E 66 8B 00 66 25 ?? ?? E9 ?? ?? ?? ?? 8B CD 87 0C 24 8B EC 51 89 EC 5D 8B 05 ?? ?? ?? ?? 09 C0 E9 ?? ?? ?? ?? 59 81 C1 ?? ?? ?? ?? C1 C1 ?? 23 0D ?? ?? ?? ?? 81 F9 ?? ?? ?? ?? E9 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 13 D0 0B F9 E9 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B 64 24 08 31 C0 64 8F 05 00 00 00 00 5A E9 ?? ?? ?? ?? 3C A4 0F 85 ?? ?? ?? 00 8B 45 FC 66 81 38 ?? ?? 0F 84 05 00 00 00 E9 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 3C 24 5F 31 DB 31 C9 31 D2 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 89 45 FC 33 C0 89 45 F4 83 7D FC 00 E9 ?? ?? ?? ?? 53 52 8B D1 87 14 24 81 C0 ?? ?? ?? ?? 0F 88 ?? ?? ?? ?? 3B CB
ep_only = true

[EXECryptor 2.2.6 DLL (minimum protection)]
signature = 50 8B C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 0F 81 ?? ?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ?? ?? ?? ?? F7 D1 0B 15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1 E2 ?? C1 E8 ?? 81 EA ?? ?? ?? ?? 13 DA 81 E9 ?? ?? ?? ?? 87 04 24 8B C8 E9 ?? ?? ?? ?? 55 8B EC 83 C4 F8 89 45 FC 8B 45 FC 89 45 F8 8B 45 08 E9 ?? ?? ?? ?? 8B 45 E0 C6 00 00 FF 45 E4 E9 ?? ?? ?? ?? FF 45 E4 E9 ?? ?? ?? 00 F7 D3 0F 81 ?? ?? ?? ?? E9 ?? ?? ?? ?? 87 34 24 5E 8B 45 F4 E8 ?? ?? ?? 00 8B 45 F4 8B E5 5D C3 E9
ep_only = true

[EXECryptor 2.2/2.3 (compressed code) -> www.strongbit.com]
signature = E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50
ep_only = false

[EXECryptor 2.2/2.3 (compressed code) -> www.strongbit.com]
signature = E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 B8 C8 ?? ?? ?? 8B 04 18 FF D0 59 58 5B 83 EB 05 C6 03 B8 43 89 03 83 C3 04 C6 03 C3 09 C9 74 46 89 C3 E8 A0 00 00 00 FC AD 83 F8 FF 74 38 53 89 CB 01 C3 01 0B 83 C3 04 AC 3C FE 73 07 25 FF 00 00 00 EB ED 81 C3 FE 00 00 00 09 C0 7A 09 66 AD 25 FF FF 00 00 EB DA AD 4E 25 FF FF FF 00 3D FF FF FF 00 75 CC ?? ?? ?? ?? ?? C3
ep_only = false

[EXECryptor 2.2/2.3 (protected IAT)]
signature = CC ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? B4 ?? ?? ?? 08 ?? ?? ?? 00 00 00 00 FF FF FF FF E8 ?? ?? ?? 04 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C ?? ?? ?? 60 ?? ?? ?? 70 ?? ?? ?? 84 ?? ?? ?? 94 ?? ?? ?? A4 ?? ?? ?? 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78
ep_only = false

[EXECryptor 2.3.9 (compressed resources)]
signature = 51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00 00 81 ED BB 43 CB 79 C1 E0 1C E9 9E 14 00 00 0B 15 ?? ?? ?? ?? 81 E2 2A 70 7F 49 81 C2 9D 83 12 3B E8 0C 50 00 00 E9 A0 16 00 00 59 5B C3 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 41 42 00 00 E9 93 33 00 00 31 DB 89 D8 59 5B C3 A1 ?? ?? ?? ?? 8A 00 2C 99 E9 82 30 00 00 0F 8A ?? ?? ?? ?? B8 01 00 00 00 31 D2 0F A2 25 FF 0F 00 00 E9 72 21 00 00 0F 86 57 0B 00 00 E9 ?? ?? ?? ?? C1 C0 03 E8 F0 36 00 00 E9 41 0A 00 00 81 F7 B3 6E 85 EA 81 C7 ?? ?? ?? ?? 87 3C 24 E9 74 52 00 00 0F 8E ?? ?? ?? ?? E8 5E 37 00 00 68 B1 74 96 13 5A E9 A1 04 00 00 81 D1 49 C0 12 27 E9 50 4E 00 00 C1 C8 1B 1B C3 81 E1 96 36 E5
ep_only = true

[EXECryptor 2.3.9 (minimum protection)]
signature = 68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0 0F 84 8E EC FF FF E9 ?? ?? ?? FF C3 87 3C 24 5F 8B 00 03 45 FC 83 C0 18 E9 ?? ?? ?? FF 87 0C 24 59 B8 01 00 00 00 D3 E0 23 D0 E9 02 18 00 00 0F 8D DB 00 00 00 C1 E8 14 E9 CA 00 00 00 9D 87 0C 24 59 87 1C 24 68 AE 73 B9 96 E9 C5 10 00 00 0F 8A ?? ?? ?? ?? E9 ?? ?? ?? FF 81 FD F5 FF 8F 07 E9 4F 10 00 00 C3 E9 5E 12 00 00 87 3C 24 E9 ?? ?? ?? FF E8 ?? ?? ?? FF 83 3D ?? ?? ?? ?? 00 0F 85 ?? ?? ?? ?? 8D 55 EC B8 ?? ?? ?? ?? E9 ?? ?? ?? FF E8 A7 1A 00 00 E8 2A CB FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF 59 89 45 E0
ep_only = true

[EXECryptor 2.3.9 DLL (compressed resources)]
signature = 50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9 ?? ?? ?? 00 BA ?? ?? ?? ?? E8 ?? ?? ?? 00 A3 ?? ?? ?? ?? C3 E9 ?? ?? ?? 00 C3 83 C4 04 C3 E9 ?? ?? ?? FF 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 ?? ?? ?? 00 E9 ?? ?? ?? FF C1 C2 03 81 CA ?? ?? ?? ?? 81 C2 ?? ?? ?? ?? 03 C2 5A E9 ?? ?? ?? FF 81 E7 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 81 C7 ?? ?? ?? ?? 89 07 E9 ?? ?? ?? ?? 0F 89 ?? ?? ?? ?? 87 14 24 5A 50 C1 C8 10
ep_only = true

[EXECryptor 2.3.9 DLL (minimum protection)]
signature = 51 68 ?? ?? ?? ?? 87 2C 24 8B CD 5D 81 E1 ?? ?? ?? ?? E9 ?? ?? ?? 00 89 45 F8 51 68 ?? ?? ?? ?? 59 81 F1 ?? ?? ?? ?? 0B 0D ?? ?? ?? ?? 81 E9 ?? ?? ?? ?? E9 ?? ?? ?? 00 81 C2 ?? ?? ?? ?? E8 ?? ?? ?? 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C E9 ?? ?? ?? 00 F7 D6 2B D5 E9 ?? ?? ?? 00 87 3C 24 8B CF 5F 87 14 24 1B CA E9 ?? ?? ?? 00 83 C4 08 68 ?? ?? ?? ?? E9 ?? ?? ?? 00 C3 E9 ?? ?? ?? 00 E9 ?? ?? ?? 00 50 8B C5 87 04 24 8B EC 51 0F 88 ?? ?? ?? 00 FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 99 03 04 24 E9 ?? ?? ?? 00 C3 81 D5 ?? ?? ?? ?? 9C E9 ?? ?? ?? 00 81 FA ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 15 81 CB ?? ?? ?? ?? 81 F3 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 87
ep_only = true

[EXECryptor 2.x -> SoftComplete Developement]
signature = A4 ?? ?? 00 00 00 00 00 FF FF FF FF 3C ?? ?? 00 94 ?? ?? 00 D8 ?? ?? 00 00 00 00 00 FF FF FF FF
ep_only = false

[EXECryptor 2.xx (compressed resources)]
signature = 56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89 F2 01 DE EB 06 85 DB 74 0E EB A9 56 89 D6 89 D9 F3 A4 31 DB 5E EB 9D 89 F0 5B 5F 5E C3
ep_only = false

[EXECryptor 2.xx (max. compressed resources)]
signature = 55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1 00 00 00 73 5B B9 04 00 00 00 E8 FD 00 00 00 48 74 DE 0F 89 C7 00 00 00 E8 D7 00 00 00 73 1B 55 BD 00 01 00 00 E8 D7 00 00 00 88 07 47 4D 75 F5 E8 BF 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 C8 00 00 00 83 C0 07 89 45 F0 C6 45 EF 00 83 F8 08 74 89 E8 A9 00 00 00 88 45 EF E9 7C FF FF FF B9 07 00 00 00 E8 A2 00 00 00 50
ep_only = false

[EXECryptor v1.3.0.45]
signature = E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1
ep_only = true

[EXECryptor v1.3.0.45]
signature = E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1
ep_only = true

[EXECryptor v1.4.0.1]
signature = E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80
ep_only = true

[EXECryptor v1.5.1.x]
signature = E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1 C1 ?? ?? ?? FE C3 31 C0 64 FF 30 64 89 20 CC C3
ep_only = true

[EXECryptor v1.5.3]
signature = E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 CC C3
ep_only = false

[EXECryptor V2.1X -> softcomplete.com]
signature = 83 C6 14 8B 55 FC E9 ?? FF FF FF
ep_only = false

[EXECryptor V2.1X -> softcomplete.com]
signature = E9 ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? ?? ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1
ep_only = true

[EXECryptor V2.2X -> softcomplete.com]
signature = FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 00
ep_only = false

[EXECryptor vx.x.x.x]
signature = E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41
ep_only = true

[ExeJoiner 1.0 -> Yoda]
signature = 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00
ep_only = true

[ExeJoiner 1.0 -> Yoda f2f]
signature = 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50
ep_only = true

[EXEJoiner v1.0]
signature = 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 C6 00 5C 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 E8
ep_only = true

[ExeJoiner V1.0 -> Yoda f2f]
signature = 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00
ep_only = true

[EXELOCK 666 1.5]
signature = BA ?? ?? BF ?? ?? EB ?? EA ?? ?? ?? ?? 79 ?? 7F ?? 7E ?? 1C ?? 48 78 ?? E3 ?? 45 14 ?? 5A E9
ep_only = true

[ExeLock v1.00]
signature = 06 8C C8 8E C0 BE ?? ?? 26 ?? ?? 34 ?? 26 ?? ?? 46 81 ?? ?? ?? 75 ?? 40 B3 ?? B3 ?? F3
ep_only = true

[EXEPACK (LINK) v3.60, v3.64, v3.65 or 5.01.21]
signature = 8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 ?? ?? ?? 8E C0 8B ?? ?? ?? 8B ?? 4F 8B F7 FD F3 A4 50 B8 ?? ?? 50 CB
ep_only = true

[EXEPACK v4.05, v4.06]
signature = 8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 06 ?? ?? 8E C0 8B 0E ?? ?? 8B F9 4F 8B F7 FD F3 A4
ep_only = true

[EXERefactor V0.1 -> random]
signature = 55 8B EC 81 EC 90 0B 00 00 53 56 57 E9 58 8C 01 00 55 53 43 41 54 49 4F 4E
ep_only = true

[ExeSafeguard v1.0 -> simonzh]
signature = C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE
ep_only = false

[ExeShield 3.6 -> www.exeshield.com]
signature = B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F
ep_only = true

[ExeShield Cryptor 1.3RC -> Tom Commander]
signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 8C 21 40 00 B9 51 2D 40 00 81 E9 E6 21 40 00 8B D5 81 C2 E6 21 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC
ep_only = true

[ExeShield Protector V3.6 -> www.exeshield.com]
signature = B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC
ep_only = true

[ExeSmasher vx.x]
signature = 9C FE 03 ?? 60 BE ?? ?? 41 ?? 8D BE ?? 10 FF FF 57 83 CD FF EB 10
ep_only = true

[ExeSplitter 1.2 -> Bill Prisoner / TPOC]
signature = E9 95 02 00 00 64 A1 00 00 00 00 83 38 FF 74 04 8B 00 EB F7 8B 40 04 C3 55 8B EC B8 00 00 00 00 8B 75 08 81 E6 00 00 FF FF B9 06 00 00 00 56 56 E8 B0 00 00 00 5E 83 F8 01 75 06 8B C6 C9 C2 04 00 81 EE 00 00 01 00 E2 E5 C9 C2 04 00 55 8B EC 8B 75 0C 8B DE 03 76 3C 8D 76 18 8D 76 60 8B 36 03 F3 56 8B 76 20 03 F3 33 D2 8B C6 8B 36 03 F3 8B 7D 08 B9 0E 00 00 00 FC F3 A6 0B C9 75 02 EB 08
ep_only = false

[ExeSplitter 1.3 (Split Method) -> Bill Prisoner / TPOC]
signature = E8 00 00 00 00 5D 81 ED 08 12 40 00 E8 66 FE FF FF 55 50 8D 9D 81 11 40 00 53 8D 9D 21 11 40 00 53 6A 08 E8 76 FF FF FF 6A 40 68 00 30 00 00 68 00 01 00 00 6A 00 FF 95 89 11 40 00 89 85 61 10 40 00 50 68 00 01 00 00 FF 95 85 11 40 00 8D 85 65 10 40 00 50 FF B5 61 10 40 00 FF 95 8D 11 40 00 6A 00 68 80 00 00 00 6A 02 6A 00 ?? ?? ?? ?? 01 1F 00 FF B5 61 10 40 00 FF 95 91 11 40 00 89 85 72 10 40 00 6A 00 8D ?? ?? ?? ?? 00 50 FF B5 09 10 40 00 8D 85 F5 12 40 00 50 FF B5 72 10 40 00 FF 95 95 11 40 00 FF B5 72 10 40 00 FF 95 99 11 40 00 8D 85 0D 10 40 00 50 8D 85 1D 10 40 00 50 B9 07 00 00 00 6A 00 E2 FC
ep_only = false

[ExeSplitter 1.3 (Split Method) -> Bill Prisoner / TPOC]
signature = E9 FE 01 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 73 76 63 45 72 30 31 31 2E 74 6D 70 00 00 00 00 00 00 00 00 00 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 85 C0 0F 84 5F 02 00 00 8B 48 30 80 39 6B 74 07 80 39 4B 74 02 EB E7 80 79 0C 33 74 02 EB DF 8B 40 18 C3
ep_only = true

[ExeSplitter 1.3 (Split+Crypt Method) -> Bill Prisoner / TPOC]
signature = 15 10 05 23 14 56 57 57 48 12 0B 16 66 66 66 66 66 66 66 66 66 02 C7 56 66 66 66 ED 26 6A ED 26 6A ED 66 E3 A6 69 E2 39 64 66 66 ED 2E 56 E6 5F 0D 12 61 E6 5F 2D 12 64 8D 81 E6 1F 6A 55 12 64 8D B9 ED 26 7E A5 33 ED 8A 8D 69 21 03 12 36 14 09 05 27 02 02 14 03 15 15 27 ED 2B 6A ED 13 6E ED B8 65 10 5A EB 10 7E EB 10 06 ED 50 65 95 30 ED 10 46 65 95 55 B4 ED A0 ED 50 65 95 37 ED 2B 6A EB DF AB 76 26 66 3F DF 68 66 66 66 9A 95 C0 6D AF 13 64
ep_only = false

[ExeSplitter 1.3 (Split+Crypt Method) -> Bill Prisoner / TPOC]
signature = E8 00 00 00 00 5D 81 ED 05 10 40 00 B9 ?? ?? ?? ?? 8D 85 1D 10 40 00 80 30 66 40 E2 FA 8F 98 67 66 66 ?? ?? ?? ?? ?? ?? ?? 66
ep_only = true

[EXEStealth 2.75 -> WebtoolMaster]
signature = 90 60 90 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00
ep_only = true

[EXEStealth 2.76 Unregistered -> WebtoolMaster]
signature = EB ?? 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 53 68 61 72 65 77 61 72 65 20
ep_only = false

[ExeTools COM2EXE]
signature = E8 ?? ?? 5D 83 ED ?? 8C DA 2E 89 96 ?? ?? 83 C2 ?? 8E DA 8E C2 2E 01 96 ?? ?? 60
ep_only = true

[ExeTools v2.1 Encruptor by DISMEMBER]
signature = E8 ?? ?? 5D 83 ?? ?? 1E 8C DA 83 ?? ?? 8E DA 8E C2 BB ?? ?? BA ?? ?? 85 D2 74
ep_only = true

[eXPressor 1.1 -> CGSoftLabs]
signature = E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? 12 00 00 E9 ?? 0C 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00
ep_only = true

[eXPressor 1.2 -> CGSoftLabs]
signature = 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E
ep_only = true

[eXPressor 1.2.0 Beta PE Packer]
signature = 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 EB ?? 45 78 50 72 2D 76 2E 31 2E 32 2E 2E
ep_only = true

[eXPressor V1.0 -> CGSoftLabs]
signature = E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00
ep_only = true

[eXpressor v1.1 -> CGSoftLabs]
signature = E9 15 13 00 00 E9 F0 12 00 00 E9 58 12 00 00 E9 AF 0C 00 00 E9 AE 02 00 00 E9 B4 0B 00 00 E9 E0 0C 00 00
ep_only = true

[eXPressor v1.2 -> CGSoftLabs]
signature = 45 78 50 72 2D 76 2E 31 2E 32 2E
ep_only = false

[eXpressor v1.2 -> CGSoftLabs]
signature = 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76
ep_only = true

[eXPressor v1.2 -> CGSoftLabs]
signature = 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04
ep_only = true

[eXPressor v1.2 -> CGSoftLabs]
signature = 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15
ep_only = true

[eXPressor v1.2.0b]
signature = 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04
ep_only = false

[eXPressor v1.3 -> CGSoftLabs]
signature = 45 78 50 72 2D 76 2E 31 2E 33 2E
ep_only = false

[eXPressor V1.3 -> CGSoftLabs]
signature = 55 8B EC 83 EC ?? 53 56 57 EB 0C 45
ep_only = true

[eXPressor v1.3 -> CGSoftLabs]
signature = 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 13 A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? 89 ?? ?? E9 ?? ?? 00 00 C7 05
ep_only = true

[eXPressor v1.4 -> CGSoftLabs]
signature = 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 34 2E 2E B8
ep_only = true

[eXPressor v1.4 -> CGSoftLabs]
signature = 65 58 50 72 2D 76 2E 31 2E 34 2E
ep_only = false

[eXpressor v1.4.5 -> CGSoftLabs]
signature = 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C
ep_only = true

[eXPressor V1.4.5.1 -> CGSoftLabs]
signature = 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D
ep_only = true

[eXPressor v1.4.5.1 -> CGSoftLabs]
signature = 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14
ep_only = true

[eXPressor v1.4.5.1 -> CGSoftLabs]
signature = 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14 89 4D CC
ep_only = true

[eXPressor.PacK 1.5.0.X -> CGSoftLabs]
signature = 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 83 A5 ?? ?? ?? ?? ?? F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C ?? 75 23 8B 45 08 A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? EB 04
ep_only = true

[eXPressor.Protection 1.5.0.X -> CGSoftLabs]
signature = EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02 66 F0 68 ?? ?? ?? ?? E8 0E 05 00 00 59 EB 01 DD 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 DA 1A 8B 45 F4 0F ?? ?? ?? ?? ?? ?? 33 45 F4 8B 4D F4 88 ?? ?? ?? ?? ?? EB 01 EB EB
ep_only = false

[EZIP v1.0]
signature = E9 19 32 00 00 E9 7C 2A 00 00 E9 19 24 00 00 E9 FF 23 00 00 E9 1E 2E 00 00 E9 88 2E 00 00 E9 2C
ep_only = true

[FACRYPT v1.0]
signature = B9 ?? ?? B3 ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 49 43 32 E4 03 D0 E3
ep_only = true

[FakeNinja v2.8 (Anti-Debug) -> Spirit]
signature = 64 A1 18 00 00 00 EB 02 C3 11 8B 40 30 EB 01 0F 0F B6 40 02 83 F8 01 74 FE EB 01 E8 90 C0 FF FF EB 03 BD F4 B5 64 A1 30 00 00 00 0F B6 40 02 74 01 BA 74 E0 50 00 64 A1 30 00 00 00 83 C0 68 8B 00 EB 00 83 F8 70 74 CF EB 02 EB FE 90 90 90 0F 31 33 C9 03 C8 0F 31 2B C1 3D FF 0F 00 00 73 EA E8 08 00 00 00 C1 3D FF 0F 00 00 74 AA EB 07 E8 8B 40 30 EB 08 EA 64 A1 18 00 00 00 EB F2 90 90 90 BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40 11 00 00 6A 00 6A 00 FF 35 70 11 40 00 FF 35 84 11 40 00 E8 25 11 00 00 FF
ep_only = false

[FakeNinja v2.8 -> Spirit]
signature = BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40
ep_only = false

[Feokt]
signature = 89 25 A8 11 40 00 BF ?? ?? ?? 00 31 C0 B9 ?? ?? ?? 00 29 F9 FC F3 AA ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8
ep_only = true

[FileShield]
signature = 50 1E EB ?? 90 00 00 8B D8
ep_only = true

[Fish PE Shield 1.01 -> HellFish]
signature = 55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 AD FF FF FF 89 45 DC E8 C1 FE FF FF 8B 10 03 55 DC 89 55 E4 83 C0 04 8B 10 89 55 FC 83 C0 04 8B 10 89 55 F4 83 C0 04 8B 10 89 55 F8 83 C0 04 8B 10 89 55 F0 83 C0 04 8B 10 89 55 EC 83 C0 04 8B 00 89 45 E8 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B 46 C7 45 E0 00 00 00 00 83 7B 04 00 74 14
ep_only = false

[Fish PE Shield 1.01 -> HellFish]
signature = 60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 28 88 00 00 40 ?? 4B 00 00 00 02 00 00 00 A0 00 00 18 01 00 00 40 ?? 4C 00 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 40 ?? 4E 00 00 00 00 00 00 00 C0 00 00 40 39 00 00 40 ?? 4E 00 00 00 08 00 00 00 00 01 00 C8 06 00 00 40
ep_only = true

[Fish PE Shield 1.12/1.16 -> HellFish]
signature = 55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 BD FE FF FF 89 45 DC E8 E1 FD FF FF 8B 00 03 45 DC 89 45 E4 E8 DC FE FF FF 8B D8 BA 8E 4E 0E EC 8B C3 E8 2E FF FF FF 89 45 F4 BA 04 49 32 D3 8B C3 E8 1F FF FF FF 89 45 F8 BA 54 CA AF 91 8B C3 E8 10 FF FF FF 89 45 F0 BA AC 33 06 03 8B C3 E8 01 FF FF FF 89 45 EC BA 1B C6 46 79 8B C3 E8 F2 FE FF FF 89 45 E8 BA AA FC 0D 7C 8B C3 E8 E3 FE FF FF 89 45 FC 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B
ep_only = false

[Fish PE Shield 1.12/1.16 -> HellFish]
signature = 60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 ?? ?? 00 ?? ?? 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 40
ep_only = true

[FishPE V1.0X -> hellfish]
signature = 60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00 ?? ?? ?? ?? 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 C0 00 00 40 39 00 00 ?? ?? ?? ?? 00 00 08 00 00 00 00 01 00 C8 06 00 00
ep_only = true

[FixupPak v1.20]
signature = 55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8
ep_only = true

[Fly-Crypter 1.0 -> ut1lz]
signature = 53 56 57 55 BB 2C ?? ?? 44 BE 00 30 44 44 BF 20 ?? ?? 44 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 44 44 00 74 06 FF 15 58 30 44 44 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 20 30 44 44 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 18 30 44 44 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 2F FA FF FF FF 15 24 30 44 44 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 ?? ?? 44 00 74 06 FF 15 10 ?? ?? 44 8B 06 50 E8 51 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 44 44 E8 26 FF FF FF C3
ep_only = false

[Fly-Crypter 1.0 -> ut1lz]
signature = 55 8B EC 83 C4 F0 53 B8 18 22 44 44 E8 7F F7 FF FF E8 0A F1 FF FF B8 09 00 00 00 E8 5C F1 FF FF 8B D8 85 DB 75 05 E8 85 FD FF FF 83 FB 01 75 05 E8 7B FD FF FF 83 FB 02 75 05 E8 D1 FD FF FF 83 FB 03 75 05 E8 87 FE FF FF 83 FB 04 75 05 E8 5D FD FF FF 83 FB 05 75 05 E8 B3 FD FF FF 83 FB 06 75 05 E8 69 FE FF FF 83 FB 07 75 05 E8 5F FE FF FF 83 FB 08 75 05 E8 95 FD FF FF 83 FB 09 75 05 E8 4B FE FF FF 5B E8 9D F2 FF FF 90
ep_only = true

[FreeBASIC 0.16b]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 90 90 90 90 90 90 90 90 90 90
ep_only = true

[FreeCryptor 0.1 (build 001)-> GlOFF]
signature = 8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 68 26 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08
ep_only = false

[FreeCryptor 0.1 (build 002) -> GlOFF]
signature = 8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 90 68 27 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08
ep_only = false

[FreeCryptor 0.2 (build 002) -> GlOFF]
signature = 33 D2 90 1E 68 1B ?? ?? ?? 0F A0 1F 8B 02 90 50 54 8F 02 90 90 8E 64 24 08 FF E2 58 50 33 D2 52 83 F8 01 9B 40 8A 10 89 14 24 90 D9 04 24 90 D9 FA D9 5C 24 FC 8B 5C 24 FC 81 F3 C2 FC 1D 1C 75 E3 74 01 62 FF D0 90 5A 33 C0 8B 54 24 08 90 64 8F 00 90 83 C2 08 52 5C 5A
ep_only = false

[FreeJoiner 1.5.1 -> GlOFF]
signature = 90 87 FF 90 90 B9 2B 00 00 00 BA 07 10 40 00 83 C2 03 90 87 FF 90 90 B9 04 00 00 00 90 87 FF 90 33 C9 C7 05 09 30 40 00 00 00 00 00 68 00 01 00 00 68 21 30 40 00 6A 00 E8 B7 02 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 21 30 40 00 E8 8F 02 00 00 A3 19 30 40 00 90 87 FF 90 8B 15 09 30 40 00 81 C2 04 01 00 00 F7 DA 6A 02 6A 00 52
ep_only = true

[FreeJoiner 1.5.2 (Stub engine 1.6) -> GlOFF]
signature = E8 46 FD FF FF 50 E8 0C 00 00 00 FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00
ep_only = true

[FreeJoiner 1.5.3 (Stub engine 1.7) -> GlOFF]
signature = E8 33 FD FF FF 50 E8 0D 00 00 00 CC FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00
ep_only = true

[FreeJoiner 1.5.3 (Stub engine 1.7.1) -> GlOFF]
signature = E8 02 FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A8 10 40 00
ep_only = true

[FreeJoiner Small (build 014-021/024-027) -> GlOFF]
signature = E8 ?? ?? FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00
ep_only = true

[FreeJoiner Small (build 023) -> GlOFF]
signature = E8 E1 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00
ep_only = true

[FreeJoiner Small (build 029) -> GlOFF]
signature = 50 32 C4 8A C3 58 E8 DE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00
ep_only = true

[FreeJoiner Small (build 031/032) -> GlOFF]
signature = 50 32 ?? 66 8B C3 58 E8 ?? FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00
ep_only = true

[FreeJoiner Small (build 033) -> GlOFF]
signature = 50 66 33 C3 66 8B C1 58 E8 AC FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00
ep_only = true

[FreeJoiner Small (build 035) -> GlOFF]
signature = 51 33 CB 86 C9 59 E8 9E FD FF FF 66 87 DB 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00
ep_only = true

[Freshbind v2.0 -> gFresh]
signature = 64 A1 00 00 00 00 55 89 E5 6A FF 68 1C A0 41 00
ep_only = true

[Frusion -> biff]
signature = 83 EC 0C 53 55 56 57 68 04 01 00 00 C7 44 24 14
ep_only = true

[FSG 1.31 -> dulek/xt]
signature = BE ?? ?? ?? 00 BF ?? ?? ?? 00 BB ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80
ep_only = true

[FSG v1.0]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B
ep_only = true

[FSG v1.00 (Eng) -> dulek/xt]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38
ep_only = true

[FSG v1.1]
signature = BB D0 01 40 ?? BF ?? 10 40 ?? BE ?? ?? ?? ?? FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16
ep_only = true

[FSG v1.10 (Eng) -> bart/xt]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00
ep_only = true

[FSG v1.10 (Eng) -> bart/xt -> (Watcom C/C++ EXE)]
signature = EB 02 CD 20 03 ?? 8D ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02
ep_only = true

[FSG v1.10 (Eng) -> bart/xt -> WinRAR-SFX]
signature = 80 E9 A1 C1 C1 13 68 E4 16 75 46 C1 C1 05 5E EB 01 9D 68 64 86 37 46 EB 02 8C E0 5F F7 D0
ep_only = true

[FSG v1.10 (Eng) -> bart/xt -> WinRAR-SFX]
signature = EB 01 02 EB 02 CD 20 B8 80 ?? 42 00 EB 01 55 BE F4 00 00 00 13 DF 13 D8 0F B6 38 D1 F3 F7
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt]
signature = BB D0 01 40 ?? BF ?? 10 40 ?? BE
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt]
signature = E8 01 00 00 00 ?? ?? E8 ?? 00 00 00
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt]
signature = EB 01 ?? EB 02 ?? ?? ?? 80 ?? ?? 00
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland C++ 1999)]
signature = EB 02 CD 20 2B C8 68 80 ?? ?? 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B 0F B6 C9
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland C++)]
signature = 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland C++)]
signature = 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]
signature = 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]
signature = 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]
signature = EB 01 2E EB 02 A5 55 BB 80 ?? ?? 00 87 FE 8D 05 AA CE E0 63 EB 01 75 BA 5E CE E0 63 EB 02
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++ / ASM)]
signature = EB 02 CD 20 EB 02 CD 20 EB 02 CD 20 C1 E6 18 BB 80 ?? ?? 00 EB 02 82 B8 EB 01 10 8D 05 F4
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]
signature = 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]
signature = C1 C8 10 EB 01 0F BF 03 74 66 77 C1 E9 1D 68 83 ?? ?? 77 EB 02 CD 20 5E EB 02 CD 20 2B F7
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)x]
signature = 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi 2.0)]
signature = EB 01 56 E8 02 00 00 00 B2 D9 59 68 80 ?? 41 00 E8 02 00 00 00 65 32 59 5E EB 02 CD 20 BB
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32 / Microsoft Visual Basic)]
signature = F7 D8 0F BE C2 BE 80 ?? ?? 00 0F BE C9 BF 08 3B 65 07 EB 02 D8 29 BB EC C5 9A F8 EB 01 94
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)]
signature = 03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)]
signature = 03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (MASM32)]
signature = EB 01 DB E8 02 00 00 00 86 43 5E 8D 1D D0 75 CF 83 C1 EE 1D 68 50 ?? 8F 83 EB 02 3D 0F 5A
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual Basic / MASM32)]
signature = EB 02 09 94 0F B7 FF 68 80 ?? ?? 00 81 F6 8E 00 00 00 5B EB 02 11 C2 8D 05 F4 00 00 00 47
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual Basic 5.0 / 6.0)]
signature = C1 CB 10 EB 01 0F B9 03 74 F6 EE 0F B6 D3 8D 05 83 ?? ?? EF 80 F3 F6 2B C1 EB 01 DE 68 77
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 4.x / LCC Win32 1.x)]
signature = 2C 71 1B CA EB 01 2A EB 01 65 8D 35 80 ?? ?? 00 80 C9 84 80 C9 68 BB F4 00 00 00 EB 01 EB
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 5.0 / 6.0)]
signature = 33 D2 0F BE D2 EB 01 C7 EB 01 D8 8D 05 80 ?? ?? ?? EB 02 CD 20 EB 01 F8 BE F4 00 00 00 EB
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0 / ASM)]
signature = E8 01 00 00 00 5A 5E E8 02 00 00 00 BA DD 5E 03 F2 EB 01 64 BB 80 ?? ?? 00 8B FA EB 01 A8
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]
signature = 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]
signature = 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? ?? EB 02 CD 20 03 D3 8D 35 F4 00
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]
signature = 87 FE E8 02 00 00 00 98 CC 5F BB 80 ?? ?? 00 EB 02 CD 20 68 F4 00 00 00 E8 01 00 00 00 E3
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]
signature = F7 D8 40 49 EB 02 E0 0A 8D 35 80 ?? ?? ?? 0F B6 C2 EB 01 9C 8D 1D F4 00 00 00 EB 01 3C 80
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]
signature = F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? A7 BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / ASM)]
signature = F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B ?? ?? FB C1 C1 03 33 F7 EB 02 CD 20 68
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = 91 EB 02 CD 20 BF 50 BC 04 6F 91 BE D0 ?? ?? 6F EB 02 CD 20 2B F7 EB 02 F0 46 8D 1D F4 00
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = C1 CE 10 C1 F6 0F 68 00 ?? ?? 00 2B FA 5B 23 F9 8D 15 80 ?? ?? 00 E8 01 00 00 00 B6 5E 0B
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = D1 E9 03 C0 68 80 ?? ?? 00 EB 02 CD 20 5E 40 BB F4 00 00 00 33 CA 2B C7 0F B6 16 EB 01 3E
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = E8 01 00 00 00 0E 59 E8 01 00 00 00 58 58 BE 80 ?? ?? 00 EB 02 61 E9 68 F4 00 00 00 C1 C8
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = EB 01 4D 83 F6 4C 68 80 ?? ?? 00 EB 02 CD 20 5B EB 01 23 68 48 1C 2B 3A E8 02 00 00 00 38
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = EB 02 AB 35 EB 02 B5 C6 8D 05 80 ?? ?? 00 C1 C2 11 BE F4 00 00 00 F7 DB F7 DB 0F BE 38 E8
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = EB 02 CD 20 ?? CF ?? ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

[FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? ?? BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68
ep_only = true

[FSG v1.2]
signature = 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 ?? 00 00 00 00 00
ep_only = true

[FSG v1.20 (Eng) -> dulek/xt -> (Borland C++)]
signature = C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6
ep_only = true

[FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]
signature = 0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB
ep_only = true

[FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]
signature = 0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01
ep_only = true

[FSG v1.20 (Eng) -> dulek/xt -> (MASM32 / TASM32)]
signature = 33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE
ep_only = true

[FSG v1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)]
signature = EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA
ep_only = true

[FSG v1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)]
signature = C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3
ep_only = true

[FSG v1.3]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00
ep_only = true

[FSG v1.31]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 BB ?? ?? ?? ?? B2 80 A4 B6 80 FF D3 73 F9 33 C9
ep_only = true

[FSG v1.31 (Eng) -> dulek/xt]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB
ep_only = true

[FSG v1.33]
signature = BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73
ep_only = true

[FSG v1.33 (Eng) -> dulek/xt]
signature = BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF
ep_only = true

[FSG v1.33 (Eng) -> dulek/xt]
signature = BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D
ep_only = true

[FSG v2.0]
signature = 87 25 ?? ?? ?? ?? 61 94 55 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75
ep_only = false

[FSG v2.0 -> bart/xt]
signature = 87 25 ?? ?? ?? 00 61 94 55 A4 B6 80 FF 13
ep_only = true

[Fuck'n'Joy v1.0c -> UsAr]
signature = 60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00
ep_only = true

[Fuck'n'Joy v1.0c -> UsAr]
signature = 60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 00 0B C0 0F 84 EC 00 00 00 89 85 4D 08 40 00 8D 85 51 08 40 00 50 FF B5 6C 08 40 00 E8 AF 02 00 00 0B C0 0F 84 CC 00 00 00 89 85 5C 08 40 00 8D 85 67 07 40 00 E8 7B 02 00 00 8D B5 C4 07 40 00 56 6A 64 FF 95 74 07 40 00 46 80 3E 00 75 FA C7 06 74 6D 70 2E 83 C6 04 C7 06 65 78 65 00 8D 85 36 07 40 00 E8 4C 02 00 00 33 DB 53 53 6A 02 53 53 68 00 00 00 40 8D 85 C4 07 40 00 50 FF 95 74 07 40 00 89 85 78 07 40 00 8D 85 51 07 40 00 E8 21 02 00 00 6A 00 8D 85 7C 07 40 00 50 68 00 ?? ?? 00 8D 85 F2 09 40 00 50 FF
ep_only = true

[Fusion 1.0 -> jaNooNi]
signature = 68 04 30 40 00 68 04 30 40 00 E8 09 03 00 00 68 04 30 40 00 E8 C7 02 00 00
ep_only = true

[GameGuard - nProtect]
signature = 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B 40 0C 8B 40 0C C7 40 20 00 10 00 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 85 C0 75 16 E9 12 00 00 00 31 C0 64 A0 20 00 00 00 85 C0 75 05 E9 01 00 00 00 61 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07
ep_only = true

[GameGuard v2006.5.x.x (*.dll) -> sign by hot_UNP]
signature = 31 FF 74 06 61 E9 4A 4D 50 30 BA 4C 00 00 00 80 7C 24 08 01 0F 85 ?? 01 00 00 60 BE 00
ep_only = true

[GameGuard v2006.5.x.x (*.exe) -> sign by hot_UNP]
signature = 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE 00
ep_only = true

[Gamehouse Media Protector Version Unknown]
signature = 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? 00 00 00 00 00 00 00 00
ep_only = true

[Gardian Angel 1.0]
signature = 06 8C C8 8E D8 8E C0 FC BF ?? ?? EB
ep_only = true

[GHF Protector (pack only) --> GPcH]
signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 61 B9 FC FF FF FF 8B 1C 08 89 99 ?? ?? ?? ?? E2 F5 90 90 BA ?? ?? ?? ?? BE ?? ?? ?? ?? 01 D6 8B 46 0C 85 C0 0F 84 87 00 00 00 01 D0 89 C3 50 B8 ?? ?? ?? ?? FF 10 85 C0 75 08 53 B8 ?? ?? ?? ?? FF 10 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 00 00 00 00 BA ?? ?? ?? ?? 8B 06 85 C0 75 03 8B 46 10 01 D0 03 05 ?? ?? ?? ?? 8B 18 8B 7E 10 01 D7 03 3D ?? ?? ?? ?? 85 DB 74 2B F7 C3 00 00 00 80 75 04 01 D3 43 43 81 E3 FF FF FF 0F 53 FF 35 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 89 07 83 05 ?? ?? ?? ?? 04 EB AE 83 C6 14 BA ?? ?? ?? ?? E9 6E FF FF FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 8B 15 ?? ?? ?? ?? 52 FF D0 61 BA ?? ?? ?? ?? FF E2 90 C3
ep_only = true

[GHF Protector (pack only) -> GPcH]
signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41
ep_only = false

[Goats Mutilator V1.6 -> Goat/_e0f]
signature = E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D
ep_only = true

[GP-Install v5.0.3.32]
signature = 55 8B EC 33 C9 51 51 51 51 51 51 51 53 56 57 B8 C4 1C 41 00 E8 6B 3E FF FF 33 C0 55 68 76 20 41 00 64 FF 30 64 89 20 BA A0 47 41 00 33 C0 E8 31 0A FF FF 33 D2 A1 A0
ep_only = false

[HACKSTOP v1.00]
signature = FA BD ?? ?? FF E5 6A 49 48 0C ?? E4 ?? 3F 98 3F
ep_only = true

[HACKSTOP v1.10, v1.11]
signature = B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 2F CD 21 B0 ?? B4 4C CD 21 50 B8 ?? ?? 58 EB
ep_only = true

[HACKSTOP v1.10p1]
signature = B4 30 CD 21 86 E0 3D 00 03 73 ?? B4 2F CD 21 B4 2A CD 21 B4 2C CD 21 B0 FF B4 4C CD 21 50 B8 ?? ?? 58 EB
ep_only = true

[HACKSTOP v1.11c]
signature = B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 ?? CD 21 B0 ?? B4 4C CD 21 53 BB ?? ?? 5B EB
ep_only = true

[HACKSTOP v1.13]
signature = 52 B8 ?? ?? 1E CD 21 86 E0 3D ?? ?? 73 ?? CD 20 0E 1F B4 09 E8 ?? ?? 24 ?? EA
ep_only = true

[HACKSTOP v1.18]
signature = 52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? FD 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB
ep_only = true

[HACKSTOP v1.19]
signature = 52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? D6 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB
ep_only = true

[Hardlock dongle (Alladin)]
signature = 5C 5C 2E 5C 48 41 52 44 4C 4F 43 4B 2E 56 58 44 00 00 00 00 5C 5C 2E 5C 46 45 6E 74 65 44 65 76
ep_only = true

[Hasp dongle (Alladin)]
signature = 50 53 51 52 57 56 8B 75 1C 8B 3E ?? ?? ?? ?? ?? 8B 5D 08 8A FB ?? ?? 03 5D 10 8B 45 0C 8B 4D 14 8B 55 18 80 FF 32
ep_only = true

[HASP HL Protection V1.X -> Aladdin]
signature = 55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15
ep_only = true

[HASP HL Protection V1.X -> Aladdin]
signature = 55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B 15
ep_only = true

[HEALTH v.5.1 by Muslim M.Polyak]
signature = 1E E8 ?? ?? 2E 8C 06 ?? ?? 2E 89 3E ?? ?? 8B D7 B8 ?? ?? CD 21 8B D8 0E 1F E8 ?? ?? 06 57 A1 ?? ?? 26
ep_only = true

[Hide PE 1.01 -> BGCorp]
signature = ?? BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 F8 FF E2 0D 0A 2D 3D 5B 20 48 69 64 65 50 45 20 62 79 20 42 47 43 6F 72 70 20 5D 3D 2D
ep_only = true

[hmimys Protect v1.0]
signature = E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9
ep_only = true

[hmimys Protect v1.0]
signature = E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9 00 00 00
ep_only = false

[hmimys's PE-Pack 0.1 -> hmimys]
signature = E8 00 00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03 D8 81 C3 F8 00 00 00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53 08 80 BD 89 0E 00 00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00 00 89 95 5B 0F 00 00 8B 5B 10 89 9D 5F 0F 00 00 8B 9D 5F 0F 00 00 8B 85 57 0F 00 00 53 50 E8 B7 0B 00 00 89 85 73 0F 00 00 6A 04 68 00 10 00 00 50 6A 00 FF 95 E9 0E 00 00 89 85 6B 0F 00 00 6A 04 68 00 10 00 00 68 D8 7C 00 00 6A 00 FF 95 E9 0E 00 00 89 85 6F 0F 00 00 8D 85 67 0F 00 00 8B 9D 73 0F 00 00 8B 8D 6B 0F 00 00 8B 95 5B 0F 00 00 83 EA 0E 8B B5 57 0F 00 00 83 C6 0E 8B BD 6F 0F 00 00 50 53 51 52 56 68 D8 7C 00 00 57 E8 01 01 00 00 8B 9D 57 0F 00 00 8B 03 3C 01 75
ep_only = true

[hmimys-Packer 1.0 -> hmimys]
signature = 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07
ep_only = false

[hmimys-Packer V1.2 -> hmimys]
signature = E8 95 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5E AD 50 AD 50 97 AD 50 AD 50 AD 50 E8 C0 01 00 00 AD 50 AD 93 87 DE B9 ?? ?? ?? ?? E3 1D 8A 07 47 04 ?? 3C ?? 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 05 ?? ?? ?? ?? 2B C7 AB E2 E3 AD 85 C0 74 2B 97 56 FF 13 8B E8 AC 84 C0 75 FB 66 AD 66 85 C0 74 E9 AC 83 EE 03 84 C0 74 08 56 55 FF 53 04 AB EB E4 AD 50 55 FF 53 04 AB EB E0 C3 8B 0A 3B 4A 04 75 0A C7 42 10 01 00 00 00 0C FF C3
ep_only = true

[HPA]
signature = E8 ?? ?? 5E 8B D6 83 ?? ?? 83 ?? ?? 06 0E 1E 0E 1F 33 FF 8C D3
ep_only = true

[Hying's PE-Armor 0.75.exe -> Hying [CCG]]
signature = 00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00
ep_only = false

[hying's PEArmor V0.76 -> hying]
signature = E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A ?? E8 A3 00 00 00
ep_only = true

[ICrypt 1.0 - by BuGGz]
signature = 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B D8 53 E8 D4 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 64 56 00 10 E8 25 F6 FF FF B8 64 56 00 10 E8 13 F6 FF FF 8B CF 8B D6 E8 E6 FA FF FF 53 E8 90 FA FF FF 8D 4D EC BA 8C 3C 00 10 A1 64 56 00 10 E8 16 FB FF FF 8B 55 EC B8 64 56 00 10 E8 C5 F4 FF FF B8 64 56 00 10 E8 DB F5 FF FF E8 56 FC FF FF 33 C0 5A 59 59 64 89 10 68 73 3C 00 10 8D 45 EC E8 4D F4 FF FF C3 E9 E3 EE FF FF EB F0 5F 5E 5B E8 4D F3 FF FF 00 53 45 54 ?? ?? ?? ?? 00 FF FF FF FF 08 00 00 00 76 6F 74 72 65 63 6C 65
ep_only = true

[ID Application Protector 1.2 -> ID Security Suite]
signature = 60 E8 00 00 00 00 5D 81 ED F2 0B 47 00 B9 19 22 47 00 81 E9 EA 0E 47 00 89 EA 81 C2 EA 0E 47 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C
ep_only = true

[ILUCRYPT v4.015 [exe]]
signature = 8B EC FA C7 46 F7 ?? ?? 42 81 FA ?? ?? 75 F9 FF 66 F7
ep_only = true

[iLUCRYPT v4.018 [exe]]
signature = 8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 2E ?? ?? D1 C8 4F 81
ep_only = true

[IMP-Packer 1.0 -> Mahdi Hezavehi [IMPOSTER]]
signature = 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63
ep_only = false

[Imploder v1.04 --> BoB / BobSoft]
signature = 60 E8 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44
ep_only = true

[IMPostor Pack 1.0 -> Mahdi Hezavehi]
signature = BE ?? ?? ?? 00 83 C6 01 FF E6 00 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? 02 ?? ?? 00 10 00 00 00 02 00
ep_only = true

[Inbuild v1.0 [hard]]
signature = B9 ?? ?? BB ?? ?? 2E ?? ?? 2E ?? ?? 43 E2
ep_only = true

[INCrypter 0.3 (INinY) - by z3e_NiFe]
signature = 60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B 85 16 17 40 00 E8 23 00 00 00 8B 85 1A 17 40 00 E8 18 00 00 00 8B 85 1E 17 40 00 E8 0D 00 00 00 8B 85 22 17 40 00 E8 02 00 00 00 EB 18 8B D6 3B 46 0C 72 0A 83 F9 01 74 0B 3B 46 34 72 06 BA 00 00 00 00 C3 58 83 FA 00 75 1A 8B 4E 10 8B 7E 0C 03 BD 02 17 40 00 83 F9 00 74 09 F6 17 31 0F 31 1F 47 E2 F7 59 83 C6 28 49 83 F9 00 75 88 8B 85 0A 17 40 00 89 44 24 1C 61 50 C3
ep_only = false

[Inno Setup Module]
signature = 49 6E 6E 6F 53 65 74 75 70 4C 64 72 57 69 6E 64 6F 77 00 00 53 54 41 54 49 43
ep_only = true

[Inno Setup Module]
signature = 55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 ?? 89 45 ?? E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF
ep_only = false

[Inno Setup Module v1.09a]
signature = 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA 92 FF FF E8 F1 B3 FF FF 33 C0
ep_only = true

[Inno Setup Module v1.2.9]
signature = 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 EC 89 45 C0 E8 5B 73 FF FF E8 D6 87 FF FF E8 C5 A9 FF FF E8 E0
ep_only = true

[Inno Setup Module v2.0.18]
signature = 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 73 71 FF FF E8 DA 85 FF FF E8 81 A7 FF FF E8 C8
ep_only = false

[Inno Setup Module v3.0.4-beta/v3.0.6/v3.0.7]
signature = 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 B3 70 FF FF E8 1A 85 FF FF E8 25 A7 FF FF E8 6C
ep_only = false

[Install Stub 32-bit]
signature = 55 8B EC 81 EC 14 ?? 00 00 53 56 57 6A 00 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 29
ep_only = true

[InstallAnywhere 6.1 -> Zero G Software Inc]
signature = 60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0
ep_only = true

[InstallAnywhere 6.1 ->Zero G Software Inc]
signature = 60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07
ep_only = true

[InstallShield 2000]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 C4 ?? 53 56 57
ep_only = true

[InstallShield Custom]
signature = 55 8B EC 83 EC 44 56 FF 15 ?? ?? 41 00 8B F0 85 F6 75 08 6A FF FF 15 ?? ?? 41 00 8A 06 57 8B 3D ?? ?? 41 00 3C 22 75 1B 56 FF D7 8B F0 8A 06 3C 22 74 04 84 C0 75 F1 80 3E 22 75 15 56 FF D7 8B
ep_only = true

[Ionic Wind Software]
signature = 9B DB E3 9B DB E2 D9 2D 00 ?? ?? 00 55 89 E5 E8
ep_only = true

[iPB Protect 0.1.3 - 0.1.7 -> forgot]
signature = 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00
ep_only = true

[iPBProtect v0.1.3]
signature = 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78
ep_only = false

[IProtect 1.0 (Fxlib.dll mode) - by FuXdas]
signature = EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00 8D 85 3C 10 40 00 50 FF B5 63 10 40 00 E8 92 00 00 00 0B C0 74 13 89 85 5F 10 40 00 8D 85 49 10 40 00 50 FF 95 5F 10 40 00 8B 85 67 10 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 FA FD FF FF
ep_only = true

[IProtect 1.0 (FxSub.dll mode) - by FuXdas]
signature = EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 53 75 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00 00 5D 81 ED B6 13 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 A8 13 40 00 8D 85 81 13 40 00 50 FF B5 A8 13 40 00 E8 92 00 00 00 0B C0 74 13 89 85 A4 13 40 00 8D 85 8E 13 40 00 50 FF 95 A4 13 40 00 8B 85 AC 13 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 98 13 40 00 89 20 89 68 04 8D 9D 4F 14 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 98 13 40 00 89 20 89 68 04 8D 9D 4F 14 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 B5 FA FF FF
ep_only = true

[JAM v2.11]
signature = 50 06 16 07 BE ?? ?? 8B FE B9 ?? ?? FD FA F3 2E A5 FB 06 BD ?? ?? 55 CB
ep_only = true

[JDPack]
signature = 60 E8 ?? ?? ?? ?? 5D 8B D5 81 ED ?? ?? ?? ?? 2B 95 ?? ?? ?? ?? 81 EA 06 ?? ?? ?? 89 95 ?? ?? ?? ?? 83 BD 45
ep_only = true

[JDPack 2.x -> JDPack]
signature = 55 8B EC 6A FF 68 68 51 40 00 68 04 25 40 00 64 A1 00 00 00 00
ep_only = true

[JDPack V2.00 -> JDPack]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? 05 00 00 00 00 83 C4 0C 5D 60 E8 00 00 00 00 5D 8B D5 64 FF 35 00 00 00 00 EB
ep_only = true

[JExeCompressor 1.0 - by Arash Veyskarami]
signature = 8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8 02 00 00 00 50 03 14 24 58 58 51 2B C9 B9 01 00 00 00 83 EA 01 E2 FB 59 E2 E1 FF E0
ep_only = true

[Joiner (sign from pinch 25.03.2007 20:10)]
signature = 81 EC 04 01 00 00 8B F4 68 04 01 00 00 56 6A 00 E8 7C 01 00 00 33 C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 56 E8 50 01 00 00 8B D8 6A 00 6A 00 6A 00 6A 02 6A 00 53 E8 44 01
ep_only = true

[KBys Packer 0.28 Beta -> Shoooo]
signature = 60 E8 00 00 00 00 5E 83 EE 0A 8B 06 03 C2 8B 08 89 4E F3 83 EE 0F 56 52 8B F0 AD AD 03 C2 8B D8 6A 04 BF 00 10 00 00 57 57 6A 00 FF 53 08 5A 59 BD 00 80 00 00 55 6A 00 50 51 52 50 89 06 AD AD 03 C2 50 AD 03 C2 FF D0 6A 04 57 AD 50 6A 00 FF 53
ep_only = false

[KByS V0.22 -> shoooo]
signature = 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 ?? ?? ?? ?? E8
ep_only = true

[KByS V0.28 -> shoooo]
signature = 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4
ep_only = true

[KByS V0.28 DLL -> shoooo]
signature = B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 03 C2 FF E0 ?? ?? ?? ?? 60 E8 00 00 00 00
ep_only = true

[KGB SFX]
signature = 60 BE 00 A0 46 00 8D BE 00 70 F9 FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73
ep_only = true

[KGCrypt vx.x]
signature = E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 64 A1 30 ?? ?? ?? 84 C0 74 ?? 64 A1 20 ?? ?? ?? 0B C0 74
ep_only = true

[kkrunchy -> Ryd]
signature = BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10
ep_only = true

[kkrunchy 0.23 alpha -> Ryd]
signature = BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 ?? 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 ?? 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 ?? 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 ?? 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE ?? ?? ?? 00 BB ?? ?? ?? 00 55 46 AD 85 C0 74 ?? 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 ?? 56 55 FF 53 04 AB 85 C0
ep_only = true

[kkrunchy 0.23 alpha 2 -> Ryd]
signature = BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF
ep_only = true

[kkrunchy 0.23 alpha 2 -> Ryd]
signature = BD ?? ?? ?? ?? C7 45 00 ?? ?? ?? 00 B8 ?? ?? ?? 00 89 45 04 89 45 54 50 C7 45 10 ?? ?? ?? 00 FF 4D 0C FF 45 14 FF 45 58 C6 45 1C 08 B8 00 08 00 00 8D 7D 30 AB AB AB AB BB 00 00 D8 00 BF ?? ?? ?? 01 31 C9 41 8D 74 09 01 B8 CA 8E 2A 2E 99 F7 F6 01 C3 89 D8 C1 E8 15 AB FE C1 75 E8 BE
ep_only = true

[kkrunchy v0.17 -> F. Giesen]
signature = FC FF 4D 08 31 D2 8D 7D 30 BE
ep_only = false

[kkrunchy V0.2X -> Ryd]
signature = BD ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? ?? 57 BE ?? ?? ?? ?? 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6
ep_only = true

[Krypton v0.2]
signature = 8B 0C 24 E9 0A 7C 01 ?? AD 42 40 BD BE 9D 7A 04
ep_only = true

[Krypton v0.3]
signature = 8B 0C 24 E9 C0 8D 01 ?? C1 3A 6E CA 5D 7E 79 6D B3 64 5A 71 EA
ep_only = true

[Krypton v0.4]
signature = 54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 61 34 ?? ?? 2B 85 60 37 ?? ?? 83 E8 06
ep_only = true

[Krypton v0.5]
signature = 54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 71 44 ?? ?? 2B 85 64 60 ?? ?? EB 43 DF
ep_only = true

[kryptor 5]
signature = E8 03 ?? ?? ?? E9 EB 6C 58 40 FF E0
ep_only = true

[kryptor 6]
signature = E8 03 ?? ?? ?? E9 EB 68 58 33 D2 74 02 E9 E9 40 42 75 02
ep_only = true

[kryptor 9]
signature = 60 E8 ?? ?? ?? ?? 5E B9 ?? ?? ?? ?? 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9
ep_only = true

[LameCrypt -> LaZaRus]
signature = 60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8 ?? ?? 40 00 FF E0
ep_only = true

[LameCrypt v1.0]
signature = 60 66 9C BB ?? ?? ?? ?? 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61
ep_only = true

[LamerStop v1.0c (c) Stefan Esser]
signature = E8 ?? ?? 05 ?? ?? CD 21 33 C0 8E C0 26 ?? ?? ?? 2E ?? ?? ?? 26 ?? ?? ?? 2E ?? ?? ?? BA ?? ?? FA
ep_only = true

[LaunchAnywhere v4.0.0.1]
signature = 55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3
ep_only = true

[Launcher Generator v1.03]
signature = 68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00
ep_only = false

[LOCK98 V1.00.28 -> keenvim]
signature = 55 E8 00 00 00 00 5D 81 ?? ?? ?? ?? ?? EB 05 E9 ?? ?? ?? ?? EB 08
ep_only = true

[Lockless Intro Pack]
signature = 2C E8 ?? ?? ?? ?? 5D 8B C5 81 ED F6 73 ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 06 89 85
ep_only = true

[LTC v1.3]
signature = 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06
ep_only = true

[LY_WGKX -> www.szleyu.com]
signature = 4D 79 46 75 6E 00 62 73
ep_only = false

[Macromedia Windows Flash Projector/Player v3.0]
signature = 55 8B EC 83 EC 44 56 FF 15 94 13 42 00 8B F0 B1 22 8A 06 3A C1 75 13 8A 46 01 46 3A C1 74 04 84 C0 75 F4 38 0E 75 0D 46 EB 0A 3C 20 7E 06
ep_only = true

[Macromedia Windows Flash Projector/Player v4.0]
signature = 83 EC 44 56 FF 15 24 41 43 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C
ep_only = true

[Macromedia Windows Flash Projector/Player v5.0]
signature = 83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00
ep_only = true

[Macromedia Windows Flash Projector/Player v6.0]
signature = 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C
ep_only = true

[MarjinZ EXE-Scrambler SE - by MarjinZ]
signature = E8 A3 02 00 00 E9 35 FD FF FF FF 25 C8 20 00 10 6A 14 68 C0 21 00 10 E8 E4 01 00 00 FF 35 7C 33 00 10 8B 35 8C 20 00 10 FF D6 59 89 45 E4 83 F8 FF 75 0C FF 75 08 FF 15 88 20 00 10 59 EB 61 6A 08 E8 02 03 00 00 59 83 65 FC 00 FF 35 7C 33 00 10 FF D6 89 45 E4 FF 35 78 33 00 10 FF D6 89 45 E0 8D 45 E0 50 8D 45 E4 50 FF 75 08 E8 D1 02 00 00 89 45 DC FF 75 E4 8B 35 74 20 00 10 FF D6 A3 7C 33 00 10 FF 75 E0 FF D6 83 C4 1C A3 78 33 00 10 C7 45 FC FE FF FF FF E8 09 00 00 00 8B 45 DC E8 A0 01 00 00 C3
ep_only = false

[MaskPE 1.6 -> yzkzero]
signature = 36 81 2C 24 ?? ?? ?? 00 C3 60
ep_only = false

[MaskPE V2.0 -> yzkzero]
signature = B8 18 00 00 00 64 8B 18 83 C3 30 C3 40 3E 0F B6 00 C1 E0 ?? 83 C0 ?? 36 01 04 24 C3
ep_only = false

[MASM32]
signature = 6A ?? 68 00 30 40 00 68 ?? 30 40 00 6A 00 E8 07 00 00 00 6A 00 E8 06 00 00 00 FF 25 08 20
ep_only = true

[Matrix Dongle -> TDi GmbH]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 E8 B6 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? E8 00 00 00 00 5B 2B D9 8B F8 8B 4C 24 2C 33 C0 2B CF F2 AA 8B 3C 24 8B 0A 2B CF 89 5C 24 20 80 37 A2 47 49 75 F9 8D 64 24 04 FF 64 24 FC 60 C7 42 08 ?? ?? ?? ?? E8 C5 FF FF FF C3 C2 F7 29 4E 29 5A 29 E6 86 8A 89 63 5C A2 65 E2 A3 A2
ep_only = false

[Matrix Dongle -> TDi GmbH]
signature = E8 00 00 00 00 E8 00 00 00 00 59 5A 2B CA 2B D1 E8 1A FF FF FF
ep_only = true

[MEGALITE v1.20a]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 2D 73 ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 90
ep_only = true

[MESS v1.20]
signature = ?? ?? ?? ?? FA B9 ?? ?? F3 ?? ?? E3 ?? EB ?? EB ?? B6
ep_only = true

[Metrowerks CodeWarrior (DLL) v2.0]
signature = 55 89 E5 53 56 57 8B 75 0C 8B 5D 10 83 FE 01 74 05 83 FE 02 75 12 53 56 FF 75 08 E8 6E FF FF FF 09 C0 75 04 31 C0 EB 21 53 56 FF 75 08 E8 ?? ?? ?? ?? 89 C7 09 F6 74 05 83 FE 03 75 0A 53 56 FF 75 08 E8 47 FF FF FF 89 F8 8D 65 F4 5F 5E 5B 5D C2 0C 00 C9
ep_only = false

[Metrowerks CodeWarrior v2.0 (Console)]
signature = 55 89 E5 55 B8 FF FF FF FF 50 50 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8
ep_only = false

[Metrowerks CodeWarrior v2.0 (GUI)]
signature = 55 89 E5 53 56 83 EC 44 55 B8 FF FF FF FF 50 50 68 ?? ?? 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8
ep_only = false

[MEW 10 by Northfox]
signature = 33 C0 E9 ?? ?? FF FF ?? 1C ?? ?? 40
ep_only = false

[Mew 10 exe-coder 1.0  -> Northfox [HCC]]
signature = 33 C0 E9 ?? ?? FF FF 6A ?? ?? ?? ?? ?? 70
ep_only = true

[MEW 11 SE v1.1]
signature = E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00
ep_only = false

[MEW 11 SE v1.2]
signature = E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[Mew 11 SE v1.2 (Eng) -> Northfox]
signature = E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C
ep_only = true

[MEW 11 SE v1.2 -> Northfox[HCC]]
signature = E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? ?? 00
ep_only = true

[MEW 5 1.0 -> Northfox]
signature = BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0
ep_only = true

[Mew 5.0.1 -> NorthFox / HCC]
signature = BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 ?? 04 ?? C0 C8 ?? AA E2 F4 C3 00 ?? ?? 00 ?? ?? ?? 00 00 10 40 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D
ep_only = true

[MicroJoiner 1.1 -> coban2k]
signature = BE 0C 70 40 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11
ep_only = true

[MicroJoiner 1.5 -> coban2k]
signature = BF 05 10 40 00 83 EC 30 8B EC E8 C8 FF FF FF E8 C3 FF FF FF
ep_only = true

[MicroJoiner 1.6 -> coban2k]
signature = 33 C0 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B
ep_only = true

[MicroJoiner 1.7 -> coban2k]
signature = BF 00 10 40 00 8D 5F 21 6A 0A 58 6A 04 59 60 57 E8 8E 00 00 00
ep_only = true

[Microsoft Visual C++ V8.0]
signature = 6A 14 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B ?? ?? ?? ?? ?? FF D7 50 FF ?? ?? ?? ?? ?? 8B F0 85 F6 75 0A 6A 12 E8 ?? ?? ?? ?? 59 EB 18 89 1E 56 FF ?? ?? ?? ?? ?? 56 85 C0 75 14 50 FF D7 50 FF ?? ?? ?? ?? ?? B8
ep_only = true

[Microsoft Visual C++ V8.0 (Debug)]
signature = E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9
ep_only = true

[MinGW GCC 3.x]
signature = 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? ?? E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? 55
ep_only = true

[Minke 1.0.1 - by Codius]
signature = 55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8 E3 E4 FF FF E8 2A F9 FF FF E8 C1 F8 FF FF B8 6C 66 00 10 8B 16 E8 6D FA FF FF E8 14 F9 FF FF E8 AB F8 FF FF 8B 06 E8 B8 E3 FF FF 8B D8 B8 6C 66 00 10 E8 38 F2 FF FF 8B D3 8B 0E E8 A7 E4 FF ?? ?? ?? ?? C4 FB FF FF E8 E7 F8 FF FF 8B C3 E8 B0 E3 FF FF E8 DB F8 FF FF 33 C0 5A 59 59 64 89 10 68 E2 40 00 10 C3 E9 50 EB FF FF EB F8 5E 5B E8 BB EF FF FF 00 00 00 43 41 31 38
ep_only = true

[Minke V1.0.1 -> Codius]
signature = 26 3D 4F 38 C2 82 37 B8 F3 24 42 03 17 9B 3A 83 01 00 00 CC 00 00 00 00 06 00 00 00 01 64 53 74 75 62 00 10 55 54 79 70 65 73 00 00 C7 53 79 73 74 65 6D 00 00 81 53 79 73 49 6E 69 74 00 0C 4B 57 69 6E 64 6F 77 73 00 00 8A 75 46 75 6E 63 74 69 6F 6E 73
ep_only = false

[mkfpack -> llydd]
signature = E8 00 00 00 00 5B 81 EB 05 00 00 00 8B 93 9F 08 00 00 53 6A 40 68 00 10 00 00 52 6A 00 FF 93 32 08 00 00 5B 8B F0 8B BB 9B 08 00 00 03 FB 56 57 E8 86 08 00 00 83 C4 08 8D 93 BB 08 00 00 52 53 FF E6
ep_only = false

[modified HACKSTOP v1.11f]
signature = 52 B4 30 CD 21 52 FA ?? FB 3D ?? ?? EB ?? CD 20 0E 1F B4 09 E8
ep_only = true

[MoleBox v2.0]
signature = E8 ?? ?? ?? ?? 60 E8 4F
ep_only = false

[MoleBox v2.3.0 -> Teggo]
signature = 42 04 E8 ?? ?? 00 00 A3 ?? ?? ?? 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 ?? 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC CC CC CC CC CC CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 20 61 58 FF D0 E8 ?? ?? 00 00 CC CC CC CC CC CC CC
ep_only = false

[MoleBox V2.3X -> MoleStudio.com]
signature = E8 00 00 00 00 60 E8 4F 00 00 00
ep_only = true

[MoleBox v2.5.4 -> Teggo]
signature = ?? ?? ?? 00 8B 4D F0 8B 11 89 15 ?? ?? ?? 00 8B 45 FC A3 ?? ?? ?? 00 5F 5E 8B E5 5D C3 CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 24 61 58 58 FF D0 E8 ?? ?? 00 00 6A 00 FF 15 ?? ?? ?? 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC
ep_only = false

[Morphine v2.7 --> Holy_Father & Ratter/29A]
signature = 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[Morphine v2.7 --> Holy_Father & Ratter/29A]
signature = ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63
ep_only = false

[Morphine V2.7 -> Holy_Father & Ratter/29A]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72
ep_only = false

[Morphine v3.3 -> Silent Software & Silent Shield (c)2005]
signature = 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63
ep_only = false

[Morphine v3.3 -> Silent Software & Silent Shield (c)2005]
signature = 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41
ep_only = false

[mPack 0.0.3 -> DeltaAziz]
signature = 55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78 00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10 33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF 75 0A E8 88 B2 FF FF E9 1B 01 00 00 C7 05 14 A5 00 10 32 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 C9 C9 FF FF BA 14 A5 00 10 A1 08 A5 00 10 B9 04 00 00 00 E8 C5 C9 FF FF 83 3D 14 A5 00 10 32 77 0A E8 47 B2 FF FF E9 DA 00 00 00 A1 08 A5 00 10 8B 15 14 A5 00 10 E8 92 C9 FF FF BA 18 A5
ep_only = true

[MS Visual C++ v.8 DLL (h-small sig1)]
signature = 8B FF 55 8B EC 83 7D 0C 01 75 05 E8 ?? ?? ?? FF 5D E9 D6 FE FF FF CC CC CC CC CC
ep_only = true

[MS Visual C++ v.8 DLL (h-small sig2)]
signature = 8B FF 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 0F 84 ?? ?? 00 00 83 FE 01
ep_only = true

[mucki's protector I -> mucki]
signature = BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 E9
ep_only = true

[mucki's protector II -> mucki]
signature = E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0 89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74 01 C3 C7 04 24 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 C3
ep_only = true

[MZ0oPE 1.0.6b --> TaskFall]
signature = EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3
ep_only = true

[MZ0oPE 1.0.6b -> TaskFall]
signature = EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4C 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3
ep_only = true

[MZ_Crypt 1.0 - by BrainSt0rm]
signature = 60 E8 00 00 00 00 5D 81 ED 25 14 40 00 8B BD 77 14 40 00 8B 8D 7F 14 40 00 EB 28 83 7F 1C 07 75 1E 8B 77 0C 03 B5 7B 14 40 00 33 C0 EB 0C 50 8A A5 83 14 40 00 30 26 58 40 46 3B 47 10 76 EF 83 C7 28 49 0B C9 75 D4 8B 85 73 14 40 00 89 44 24 1C 61 FF E0
ep_only = false

[N-Joiner 0.1 (Asm Version) -> NEX]
signature = 6A 00 68 00 14 40 00 68 00 10 40 00 6A 00 E8 14 00 00 00 6A 00 E8 13 00 00 00 CC FF 25 AC 12 40 00 FF 25 B0 12 40 00 FF 25 B4 12 40 00 FF 25 B8 12 40 00 FF 25 BC 12 40 00 FF 25 C0 12 40 00 FF 25 C4 12 40 00 FF 25 C8 12 40 00 FF 25 CC 12 40 00 FF 25 D0 12 40 00 FF 25 D4 12 40 00 FF 25 D8 12 40 00 FF 25 DC 12 40 00 FF 25 E4 12 40 00 FF 25 EC 12 40 00
ep_only = true

[N-Joy 1.0 -> NEX]
signature = 55 8B EC 83 C4 F0 B8 9C 3B 40 00 E8 8C FC FF FF 6A 00 68 E4 39 40 00 6A 0A 6A 00 E8 40 FD FF FF E8 EF F5 FF FF 8D 40 00
ep_only = true

[N-Joy 1.1 -> NEX]
signature = 55 8B EC 83 C4 F0 B8 0C 3C 40 00 E8 24 FC FF FF 6A 00 68 28 3A 40 00 6A 0A 6A 00 E8 D8 FC FF FF E8 7F F5 FF FF 8D 40 00
ep_only = true

[N-Joy 1.2 -> NEX]
signature = 55 8B EC 83 C4 F0 B8 A4 32 40 00 E8 E8 F1 FF FF 6A 00 68 54 2A 40 00 6A 0A 6A 00 E8 A8 F2 FF FF E8 C7 EA FF FF 8D 40 00
ep_only = true

[N-Joy 1.3 -> NEX]
signature = 55 8B EC 83 C4 F0 B8 48 36 40 00 E8 54 EE FF FF 6A 00 68 D8 2B 40 00 6A 0A 6A 00 E8 2C EF FF FF E8 23 E7 FF FF 8D 40 00
ep_only = true

[Nakedbind 1.0 -> nakedcrew]
signature = 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B 4D 5A 74 08 81 EB 00 00
ep_only = true

[NakedPacker 1.0 - by BigBoote]
signature = 60 FC 0F B6 05 34 ?? ?? ?? 85 C0 75 31 B8 50 ?? ?? ?? 2B 05 04 ?? ?? ?? A3 30 ?? ?? ?? A1 00 ?? ?? ?? 03 05 30 ?? ?? ?? A3 38 ?? ?? ?? E8 9A 00 00 00 A3 50 ?? ?? ?? C6 05 34 ?? ?? ?? 01 83 3D 50 ?? ?? ?? 00 75 07 61 FF 25 38 ?? ?? ?? 61 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 40 ?? ?? ?? C3 FF 74 24 04 6A 00 FF 15 44 ?? ?? ?? 50 FF 15 48 ?? ?? ?? C3 8B 4C 24 04 56 8B 74 24 10 57 85 F6 8B F9 74 0D 8B 54 24 10 8A 02 88 01
ep_only = false

[Native UD Packer 1.1 (Modded Poison Ivy Shellcode) -> okkixot]
signature = 31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7 FF 35 04 30 40 00 68 CA 10 40 00 50 FF 15 A8 40 40 00 6A 40 68 00 10 00 00 FF 35 08 30 40 00 6A 00 FF 15 A4 40 40 00 89 C6 68 00 30 40 00 FF 35 04 30 40 00 57 FF 35 08 30 40 00 50 6A 02 FF 15 4E 41 40 00 6A 00 6A 00 6A 00 56 6A 00 6A 00 FF 15 9C 40 40 00 50 6A 00 6A 00 6A 11 50 FF 15 4A 41 40 00 58 6A FF 50 FF 15 AC 40 40 00 6A 00 FF 15 A0 40
ep_only = true

[nBinder v3.6.1]
signature = 6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C 00 5C 6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C
ep_only = false

[nBinder v4.0]
signature = 5C 6E 62 34 5F 74 6D 70 5F 30 31 33 32 34 35 34 33 35 30 5C 00 00 00 00 00 00 00 00 00 E9 55 43 4C FF 01 1A 00 00 00 00 96 30 07 77 2C 61 0E EE BA 51 09 99 19 C4 6D 07 8F F4 6A 70 35 A5 63 E9 A3 95 64 9E 32 88 DB 0E A4 B8 DC 79
ep_only = false

[nbuild v1.0 [soft]]
signature = B9 ?? ?? BB ?? ?? C0 ?? ?? 80 ?? ?? 43 E2
ep_only = true

[NeoLite v1.0]
signature = 8B 44 24 04 8D 54 24 FC 23 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 50 FF 25
ep_only = true

[NeoLite v2.0]
signature = E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4E 65 6F 4C 69 74 65
ep_only = true

[NeoLite v2.00]
signature = 8B 44 24 04 23 05 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74
ep_only = true

[NFO v1.0]
signature = 8D 50 12 2B C9 B1 1E 8A 02 34 77 88 02 42 E2 F7 C8 8C
ep_only = true

[Ningishzida 1.0 -> CyberDoom]
signature = 9C 60 96 E8 00 00 00 00 5D 81 ED 03 25 40 00 B9 04 1B 00 00 8D BD 4B 25 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC
ep_only = true

[nMacro recorder 1.0]
signature = 5C 6E 6D 72 5F 74 65 6D 70 2E 6E 6D 72 00 00 00 72 62 00 00 58 C7 41 00 10 F8 41 00 11 01 00 00 00 00 00 00 46 E1 00 00 46 E1 00 00 35 00 00 00 F6 88 41 00
ep_only = false

[NME 1.1 Public - by redlime]
signature = 55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 2C F9 FF FF A3 F8 5A 14 13 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 17 F9 FF FF A3 FC 5A 14 13 B8 04 5C 14 13 E8 20 FB FF FF 8B D8 85 DB 74 48 B8 00 5B 14 13 8B 15 C4 45 14 13 E8 1E E7 FF FF A1 04 5C 14 13 E8 A8 DA FF FF ?? ?? ?? ?? 5C 14 13 50 8B CE 8B D3 B8 00 5B 14 13 ?? ?? ?? ?? FF 8B C6 E8 DF FB FF FF 8B C6 E8 9C DA FF FF B8 00 5B 14 13 E8 72 E7 FF FF 33 C0 5A 59 59 64 89 10 68 73 36 14 13 C3 E9 0F DF FF FF EB F8 5E 5B E8 7E E0 FF FF 00 00 FF FF FF FF 0C 00 00 00 4E 4D 45 20 31 2E 31 20 53 74 75 62
ep_only = false

[NoodleCrypt v2.0]
signature = EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01
ep_only = true

[NoodleCrypt v2.0]
signature = EB 01 9A E8 ?? 00 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01
ep_only = false

[NoodleCrypt v2.00 (Eng) -> NoodleSpa]
signature = EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02
ep_only = true

[Noodlecrypt2 -> r!sc]
signature = EB 01 9A E8 76 00 00 00
ep_only = true

[North Star PE Shrinker 1.3 -> Liuxingping]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5
ep_only = true

[North Star PE Shrinker v1.3 by Liuxingping]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01
ep_only = false

[nPack 1.1.150.2006.Beta -> NEOx]
signature = 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3
ep_only = true

[nPack 1.1.300.2006 Beta -> NEOx]
signature = 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 2D 02 00 00 E8 DD 06 00 00 E8 2C 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3
ep_only = true

[nPack v1.1 150-200 Beta -> NEOx]
signature = 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? 00 E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00
ep_only = true

[nPack v1.1 250 Beta -> NEOx]
signature = 83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00
ep_only = true

[nPack V1.1.150.2006.Beta -> NEOx/[uinC]]
signature = 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3
ep_only = true

[nPack V1.1.200.2006.Beta -> NEOx/[uinC]]
signature = 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 EC 01 00 00 E8 F8 06 00 00 E8 03 06 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3
ep_only = true

[NSIS Installer --> NullSoft]
signature = 83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF 15 30 70 40 00 53 FF 15 80 72 40 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE
ep_only = true

[NsPacK .Net -> LiuXingPing]
signature = 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 BB 01 47 65 74 53 79 73 74 65 6D 49 6E 66 6F 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 5E 00 5F 43 6F 72 ?? ?? ?? 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C
ep_only = false

[NsPack 1.4 -> Liuxingping]
signature = 9C 60 E8 00 00 00 00 5D B8 ?? ?? 40 00 2D ?? ?? 40 00
ep_only = true

[NsPack 1.4 by North Star (Liu Xing Ping)]
signature = 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53
ep_only = false

[NsPack 2.9 -> North Star]
signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8A 06 3C 00 74 12 8B F5 8D B5 ?? ?? FF FF 8A 06 3C 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36
ep_only = true

[NsPack 3.0 -> North Star]
signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 ?? ?? FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36
ep_only = true

[NsPack 3.4 -> North Star]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5
ep_only = true

[NSPack 3.x -> Liu Xing Ping]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF ?? 38 01 0F 84 ?? 02 00 00 ?? 00 01
ep_only = true

[NsPack V1.1 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D B8 57 84 40 00 2D 50 84 40 00
ep_only = true

[NsPack V1.3 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00
ep_only = true

[NsPack V1.4 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D B8 B1 85 40 00 2D AA 85 40 00
ep_only = true

[nSpack V2.3 -> LiuXingPing]
signature = 9C 60 70 61 63 6B 24 40
ep_only = false

[NsPack v2.3 -> North Star]
signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD
ep_only = false

[NsPack v2.3 -> North Star]
signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 56 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 54 03 00 00 03 D9 50 53 E8 9D 02 00 00 61
ep_only = false

[NsPack V2.X -> LiuXingPing]
signature = 6E 73 70 61 63 6B 24 40
ep_only = false

[nSpack V2.x -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5
ep_only = false

[NsPacK V3.0 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? ?? ?? 66 8B 06 66 83 F8 00 74
ep_only = true

[NsPacK V3.1 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74
ep_only = true

[NsPack v3.1 -> North Star]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00
ep_only = true

[NsPack v3.1 -> North Star]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00 00 89 85 ?? ?? FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD ?? ?? FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 ?? ?? FF FF FF B5 ?? ?? FF FF 8B D6 8B CF 8B 85 ?? ?? FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5 68 00 80 00 00 6A 00
ep_only = false

[NsPacK V3.3 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 00 74
ep_only = true

[NsPacK V3.4-V3.5 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 01 0F 84
ep_only = true

[NsPacK V3.6 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 83 38 01 0F 84 47 02 00 00
ep_only = true

[NsPacK V3.7 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 80 39 01 0F ?? ?? ?? 00 00
ep_only = true

[NTkrnl Secure Suite -> NTkrnl team]
signature = 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73
ep_only = false

[NTkrnl Secure Suite 0.1-0.15 -> NTkrnl Software]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3
ep_only = false

[NTkrnl Secure Suite 0.1-0.15 DLL -> NTkrnl Software]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 8B 44 24 04 05 ?? ?? ?? ?? 50 E8 01 00 00 00 C3 C3
ep_only = false

[NTKrnlPacker -> Ashkbiz Danehkar]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74
ep_only = false

[NTPacker 1.0 -> ErazerZ]
signature = 55 8B EC 83 C4 E0 53 33 C0 89 45 E0 89 45 E4 89 45 E8 89 45 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 8D 4D EC BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FC FF FF 8B 55 EC B8 ?? ?? 40 00 E8 ?? ?? FF FF 8D 4D E8 BA ?? ?? 40 00 A1 ?? ?? 40 00 E8 ?? FE FF FF 8B 55 E8 B8 ?? ?? 40 00 E8 ?? ?? FF FF B8 ?? ?? 40 00 E8 ?? FB FF FF 8B D8 A1 ?? ?? 40 00 BA ?? ?? 40 00 E8 ?? ?? FF FF 75 26 8B D3 A1 ?? ?? 40 00 E8 ?? ?? FF FF 84 C0 75 2A 8D 55 E4 33 C0 E8 ?? ?? FF FF 8B 45 E4 8B D3 E8 ?? ?? FF FF EB 14 8D 55 E0 33 C0 E8 ?? ?? FF FF 8B 45 E0 8B D3 E8 ?? ?? FF FF 6A 00 E8 ?? ?? FF FF 33 C0 5A 59 59 64 89 10 68 ?? ?? 40 00 8D 45 E0 BA 04 00 00 00 E8 ?? ?? FF FF C3 E9 ?? ?? FF FF EB EB 5B E8 ?? ?? FF FF 00 00 00 FF FF FF FF 01 00 00 00 25 00 00 00 FF FF FF FF 01 00 00 00 5C 00 00 00 FF FF FF FF 06 00 00 00 53 45 52 56 45 52 00 00 FF FF FF FF 01 00 00 00 31
ep_only = true

[NTPacker V2.X -> ErazerZ]
signature = 4B 57 69 6E 64 6F 77 73 00 10 55 54 79 70 65 73 00 00 3F 75 6E 74 4D 61 69 6E 46 75 6E 63 74 69 6F 6E 73 00 00 47 75 6E 74 42 79 70 61 73 73 00 00 B7 61 50 4C 69 62 75 00 00 00
ep_only = false

[Nullsoft Install System v1.98]
signature = 83 EC 0C 53 56 57 FF 15 2C 81 40
ep_only = true

[Nullsoft Install System v1.xx]
signature = 55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00
ep_only = true

[Nullsoft Install System v1.xx]
signature = 83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74
ep_only = true

[Nullsoft Install System v2.0]
signature = 83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00
ep_only = false

[Nullsoft Install System v2.0 RC2]
signature = 83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00
ep_only = false

[Nullsoft Install System v2.0a0]
signature = 83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74
ep_only = false

[Nullsoft Install System v2.0b2, v2.0b3]
signature = 83 EC 0C 53 55 56 57 FF 15 ?? 70 40 00 8B 35 ?? 92 40 00 05 E8 03 00 00 89 44 24 14 B3 20 FF 15 2C 70 40 00 BF 00 04 00 00 68 ?? ?? ?? 00 57 FF 15 ?? ?? 40 00 57 FF 15
ep_only = true

[Nullsoft Install System v2.0b4]
signature = 83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00
ep_only = false

[Nullsoft Install System v2.0b4]
signature = 83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71
ep_only = false

[Nullsoft PIMP Install System v1.3x]
signature = 55 8B EC 81 EC ?? ?? 00 00 56 57 6A ?? BE ?? ?? ?? ?? 59 8D BD
ep_only = true

[Nullsoft PiMP Install System v1.x]
signature = 83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74
ep_only = false

[Nullsoft PIMP Install System v1.x]
signature = 83 EC 5C 53 55 56 57 FF 15 ?? ?? ?? 00
ep_only = true

[NX PE Packer v1.0]
signature = FF 60 FF CA FF 00 BA DC 0D E0 40 00 50 00 60 00 70 00 80 00
ep_only = true

[Obsidium 1.2.0.0 -> Obsidium Software]
signature = EB 02 ?? ?? E8 3F 1E 00 00
ep_only = true

[Obsidium 1.2.5.8 -> Obsidium Software]
signature = EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 7B 21 00 00
ep_only = true

[Obsidium 1.3.0.0 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 22 EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 47 26 00 00
ep_only = true

[Obsidium 1.3.0.13 -> Obsidium Software]
signature = EB 01 ?? E8 26 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 02 ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 03 ?? ?? ?? E8 13 26 00 00
ep_only = true

[Obsidium 1.3.0.17 -> Obsidium software]
signature = EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04
ep_only = true

[Obsidium 1.3.0.21 -> Obsidium Software]
signature = EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 26 00 00
ep_only = true

[Obsidium 1.3.0.37 -> Obsidium Software]
signature = EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00
ep_only = true

[Obsidium 1.3.1.1 -> Obsidium Software]
signature = EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 03 ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03
ep_only = true

[Obsidium 1.3.2.2 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 04
ep_only = true

[Obsidium 1.3.3.1 -> Obsidium Software]
signature = EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 02 ?? ?? E8 5F 27 00 00
ep_only = true

[Obsidium 1.3.3.2 -> Obsidium Software]
signature = EB 01 ?? E8 2B 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 01 ?? 58 EB 01 ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 02 ?? ?? E8 3B 27 00 00
ep_only = true

[Obsidium 1.3.3.3 -> Obsidium Software]
signature = EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04
ep_only = true

[Obsidium 1.3.3.3 -> Obsidium Software]
signature = EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 01 ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 27
ep_only = true

[Obsidium 1.3.3.4 -> Obsidium Software]
signature = EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33
ep_only = true

[Obsidium 1.3.3.4 -> Obsidium Software]
signature = EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 03
ep_only = true

[Obsidium 1.3.3.6 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04
ep_only = false

[Obsidium 1.3.3.7 (2007.06.23) -> Obsidium Software]
signature = EB 02 ?? ?? E8 27 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 23 EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ?? ?? ?? EB 01 ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8 F7 26 00 00
ep_only = true

[Obsidium 1.3.3.7 -> Obsidium Software]
signature = EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 02 ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 00 00
ep_only = true

[Obsidium 1.3.3.8 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 57 27 00 00
ep_only = true

[Obsidium 1.3.3.9 -> Obsidium Software]
signature = EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 28 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 CF 27 00 00
ep_only = true

[Obsidium 1.3.4.1 -> Obsidium Software]
signature = EB 01 ?? E8 2A 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 21 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 C3 27 00 00
ep_only = true

[Obsidium v1.1.1.1]
signature = EB 02 ?? ?? E8 E7 1C 00 00
ep_only = true

[Obsidium V1.2 -> Obsidium Software]
signature = EB 02 ?? ?? E8 77 1E 00 00
ep_only = true

[Obsidium v1.2.5.0 -> Obsidium Software]
signature = E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00
ep_only = true

[Obsidium V1.2.5.8 -> Obsidium Software]
signature = EB 01 ?? E8 ?? 00 00 00
ep_only = true

[Obsidium V1.2.5.8-V1.3.3.X -> Obsidium Software]
signature = EB 01 ?? E8 ?? 00 00 00 EB 02 ?? ?? EB
ep_only = true

[Obsidium V1.2.X -> Obsidium Software]
signature = E8 0E 00 00 00 33 C0 8B 54 24 0C 83 82 B8 00 00 00 0D C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00
ep_only = true

[Obsidium V1.25 -> Obsidium Software]
signature = E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3
ep_only = true

[Obsidium v1.3.0.0 -> Obsidium Software]
signature = EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B
ep_only = true

[Obsidium v1.3.0.0 -> Obsidium Software]
signature = EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B 50 EB 03 8A 0B 93 33 C0 EB 02 28 B9 8B 00 EB 01 04 C3 EB 04 65 B3 54 0A E9 FA 00 00 00 EB 01 A2 E8 D5 FF FF FF EB 02 2B 49 EB 03 7C 3E 76 58 EB 04 B8 94 92 56 EB 01 72 64 67 8F 06 00 00 EB 02 23 72 83 C4 04 EB 02 A9 CB E8 47 26 00 00
ep_only = true

[Obsidium V1.3.0.0 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 29 00 00 00
ep_only = true

[Obsidium V1.3.0.0 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 ?? 00 00 00
ep_only = true

[Obsidium v1.3.0.37 -> Obsidium Software]
signature = EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27
ep_only = true

[Obsidium v1.3.0.4 -> Obsidium Software]
signature = EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01
ep_only = true

[Obsidium v1.3.0.4 -> Obsidium Software]
signature = EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? E8 3B 26 00 00
ep_only = true

[Obsidium V1.3.0.4 -> Obsidium Software]
signature = EB 02 ?? ?? E8 ?? 00 00 00
ep_only = true

[Obsidium V1.3.0.X -> Obsidium Software]
signature = EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B ?? ?? ?? EB 04 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3
ep_only = true

[Obsidium V1.3.4.2 -> Obsidium Software]
signature = EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 C3 27 00 00
ep_only = true

[Obsidium V1.3.5.0 -> Obsidium Software]
signature = EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 02 ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 20 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 01 ?? E8 ?? ?? ?? ?? EB 01 ?? EB 02 ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 02 ?? ?? 83 C4 04 EB 01 ?? E8
ep_only = true

[Obsiduim 1.3.0.4 -> Obsiduim Software]
signature = EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64
ep_only = true

[ocBat2Exe 1.0 -> OC]
signature = 55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 58 3C 40 00 E8 6C FA FF FF 33 C0 55 68 8A 3F 40 00 64 FF 30 64 89 20 6A 00 6A 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 81 E9 FF FF 8B 45 EC E8 41 F6 FF FF 50 E8 F3 FA FF FF 8B F8 83 FF FF 0F 84 83 02 00 00 6A 02 6A 00 6A EE 57 E8 FC FA FF FF 6A 00 68 60 99 4F 00 6A 12 68 18 57 40 00 57 E8 E0 FA FF FF 83 3D 60 99 4F 00 12 0F 85 56 02 00 00 8D 45 E4 50 8D 45 E0 BA 18 57 40 00 B9 40 42 0F 00 E8 61 F4 FF FF 8B 45 E0 B9 12 00 00 00 BA 01 00 00 00 E8 3B F6 FF FF 8B 45 E4 8D 55 E8 E8 04 FB ?? ?? ?? ?? E8 B8 58 99 4F 00 E8 67 F3 FF FF 33 C0 A3 60 99 4F 00 8D 45 DC 50 B9 05 00 00 00 BA 01 00 00 00 A1 58 99 4F 00 E8 04 F6 FF FF 8B 45 DC BA A4 3F 40 00 E8 E3 F4 FF FF
ep_only = false

[Open Source Code Crypter -> p0ke]
signature = 55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0 E0 FF FF BE 01 00 00 00 B8 2C 68 40 00 E8 E1 F0 FF FF BF 0A 00 00 00 8D 55 EC 8B C6 E8 92 FC FF FF 8B 4D EC B8 2C 68 40 00 BA BC 47 40 00 E8 54 F2 FF FF A1 2C 68 40 00 E8 52 F3 FF FF 8B D0 B8 20 67 40 00 E8 A2 FC FF FF 8B D8 85 DB 0F 84 52 02 00 00 B8 24 67 40 00 8B 15 20 67 40 00 E8 78 F4 FF FF B8 24 67 40 00 E8 7A F3 FF FF 8B D0 8B C3 8B 0D 20 67 40 00 E8 77 E0 FF FF 8D 55 E8 A1 24 67 40 00 E8 42 FD FF FF 8B 55 E8 B8 24 67 40 00
ep_only = false

[ORiEN V1.X-V2.X -> Fisun A.V.]
signature = 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D
ep_only = false

[ORiEN v2.11 (DEMO)]
signature = E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F
ep_only = true

[ORiEN v2.11 - 2.12 -> Fisun Alexander]
signature = E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F
ep_only = true

[ORiEN V2.12 -> Fisun A.V.]
signature = E9 5D 01 00 00 CE D1 CE CD 0D
ep_only = true

[Pack Master v1.0]
signature = 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED D3 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46
ep_only = true

[Pack Master v1.0]
signature = 60 E8 01 ?? ?? ?? E8 83 C4 04 E8 01 ?? ?? ?? E9 5D 81 ED D3 22 40 ?? E8 04 02 ?? ?? E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46
ep_only = true

[Packanoid -> Arkanoid]
signature = BF 00 10 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8
ep_only = true

[Packanoid 1.0 -> ackanoid]
signature = BF 00 ?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ?? ?? ?? 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00
ep_only = true

[Packanoid v1 -> Arkanoid]
signature = BF ?? ?? ?? ?? BE ?? ?? ?? ?? E8 9D 00 00 00 B8 ?? ?? ?? ?? 8B 30 8B 78 04 BB ?? ?? ?? ?? 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08
ep_only = true

[Packed with: PKLITE v1.50 with CRC check (1)]
signature = 1F B4 09 BA ?? ?? CD 21 B8 ?? ?? CD 21
ep_only = true

[PackItBitch 1.0 -> archphase]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 28 ?? ?? ?? 35 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 41 ?? ?? ?? 50 ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? ?? ?? 79 ?? ?? ?? 7D ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[PackItBitch V1.0-> archphase]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false

[Packman 0.0.0.1 -> bubba]
signature = 60 E8 00 00 00 00 58 8D A8 ?? FE FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00
ep_only = true

[Packman 0.0.0.1 -> Bubbasoft]
signature = 0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00
ep_only = false

[Packman v0.0.0.1]
signature = 60 E8 00 00 00 00 58 8D A8 ?? ?? FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00
ep_only = true

[Packman V0.0.0.1 -> Bubbasoft]
signature = 60 E8 00 00 00 00 58 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? 48
ep_only = true

[Packman V1.0 -> Brandon LaCombe]
signature = 60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA
ep_only = true

[Packman v1.0 -> Brandon LaCombe]
signature = 60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA 8B E8 C6 06 E9 8B 43 0C 89 46 01 6A 04 68 00 10 00 00 FF 73 08 51 FF 55 08 8B
ep_only = true

[PACKWIN v1.01p]
signature = 8C C0 FA 8E D0 BC ?? ?? FB 06 0E 1F 2E ?? ?? ?? ?? 8B F1 4E 8B FE 8C DB 2E ?? ?? ?? ?? 8E C3 FD F3 A4 53 B8 ?? ?? 50 CB
ep_only = true

[PAK-SFX Archive]
signature = 55 8B EC 83 ?? ?? A1 ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? ?? ?? 8C D7 8E C7 8D ?? ?? BE ?? ?? FC AC 3C 0D
ep_only = true

[PassEXE v2.0]
signature = 06 1E 0E 0E 07 1F BE ?? ?? B9 ?? ?? 87 14 81 ?? ?? ?? EB ?? C7 ?? ?? ?? 84 00 87 ?? ?? ?? FB 1F 58 4A
ep_only = true

[PassLock 2000 v1.0 (Eng) -> Moonlight-Software]
signature = 55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24
ep_only = true

[Password Protector (c) MiniSoft 1992]
signature = 06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA
ep_only = true

[Password protector my SMT]
signature = E8 ?? ?? ?? ?? 5D 8B FD 81 ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 46 80 ?? ?? 74
ep_only = true

[PAV.Cryptor (Pawning AntiVirus Cryptor) -> masha_dev]
signature = 53 56 57 55 BB 2C ?? ?? 70 BE 00 30 00 70 BF 20 ?? ?? 70 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 00 70 00 74 06 FF 15 54 30 00 70 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 1C 30 00 70 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 14 30 00 70 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 8F FA FF FF FF 15 20 30 00 70 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 ?? ?? 70 00 74 06 FF 15 10 ?? ?? 70 8B 06 50 E8 A9 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 00 70 E8 26 FF FF FF C3 90 8F 05 04 30 00 70 E9 E9 FF FF FF C3
ep_only = false

[PC Guard for Win32 v5.00 -> SofPro/Blagoje Ceklic]
signature = FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C
ep_only = true

[PC PE Encryptor Alpha preview]
signature = 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 ?? 2B 8D EE 32 40 00 83 E9 0B 89 8D F2 32 40 ?? 80 BD D1 32 40 ?? 01 0F 84
ep_only = true

[PC Shrinker v0.20]
signature = E8 E8 01 ?? ?? 60 01 AD B3 27 40 ?? 68
ep_only = true

[PC Shrinker v0.29]
signature = ?? BD ?? ?? ?? ?? 01 AD 55 39 40 ?? 8D B5 35 39 40
ep_only = true

[PC Shrinker v0.45]
signature = ?? BD ?? ?? ?? ?? 01 AD E3 38 40 ?? FF B5 DF 38 40
ep_only = true

[PC Shrinker v0.71]
signature = 9C 60 BD ?? ?? ?? ?? 01 AD 54 3A 40 ?? FF B5 50 3A 40 ?? 6A 40 FF 95 88 3A 40 ?? 50 50 2D ?? ?? ?? ?? 89 85
ep_only = true

[PC-Guard v3.03d, v3.05d]
signature = 55 50 E8 ?? ?? ?? ?? 5D EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01
ep_only = true

[PC-Guard v4.05d, v4.10d, v4.15d]
signature = FC 55 50 E8 00 00 00 00 5D EB 01
ep_only = true

[PC-Guard v5.00d]
signature = FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C
ep_only = true

[PCPEC "alpha - preview"]
signature = 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 00
ep_only = true

[PCPEC [alpha]]
signature = 53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 8B CD 81 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 83
ep_only = true

[PCrypt v3.51]
signature = 50 43 52 59 50 54 FF 76 33 2E 35 31 00 E9
ep_only = true

[PcShare ?????????? v4.0 -> ????????]
signature = 55 8B EC 6A FF 68 90 34 40 00 68 B6 28 40 00 64 A1
ep_only = true

[PCShrink 0.71 beta]
signature = 01 AD 54 3A 40 00 FF B5 50 3A 40 00 6A 40 FF 95 88 3A 40 00
ep_only = true

[PCShrink v0.40b]
signature = 9C 60 BD ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 6A ?? FF ?? ?? ?? ?? ?? 50 50 2D
ep_only = true

[PE Crypt 1.5 -> BitShape Software]
signature = 60 E8 00 00 00 00 5D 81 ED 55 20 40 00 B9 7B 09 00 00 8D BD 9D 20 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC
ep_only = true

[PE Crypt v1.00/v1.01]
signature = E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB
ep_only = true

[PE Crypt v1.02]
signature = E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44
ep_only = true

[PE Crypt32 (Console v1.0, v1.01, v1.02)]
signature = E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB
ep_only = true

[PE Crypt32 v1.02]
signature = E8 00 00 00 00 5B 83 ?? ?? EB ?? 52 4E 44 21
ep_only = true

[PE Diminisher v0.1]
signature = 53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74
ep_only = true

[PE Diminisher v0.1]
signature = 5D 8B D5 81 ED A2 30 40 ?? 2B 95 91 33 40 ?? 81 EA 0B ?? ?? ?? 89 95 9A 33 40 ?? 80 BD 99
ep_only = true

[PE Diminisher V0.1 -> Teraphy]
signature = 53 51 52 56 57 55 E8 00 00 00 00
ep_only = true

[PE Diminisher v0.1 -> Teraphy]
signature = 53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74 50 E8 02 01 00 00 8B FD 8D 9D 9A 33 40 00 8B 1B 8D 87
ep_only = true

[PE Encrypt 1.0 -> Liwuyue]
signature = 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D 0F 05 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 5D EC 8B 41 18 8B C8 49 85 C9 72 5A 41 33 C0 8B D8 C1 E3 02 03 DA 8B 3B 03 3E 81 3F 47 65 74 50 75 40 8B DF 83 C3 04 81 3B 72 6F 63 41 75 33 8B DF 83 C3 08 81 3B 64 64 72 65 75 26 83 C7 0C 66 81 3F 73 73
ep_only = true

[PE Intro v1.0]
signature = 8B 04 24 9C 60 E8 ?? ?? ?? ?? 5D 81 ED 0A 45 40 ?? 80 BD 67 44 40 ?? ?? 0F 85 48
ep_only = true

[PE Lock NT v2.01]
signature = EB 03 CD 20 EB EB 01 EB 1E EB 01 EB EB 02 CD 20 9C EB 03 CD
ep_only = true

[PE Lock NT v2.02c]
signature = EB 02 C7 85 1E EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD
ep_only = true

[PE Lock NT v2.03]
signature = EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB 01
ep_only = true

[PE Lock NT v2.04]
signature = EB ?? CD ?? ?? ?? ?? ?? CD ?? ?? ?? ?? ?? EB ?? EB ?? EB ?? EB ?? CD ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 50 C3
ep_only = true

[PE Lock v1.06]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 4B 45
ep_only = true

[PE Ninja v1.0 -> +DzA kRAker TNT]
signature = BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true

[PE Pack v0.99]
signature = 60 E8 ?? ?? ?? ?? 5D 83 ED 06 80 BD E0 04 ?? ?? 01 0F 84 F2
ep_only = true

[PE Packer]
signature = FC 8B 35 70 01 40 ?? 83 EE 40 6A 40 68 ?? 30 10
ep_only = true

[PE Password v0.2 SMT/SMF]
signature = E8 04 ?? ?? ?? 8B EC 5D C3 33 C0 5D 8B FD 81 ED 33 26 40 ?? 81 EF ?? ?? ?? ?? 83 EF 05 89 AD 88 27 40 ?? 8D 9D 07 29 40 ?? 8D B5 62 28 40 ?? 46 80
ep_only = true

[PE Protect v0.9]
signature = 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 ?? ?? ?? ?? 58 83 C0 07 C6 ?? C3
ep_only = true

[PE Protect v0.9]
signature = E9 ?? 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 20 28 43 29 6F
ep_only = false

[PE Protector 0.9.3 --> CRYPToCRACk]
signature = 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00
ep_only = true

[PE Spin v0.4x]
signature = EB 01 68 60 E8 00 00 00 00 8B
ep_only = false

[PE Spin v0.b]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9
ep_only = true

[PE-Armor 0.46 -> China Cracking Group]
signature = E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41
ep_only = true

[PE-Armor 0.46 -> Hying]
signature = E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41
ep_only = true

[PE-Armor 0.46 -> Hying]
signature = E8 AA 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D
ep_only = true

[PE-Armor 0.460-0.759 -> hying]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00
ep_only = false

[PE-Armor 0.49 -> Hying]
signature = 56 52 51 53 55 E8 15 01 00 00 32 ?? ?? 00 00 00 00 00
ep_only = true

[PE-Armor 0.760-0.765 -> hying]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00
ep_only = false

[PE-Armor V0.7X -> hying]
signature = 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 55 56 81 C5 ?? ?? ?? ?? 55 C3
ep_only = true

[PE-Crypt 1.02]
signature = E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7
ep_only = true

[PE-Crypter]
signature = 60 E8 00 00 00 00 5D EB 26
ep_only = true

[PE-PACK 0.99]
signature = 60 E8 00 00 00 00 5D 83 ED 06 80 BD E0 04 00 00 01 0F 84 F2
ep_only = true

[PE-PaCK v1.0 -> (C) Copyright 1998 by ANAKiN]
signature = C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70
ep_only = false

[PE-PACK v1.0 by ANAKiN 1998 (???)]
signature = 74 ?? E9 ?? ?? ?? ?? 00 00 00 00
ep_only = true

[PE-PROTECT 0.9]
signature = E9 CF 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
ep_only = true

[PE-Protect 0.9 by Cristoph Gabler 1998]
signature = 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39
ep_only = false

[PE-SHiELD 0.2]
signature = 60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04
ep_only = true

[Pe123  v2006.4.12]
signature = 8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B
ep_only = true

[Pe123  v2006.4.4]
signature = 8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10
ep_only = true

[PEBundle v0.2 - v2.0x]
signature = 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95
ep_only = true

[PEBundle v2.0b5 - v2.3]
signature = 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 01 AD ?? ?? ?? ?? 01 AD
ep_only = true

[PEBundle v2.44]
signature = 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 83 BD
ep_only = true

[PEBundle v3.10]
signature = 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD ?? ?? ?? ?? 40 00 01
ep_only = false

[PeCompact 2.53 DLL (Slim Loader) --> BitSum Technologies]
signature = B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D 0B 6B 65 72 6E 6C 33 32
ep_only = true

[PECompact 2.xx (Slim Loader) --> BitSum Technologies]
signature = B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00
ep_only = true

[PECompact 2.xx --> BitSum Technologies]
signature = B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00
ep_only = true

[PECompact v0.90]
signature = EB 06 68 ?? ?? 40 00 C3 9C 60 BD ?? ?? 00 00 B9 02 00 00 00 B0 90 8D BD 7A 42 40 00 F3 AA 01 AD D9 43 40 00 FF B5
ep_only = true

[PECompact v0.92]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 BD ?? ?? ?? ?? B9 02 ?? ?? ?? B0 90 8D BD A5 4F 40 ?? F3 AA 01 AD 04 51 40 ?? FF B5
ep_only = true

[PECompact v0.94]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 ?? ?? ?? ?? 5D 55 58 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 01 85 ?? ?? ?? ?? 50 B9 02
ep_only = true

[PECompact v0.971 - v0.976]
signature = EB 06 68 C3 9C 60 E8 5D 55 5B 81 ED 8B 85 01 85 66 C7 85
ep_only = true

[PECompact v0.977]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB A0 86 40 ?? 87 DD 8B 85 2A 87
ep_only = true

[PECompact v0.978]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 24 88 40 ?? 87 DD 8B 85 A9 88
ep_only = true

[PECompact v0.978.1]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 49 87 40 ?? 87 DD 8B 85 CE 87
ep_only = true

[PECompact v0.978.2]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D1 84 40 ?? 87 DD 8B 85 56 85
ep_only = true

[PECompact v0.98]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 ?? 87 DD 8B 85 5C 85
ep_only = true

[PECompact v0.99]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 2F 85 40 ?? 87 DD 8B 85 B4 85
ep_only = true

[PECompact v1.00]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB C4 84 40 ?? 87 DD 8B 85 49 85
ep_only = true

[PECompact v1.10b1]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 28 63 40 ?? 87 DD 8B 85 AD 63
ep_only = true

[PECompact v1.10b2]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 94 60
ep_only = true

[PECompact v1.10b3]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 95
ep_only = true

[PECompact v1.10b4]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 44
ep_only = true

[PECompact v1.10b5]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 49
ep_only = true

[PECompact v1.10b6]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 ?? 00 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB B7
ep_only = true

[PECompact v1.10b7]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB 14
ep_only = true

[PECompact v1.20 - v1.20.1]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 9A 70 40
ep_only = true

[PECompact v1.22]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 ?? 70 40 ?? 90 90 01 85 9E 70 40 ?? BB F3 08
ep_only = true

[PECompact v1.23b3 - v1.24.1]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 08
ep_only = true

[PECompact v1.24.2 - v1.24.3]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 09
ep_only = true

[PECompact v1.25]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? F3 0D
ep_only = true

[PECompact v1.26b1 - v1.26b2]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? 05 0E
ep_only = true

[PECompact v1.33]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 00 80 40 ?? 90 90 01 85 9E 80 40 ?? BB E8 0E
ep_only = true

[PECompact v1.34 - v1.40b1]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 00 80 ?? 40 90 90 01 85 9E 80 ?? 40 BB F8 10
ep_only = true

[PECompact v1.40 - v1.45]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB C3 11
ep_only = true

[PECompact v1.40b2 - v1.40b4]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 86 11
ep_only = true

[PECompact v1.40b5 - v1.40b6]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 8A 11
ep_only = true

[PECompact v1.46]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 60 12
ep_only = true

[PECompact v1.47 - v1.50]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 5B 12
ep_only = true

[PECompact v1.4x+]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81
ep_only = true

[PECompact v1.55]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A2 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 9E 80 40 ?? BB 2D 12
ep_only = true

[PECompact v1.56]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 90 40 ?? 87 DD 8B 85 A2 90 40 ?? 01 85 03 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 9E 90 40 ?? BB 2D 12
ep_only = true

[PECompact v1.60 - v1.65]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 80 40 ?? 87 DD 8B 85 D2 80 40 ?? 01 85 33 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 CE 80 40 ?? BB BB 12
ep_only = true

[PECompact v1.66]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 ?? 87 DD 8B 85 E6 90 40 ?? 01 85 33 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 DA 90 40 ?? 01 85 DE 90 40 ?? 01 85 E2 90 40 ?? BB 5B 11
ep_only = true

[PECompact v1.67]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 8B 11
ep_only = true

[PECompact v1.68 - v1.84]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 7B 11
ep_only = true

[PECompact v1.84]
signature = 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81
ep_only = true

[PECompact v2.0 beta -> Jeremy Collake]
signature = B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC 90 90 90 90
ep_only = true

[PECompact v2.00 alpha 38]
signature = B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F
ep_only = false

[PECompact v2.5 Retail (Slim Loader) -> Bitsum Technologies]
signature = B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00
ep_only = true

[PECompact v2.5 Retail -> Bitsum Technologies]
signature = B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00
ep_only = true

[PECompact V2.X-> Bitsum Technologies]
signature = B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43
ep_only = true

[PECompact v2.xx]
signature = B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00
ep_only = false

[PeCompact2 2.53-2.76 --> BitSum Technologies]
signature = B8 ?? ?? ?? ?? 55 53 51 57 56 52 8D 98 C9 11 00 10 8B 53 18 52 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 5A 8B F8 50 52 8B 33 8B 43 20 03 C2 8B 08 89 4B 20 8B 43 1C 03 C2 8B 08 89 4B 1C 03 F2 8B 4B 0C 03 CA 8D 43 1C 50 57 56 FF
ep_only = false

[PECrc32 0.88 -> ZhouJinYu]
signature = 60 E8 00 00 00 00 5D 81 ED B6 A4 45 00 8D BD B0 A4 45 00 81 EF 82 00 00 00
ep_only = true

[PEcrypt - by archphase]
signature = 55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9 40 00 68 00 04 00 00 50 6A 00 68 00 13 00 00 E8 FF C7 FF FF 6A 00 68 E0 84 40 00 A1 A0 A9 40 00 50 6A 00 E8 ?? ?? ?? ?? E9 7D 01 00 00 53 A1 10 A7 40 00 50 E8 42 C8 FF FF 8B F0 85 F6 75 18 6A 00 68 E0 84 40 00 68 E4 84 40 00 6A 00 E8 71 C8 FF FF E9 53 01 00 00 53 6A 00 E8 2C C8 FF FF A3 ?? ?? ?? ?? 83 3D 48 A8 40 00 00 75 18 6A 00 68 E0 84 40 00 68 F8 84 40 00 6A 00 E8 43 C8 FF FF E9 25 01 00 00 56 E8 F8 C7 FF FF A3 4C A8 40 00 A1 48 A8 40 00 E8 91 A1 FF FF 8B D8 8B 15 48 A8 40 00 85 D2 7C 16 42 33 C0 8B 0D 4C A8 40 00 03 C8 8A 09 8D 34 18 88 0E 40 4A 75 ED 8B 15 48 A8 40 00 85 D2 7C 32 42 33 C0 8D 34 18 8A 0E 80 F9 01 75 05 C6 06 FF EB 1C 8D 0C 18 8A 09 84 ?? ?? ?? ?? ?? 00 EB 0E 8B 0D 4C A8 40 00 03 C8 0F B6 09 49 88 0E 40 4A 75 D1 8D ?? ?? ?? ?? E8 A5 A3 FF FF 8B 45 E8 8D 55 EC E8 56 D5 FF FF 8D 45 EC BA 18 85 40 00 E8 79 BA FF FF 8B 45 EC E8 39 BB FF FF 8B D0 B8 54 A8 40 00 E8 31 A6 FF FF BA 01 00 00 00 B8 54 A8 40 00 E8 12 A9 FF FF E8 DD A1 FF FF 68 50 A8 40 00 8B D3 8B 0D 48 A8 40 00 B8 54 A8 40 00 E8 56 A7 FF FF E8 C1 A1 FF FF
ep_only = true

[PEEncrypt v4.0b (JunkCode)]
signature = 66 ?? ?? 00 66 83 ?? 00
ep_only = true

[PEiD-Bundle v1.00 - v1.01 --> BoB / BobSoft]
signature = 60 E8 ?? 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A
ep_only = true

[PEiD-Bundle v1.00 --> BoB / BobSoft]
signature = 60 E8 21 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A
ep_only = true

[PEiD-Bundle v1.01 --> BoB / BobSoft]
signature = 60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A
ep_only = true

[PEiD-Bundle v1.02 - v1.03 --> BoB / BobSoft]
signature = 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44
ep_only = true

[PEiD-Bundle v1.02 - v1.03 DLL --> BoB / BobSoft]
signature = 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 00 08 00 39 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00
ep_only = true

[PEiD-Bundle v1.02 - v1.04 --> BoB / BobSoft]
signature = 60 E8 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44
ep_only = true

[Pelles C 2.8.x-4.5.x -> Pelle Orinius]
signature = 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC
ep_only = true

[Pelles C 2.80 -2.90 EXE (X86 CRT-LIB)]
signature = 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 ?? E8 ?? ?? ?? ?? 59 A3
ep_only = true

[Pelles C 2.90, 3.00, 4.00 DLL (X86 CRT-LIB)]
signature = 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 BF 01 00 00 00 85 DB 75 10 83 3D ?? ?? ?? ?? 00 75 07 31 C0 E9 ?? ?? ?? ?? 83 FB 01 74 05 83 FB 02 75 ?? 85 FF 74
ep_only = true

[Pelles C 2.x-4.x DLL -> Pelle Orinius]
signature = 55 89 E5 53 56 57 8B 5D 0C 8B 75 10
ep_only = true

[Pelles C 3.00, 4.00, 4.50 EXE (X86 CRT-DLL)]
signature = 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 C7 45 FC ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 BE ?? ?? ?? ?? EB
ep_only = true

[Pelles C 3.00, 4.00, 4.50 EXE (X86 CRT-LIB)]
signature = 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3
ep_only = true

[Pelles C 4.50 DLL (X86 CRT-LIB)]
signature = 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 85 DB 75 0D 83 3D ?? ?? ?? ?? 00 75 04 31 C0 EB 57 83 FB 01 74 05 83 FB 02 75
ep_only = true

[PELOCKnt 2.04]
signature = EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60
ep_only = true

[PEMangle]
signature = 60 9C BE ?? ?? ?? ?? 8B FE B9 ?? ?? ?? ?? BB 44 52 4F 4C AD 33 C3
ep_only = true

[PEncrypt 1.0 -> JunkCode]
signature = 60 9C BE 00 10 40 00 8B FE B9 ?? ?? ?? ?? BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 E9 ?? ?? ?? FF
ep_only = true

[PEncrypt 2.0 -> junkcode]
signature = EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8 33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85
ep_only = true

[PEncrypt v1.0]
signature = 60 9C BE 00 10 40 00 8B FE B9 28 03 00 00 BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61
ep_only = true

[PEncrypt v3.0]
signature = E8 00 00 00 00 5D 81 ED 05 10 40 00 8D B5 24 10 40 00 8B FE B9 0F 00 00 00 BB ?? ?? ?? ?? AD 33 C3 E2 FA
ep_only = true

[PEncrypt v3.1]
signature = E9 ?? ?? ?? 00 F0 0F C6
ep_only = true

[PEnguinCrypt v1.0]
signature = B8 93 ?? ?? 00 55 50 67 64 FF 36 00 00 67 64 89 26 00 00 BD 4B 48 43 42 B8 04 00 00 00 CC 3C 04 75 04 90 90 C3 90 67 64 8F 06 00 00 58 5D BB 00 00 40 00 33 C9 33 C0
ep_only = true

[PENightMare 2 Beta]
signature = 60 E9 ?? ?? ?? ?? EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A
ep_only = true

[PENightMare v1.3]
signature = 60 E8 00 00 00 00 5D B9 ?? ?? ?? ?? 80 31 15 41 81 F9
ep_only = true

[PENinja]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true

[PENinja modified]
signature = 5D 8B C5 81 ED B2 2C 40 00 2B 85 94 3E 40 00 2D 71 02 00 00 89 85 98 3E 40 00 0F B6 B5 9C 3E 40 00 8B FD
ep_only = true

[PEQuake 0.06-> forgat]
signature = E8 A5 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? ?? 00 5B ?? ?? 00 6E ?? ?? 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00
ep_only = false

[PEQuake v0.06 by fORGAT]
signature = E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64
ep_only = false

[PerlApp 6.0.2 -> ActiveState]
signature = 68 2C EA 40 00 FF D3 83 C4 0C 85 C0 0F 85 CD 00 00 00 6A 09 57 68 20 EA 40 00 FF D3 83 C4 0C 85 C0 75 12 8D 47 09 50 FF 15 1C D1 40 00 59 A3 B8 07 41 00 EB 55 6A 08 57 68 14 EA 40 00 FF D3 83 C4 0C 85 C0 75 11 8D 47 08 50 FF 15 1C D1 40 00 59 89 44 24 10 EB 33 6A 09 57 68 08 EA 40 00 FF D3 83 C4 0C 85 C0 74 22 6A 08 57 68 FC E9 40 00 FF D3 83 C4 0C 85 C0 74 11 6A 0B 57 68 F0 E9 40 00 FF D3 83 C4 0C 85 C0 75 55
ep_only = false

[PerlApp 6.0.2 -> ActiveState]
signature = 68 9C E1 40 00 FF 15 A4 D0 40 00 85 C0 59 74 0F 50 FF 15 1C D1 40 00 85 C0 59 89 45 FC 75 62 6A 00 8D 45 F8 FF 75 0C F6 45 14 01 50 8D 45 14 50 E8 9B 01 00 00 83 C4 10 85 C0 0F 84 E9 00 00 00 8B 45 F8 83 C0 14 50 FF D6 85 C0 59 89 45 FC 75 0E FF 75 14 FF 15 78 D0 40 00 E9 C9 00 00 00 68 8C E1 40 00 FF 75 14 50
ep_only = false

[PESHiELD v0.1b MTE]
signature = E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 1B 01 ?? ?? D1
ep_only = true

[PESHiELD v0.2 / v0.2b / v0.2b2]
signature = 60 E8 ?? ?? ?? ?? 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04
ep_only = true

[PESHiELD v0.251]
signature = 5D 83 ED 06 EB 02 EA 04 8D
ep_only = true

[PEShit]
signature = B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 83 F9 00 7E 06 80 30 ?? 40 E2 F5 E9 ?? ?? ?? FF
ep_only = true

[PESpin v0.1 -> Cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF
ep_only = true

[PESpin v0.1 -> Cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 B3 28 40 00 8B 42 3C 03 C2 89 85 BD 28 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D D1 28 40 00 53 8F 85 C4 27 40 00 BB ?? 00 00 00 B9 A5 08 00 00 8D BD 75 29 40 00 4F 30 1C 39 FE CB E2 F9 68 2D 01 00 00 59 8D BD AA 30 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 07 4F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D C4 28 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 59 81 C1 1D 00 00 00 52 51 C1 E9 05 23 D1 FF
ep_only = true

[PESpin v0.3 (Eng) -> cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46
ep_only = true

[PESpin v0.3 (Eng) -> cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF
ep_only = true

[PESpin V0.3 -> cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00
ep_only = true

[PESpin v0.7 -> Cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF
ep_only = true

[PESpin V0.71 -> cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E
ep_only = true

[PESpin V1.1 -> cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E
ep_only = true

[PESpin v1.1 -> Cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF
ep_only = true

[PESPin v1.3 -> Cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF
ep_only = true

[PESpin v1.304 -> Cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF
ep_only = true

[PESpin v1.3beta -> Cyberbob]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF
ep_only = true

[PEStubOEP v1.x]
signature = 40 48 BE 00 ?? ?? 00 40 48 60 33 C0 B8 ?? ?? ?? 00 FF E0 C3 C3
ep_only = false

[PeStubOEP v1.x]
signature = 90 33 C9 33 D2 B8 ?? ?? ?? 00 B9 FF
ep_only = false

[PeStubOEP v1.x]
signature = E8 05 00 00 00 33 C0 40 48 C3 E8 05
ep_only = false

[Petite 1.2]
signature = 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00
ep_only = true

[Petite 1.2 -> (c)1998 Ian Luck]
signature = 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02
ep_only = true

[Petite 1.3]
signature = 66 9C 60 50 8D 88 00 F0 00 00 8D 90 04 16 00 00 8B DC 8B E1
ep_only = false

[Petite 1.3 -> (c)1998 Ian Luck]
signature = ?? ?? ?? ?? ?? ?? 9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03
ep_only = true

[Petite 1.4]
signature = 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC
ep_only = false

[Petite 1.4 -> (c)1998-99 Ian Luck]
signature = ?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6
ep_only = true

[Petite 2.1]
signature = 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8
ep_only = false

[Petite 2.2 -> (c)1998-99 Ian Luck]
signature = ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66
ep_only = true

[PEtite v1.2]
signature = 9C 60 E8 CA ?? ?? ?? 03 ?? 04 ?? 05 ?? 06 ?? 07 ?? 08
ep_only = true

[PEtite v1.3]
signature = ?? ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? F0 ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 68 ?? ?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42
ep_only = true

[PEtite v1.4]
signature = 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 14 8B CC
ep_only = true

[PEtite v1.4]
signature = ?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC
ep_only = true

[Petite v1.4]
signature = B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 ?? ?? ?? ?? 6A 00
ep_only = true

[PEtite v2.0]
signature = B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 18 8B CC 8D A0 54 BC ?? ?? 8B C3 8D 90 E0 15 ?? ?? 68
ep_only = true

[PEtite v2.1]
signature = B8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50
ep_only = true

[Petite v2.1 (1)]
signature = B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50
ep_only = true

[Petite v2.1 (2)]
signature = B8 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50
ep_only = true

[PEtite v2.2]
signature = B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50
ep_only = true

[Petite v?.? (after v1.4)]
signature = B8 ?? ?? ?? ?? 66 9C 60 50 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 83
ep_only = true

[PEtite vx.x]
signature = B8 ?? ?? ?? ?? 66 9C 60 50
ep_only = true

[PeX 0.99 -> bart^CrackPl]
signature = E9 F5 ?? ?? ?? 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
ep_only = true

[PEX v0.99]
signature = 60 E8 01 ?? ?? ?? ?? 83 C4 04 E8 01 ?? ?? ?? ?? 5D 81
ep_only = true

[PeX v0.99 (Eng) -> bart/CrackPl]
signature = E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
ep_only = true

[PEZip v1.0 by BaGIE]
signature = D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51
ep_only = false

[PE_Admin 1.0 (EncryptPE 1.2003.5.18 Sold) -> Flying Cat]
signature = 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73
ep_only = true

[PE_Admin 1.0 (EncryptPE 1.2003.5.18 Sold) -> Flying Cat]
signature = 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00
ep_only = true

[PGMPACK v0.13]
signature = FA 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3
ep_only = true

[PGMPACK v0.14]
signature = 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3
ep_only = true

[Pi Cryptor 1.0 - by Scofield]
signature = 55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0
ep_only = false

[Pi Cryptor 1.0 - by Scofield]
signature = 55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0 5A 59 59 64 89 10 68 3D 1F 06 00 8D 45 EC E8 C3 F6 FF FF C3
ep_only = true

[Pi Cryptor 1.0 - by Scofield]
signature = 89 55 F8 BB 01 00 00 00 8A 04 1F 24 0F 8B 55 FC 8A 14 32 80 E2 0F 32 C2 8A 14 1F 80 E2 F0 02 D0 88 14 1F 46 8D 45 F4 8B 55 FC E8 ?? ?? ?? ?? 8B 45 F4 E8 ?? ?? ?? ?? 3B F0 7E 05 BE 01 00 00 00 43 FF 4D F8 75 C2 ?? ?? ?? ?? 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 F4 E8 ?? ?? ?? ?? C3 E9
ep_only = false

[PKLITE v1.00, v1.03]
signature = B8 ?? ?? BA ?? ?? 8C DB 03 D8 3B
ep_only = true

[PKLITE v1.00c (1)]
signature = 2E 8C 1E ?? ?? 8B 1E ?? ?? 8C DA 81 C2 ?? ?? 3B DA 72 ?? 81 EB ?? ?? 83 EB ?? FA 8E D3 BC ?? ?? FB FD BE ?? ?? 8B FE
ep_only = true

[PKLITE v1.00c (2)]
signature = BA ?? ?? A1 ?? ?? 2D ?? ?? 8C CB 81 C3 ?? ?? 3B C3 77 ?? 05 ?? ?? 3B C3 77 ?? B4 09 BA ?? ?? CD 21 CD 20 90
ep_only = true

[PKLITE v1.12, v1.15, v1.20 (1)]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 73 ?? 2D ?? ?? FA 8E D0 FB 2D ?? ?? 8E C0 50 B9 ?? ?? 33 FF 57 BE ?? ?? FC F3 A5 CB B4 09 BA ?? ?? CD 21 CD 20
ep_only = true

[PKLITE v1.12, v1.15, v1.20 (2)]
signature = B8 ?? ?? BA ?? ?? 3B C4 73
ep_only = true

[PKLITE v1.14, v1.15, v1.20 (3)]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B ?? ?? ?? 72 ?? B4 09 BA ?? 01 CD 21 CD 20 4E 6F
ep_only = true

[PKLITE v1.14, v1.20]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 20
ep_only = true

[PKLITE v1.20]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 B4 4C CD 21
ep_only = true

[PKLITE v1.50 (1)]
signature = 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 ?? BA ?? ?? CD 21 B8 ?? ?? CD 21
ep_only = true

[PKLITE v1.50 (Device driver compression)]
signature = B4 09 BA 14 01 CD 21 B8 00 4C CD 21 F8 9C 50 53 51 52 56 57 55 1E 06 BB
ep_only = true

[PKLITE v2.00b]
signature = 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 59 2D ?? ?? 8E D0 51 2D ?? ?? 8E C0 50 B9
ep_only = true

[PKLITE v2.00b [extra]]
signature = 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EA ?? ?? ?? ?? F3 A5 C3 59 2D ?? ?? 8E D0 51 2D ?? ?? 50 80
ep_only = true

[PKLITE v2.00c]
signature = 50 B8 ?? ?? BA ?? ?? 3B C4 73 ?? 8B C4 2D ?? ?? 25 ?? ?? 8B F8 B9 ?? ?? BE ?? ?? FC
ep_only = true

[PKLITE32 1.1]
signature = 50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31
ep_only = true

[PKLITE32 1.1 -> PKWARE Inc.]
signature = 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 00 00 00 00 E8 ?? ?? ?? ?? E9
ep_only = true

[PKLITE32 v1.1]
signature = 55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 00 00 00 5D C2 0C 00 8B 45 0C 57 56 53 8B 5D 10
ep_only = true

[PKLITE32 v1.1]
signature = 55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 ?? ?? ?? 5D C2 0C ?? 8B 45 0C 57 56 53 8B 5D 10
ep_only = false

[PKLITE32 v1.1]
signature = 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 00 00 00 00 E8
ep_only = true

[PKLITE32 v1.1]
signature = 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 44 24 0C 50
ep_only = true

[PKLITE32 v1.1]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31
ep_only = true

[Pksmart 1.0b]
signature = BA ?? ?? 8C C8 8B C8 03 C2 81 ?? ?? ?? 51 B9 ?? ?? 51 1E 8C D3
ep_only = true

[PKTINY v1.0 with TINYPROG v3.8]
signature = 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? E9 ?? ?? E8 ?? ?? 83
ep_only = true

[PKZIP-SFX v1.1 1989-90]
signature = FC 2E 8C 0E ?? ?? A1 ?? ?? 8C CB 81 C3 ?? ?? 3B C3 72 ?? 2D ?? ?? 2D ?? ?? FA BC ?? ?? 8E D0 FB
ep_only = true

[PLINK86 1984, 1985]
signature = FA 8C C7 8C D6 8B CC BA ?? ?? 8E C2 26
ep_only = true

[PluginToExe v1.00 -> BoB / BobSoft]
signature = E8 00 00 00 00 29 C0 5D 81 ED D1 40 40 00 50 FF 95 B8 40 40 00 89 85 09 40 40 00 FF 95 B4 40 40 00 89 85 11 40 40 00 50 FF 95 C0 40 40 00 8A 08 80 F9 22 75 07 50 FF 95 C4 40 40 00 89 85 0D 40 40 00 8B 9D 09 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 0D 40 40 00 6A 00 81 C3 ?? ?? ?? 00 FF D3 83 C4 10 FF 95 B0 40 40 00
ep_only = true

[PluginToExe v1.01 -> BoB / BobSoft]
signature = E8 00 00 00 00 29 C0 5D 81 ED C6 41 40 00 50 8F 85 71 40 40 00 50 FF 95 A5 41 40 00 89 85 6D 40 40 00 FF 95 A1 41 40 00 50 FF 95 B5 41 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 B9 41 40 00 89 85 75 40 40 00 EB 6C 6A 01 8F 85 71 40 40 00 6A 58 6A 40 FF 95 A9 41 40 00 89 85 69 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 A9 41 40 00 89 47 1C C7 07 58 00 00 00 C7 47 20 00 08 00 00 C7 47 18 01 00 00 00 C7 47 34 04 10 88 00 8D 8D B9 40 40 00 89 4F 0C 8D 8D DB 40 40 00 89 4F 30 FF B5 69 40 40 00 FF 95 95 41 40 00 FF 77 1C 8F 85 75 40 40 00 8B 9D 6D 40 40 00 60 6A 00 6A 01 53 81 C3 ?? ?? ?? 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 75 40 40 00 6A 00 81 C3 ?? ?? 00 00 FF D3 83 C4 10 83 BD 71 40 40 00 00 74 10 FF 77 1C FF 95 AD 41 40 00 57 FF 95 AD 41 40 00 6A 00 FF 95 9D 41 40 00
ep_only = true

[PluginToExe v1.02 -> BoB / BobSoft]
signature = E8 00 00 00 00 29 C0 5D 81 ED 32 42 40 00 50 8F 85 DD 40 40 00 50 FF 95 11 42 40 00 89 85 D9 40 40 00 FF 95 0D 42 40 00 50 FF 95 21 42 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 25 42 40 00 89 85 E1 40 40 00 EB 6C 6A 01 8F 85 DD 40 40 00 6A 58 6A 40 FF 95 15 42 40 00 89 85 D5 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 15 42 40 00 89 47 1C C7 07 58 00
ep_only = true

[PMODE/W v.1.12, 1.16, 1.21, 1.33 DOS extender]
signature = FC 16 07 BF ?? ?? 8B F7 57 B9 ?? ?? F3 A5 06 1E 07 1F 5F BE ?? ?? 06 0E A4
ep_only = true

[PocketPC ARM]
signature = F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9 ?? ?? 9F E5 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 9F E5 00 ?? ?? ?? ?? 00
ep_only = true

[PocketPC MIB]
signature = E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF ?? 00
ep_only = true

[PocketPC SHA]
signature = 86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09
ep_only = true

[Pohernah 1.0.0 - by Kas]
signature = 58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28 49 EB CE 8B 85 82 25 40 00 89 44 24 1C 61 FF E0
ep_only = true

[Pohernah 1.0.1 - by Kas]
signature = 60 E8 00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00 31 C0 51 31 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 38 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 14 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3
ep_only = true

[Pohernah 1.0.2 - by Kas]
signature = 60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 25 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 01 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3
ep_only = true

[Pohernah 1.0.3 - by Kas]
signature = 60 E8 00 00 00 00 5D 81 ED 2A 27 40 00 31 C0 40 83 F0 06 40 3D 40 1F 00 00 75 07 BE 6A 27 40 00 EB 02 EB EB 8B 85 9E 28 40 00 83 F8 01 75 17 31 C0 01 EE 3D 99 00 00 00 74 0C 8B 8D 86 28 40 00 30 0E 40 46 EB ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3
ep_only = true

[PolyBox C -> Anskya]
signature = 55 8B EC 83 C4 F0 53 56 B8 E4 41 00 10 E8 3A E1 FF FF 33 C0 55 68 11 44 00 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 6A 0A 68 20 44 00 10 A1 1C 71 00 10 50 E8 CC E1 ?? ?? ?? ?? 85 DB 0F 84 77 01 00 00 53 A1 1C 71 00 10 50 E8 1E E2 FF FF 8B F0 85 F6 0F 84 61 01 00 00 53 A1 1C 71 00 10 50 E8 E0 E1 FF FF 85 C0 0F 84 4D 01 00 00 50 E8 DA E1 FF FF 8B D8 85 DB 0F 84 3D 01 00 00 56 B8 70 80 00 10 B9 01 00 00 00 8B 15 98 41 00 10 E8 9E DE FF FF 83 C4 04 A1 70 80 00 10 8B CE 8B D3 E8 E1 E1 FF FF 6A 00 6A 00 A1 70 80 00 10 B9 30 44 00 10 8B D6 E8 F8 FD FF FF
ep_only = false

[PolyBox D -> Anskya]
signature = 55 8B EC 33 C9 51 51 51 51 51 53 33 C0 55 68 84 2C 40 00 64 FF 30 64 89 20 C6 45 FF 00 B8 B8 46 40 00 BA 24 00 00 00 E8 8C F3 FF FF 6A 24 BA B8 46 40 00 8B 0D B0 46 40 00 A1 94 46 40 00 E8 71 FB FF FF 84 C0 0F 84 6E 01 00 00 8B 1D D0 46 40 00 8B C3 83 C0 24 03 05 D8 46 40 00 3B 05 B4 46 40 00 0F 85 51 01 00 00 8D 45 F4 BA B8 46 40 00 B9 10 00 00 00 E8 A2 EC FF FF 8B 45 F4 BA 9C 2C 40 00 E8 F1 ED FF FF
ep_only = false

[PolyCrypt PE - 2.1.4b/2.1.5 -> JLab Software Creations (h-oep)]
signature = 91 8B F4 AD FE C9 80 34 08 ?? E2 FA C3 60 E8 ED FF FF FF EB
ep_only = false

[PolyCrypt PE - 2.1.4b/2.1.5 -> JLab Software Creations (h-signed)]
signature = 50 6F 6C 79 43 72 79 70 74 20 50 45 20 28 63 29 20 32 30 30 34 2D 32 30 30 35 2C 20 4A 4C 61 62 53 6F 66 74 77 61 72 65 2E 00 50 00 43 00 50 00 45
ep_only = false

[PolyCryptor by SMT Version %v3.%v4]
signature = EB ?? 28 50 6F 6C 79 53 63 72 79 70 74 20 ?? ?? ?? 20 62 79 20 53 4D 54 29
ep_only = true

[PolyEnE V0.01+ -> Lennart Hedlund]
signature = 50 6F 6C 79 45 6E 45 00 4D 65 73 73 61 67 65 42 6F 78 41 00 55 53 45 52 33 32 2E 64 6C 6C
ep_only = false

[PoPa 0.01 (Packer on Pascal) -> bagie]
signature = 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 A4 3E 00 10 E8 30 F6 FF FF 33 C0 55 68 BE 40 00 10 ?? ?? ?? ?? 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 62 E7 FF FF 8B 45 EC E8 32 F2 FF FF 50 E8 B4 F6 FF FF A3 64 66 00 10 33 D2 55 68 93 40 00 10 64 FF 32 64 89 22 83 3D 64 66 00 10 FF 0F 84 3A 01 00 00 6A 00 6A 00 6A 00 A1 64 66 00 10 50 E8 9B F6 FF FF 83 E8 10 50 A1 64 66 00 10 50 E8 BC F6 FF FF 6A 00 68 80 66 00 10 6A 10 68 68 66 00 10 A1 64 66 00 10 50 E8 8B F6 FF FF
ep_only = true

[PPC-PROTECT 1.1X -> Alexey Gorchakov]
signature = FF 5F 2D E9 20 00 9F E5 00 00 90 E5 18 00 8F E5 18 00 9F E5 00 00 90 E5 10 00 8F E5 01 00 A0 E3 00 00 00 EB 02 00 00 EA 04 F0 1F E5
ep_only = true

[PrincessSandy v1.0 eMiNENCE Process Patcher Patch]
signature = 68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08
ep_only = false

[Private EXE Protector 1.8]
signature = BB DC EE 0D 76 D9 D0 8D 16 85 D8 90 D9 D0
ep_only = false

[Private EXE Protector 1.8 -> SetiSoft]
signature = A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 FF 31 F6 C3
ep_only = false

[Private EXE Protector 1.9.7 -> SetiSoft]
signature = 55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 02 44 24 0C 88 07 47 EB C6 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 82 6E 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 83 DC 00 00 00 B9 04 00 00 00 33 C0 8D A4 24 00 00 00 00 8D 64 24 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 48 74 B1 0F 89 EF 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 42 BD 00 01 00 00 B9 08 00 00 00 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 88 07 47 4D 75 D6
ep_only = false

[Private Exe Protector 1.x -> setisoft]
signature = B8 ?? ?? ?? ?? B9 ?? 90 01 ?? BE ?? 10 40 ?? 68 50 91 41 ?? 68 01 ?? ?? ?? C3
ep_only = true

[Private EXE Protector 2.0 -> SetiSoft]
signature = 89 ?? ?? 38 00 00 00 8B ?? 00 00 00 00 81 ?? ?? ?? ?? ?? 89 ?? 00 00 00 00 81 ?? 04 00 00 00 81 ?? 04 00 00 00 81 ?? 00 00 00 00 0F 85 D6 FF FF FF
ep_only = false

[Private exe Protector 2.0 -> SetiSoft Team]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00
ep_only = false

[Private exe Protector 2.15-2.2X -> SetiSoft Team]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00
ep_only = false

[Private exe Protector V1.8 -> SetiSoft Team]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73
ep_only = false

[Private EXE v2.0a]
signature = 53 E8 00 00 00 00 5B 8B C3 2D
ep_only = true

[Private Personal Packer (PPP) 1.0.2 -> ConquestOfTroy.com]
signature = E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9
ep_only = false

[Private Personal Packer (PPP) 1.0.3 -> ConquestOfTroy.com]
signature = E8 19 00 00 00 90 90 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9
ep_only = true

[Private Personal Packer (PPP) v1.0.2 --> ConquestOfTroy.com]
signature = E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00
ep_only = true

[PrivateEXE v2.0a]
signature = 06 60 C8 ?? ?? ?? 0E 68 ?? ?? 9A ?? ?? ?? ?? 3D ?? ?? 0F ?? ?? ?? 50 50 0E 68 ?? ?? 9A ?? ?? ?? ?? 0E
ep_only = true

[PrivateEXE v2.0a]
signature = 53 E8 ?? ?? ?? ?? 5B 8B C3 2D ?? ?? ?? ?? 50 81 ?? ?? ?? ?? ?? 8B
ep_only = true

[PRO-PACK v2.08]
signature = 8C D3 8E C3 8C CA 8E DA 8B 0E ?? ?? 8B F1 83 ?? ?? 8B FE D1 ?? FD F3 A5 53
ep_only = true

[PRO-PACK v2.08, emphasis on packed size, locked]
signature = 83 EC ?? 8B EC BE ?? ?? FC E8 ?? ?? 05 ?? ?? 8B C8 E8 ?? ?? 8B
ep_only = true

[ProActivate V1.0X -> TurboPower Software Company]
signature = 55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? ?? ?? ?? 90 90 90 90 90 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 83 C0 05 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0D 00 00 00 E8 85 E2 FF FF 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 7A 81 3D ?? ?? ?? ?? 43 52 43 33 75 6E 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 62 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 56 81 3D ?? ?? ?? ?? 43 52 43 33 75 4A 81 3D ?? ?? ?? ?? 32 40 7E 7E 75 3E 81 3D ?? ?? ?? ?? 21 7E 7E 40 75 32 81 3D ?? ?? ?? ?? 43 52 43 33
ep_only = true

[Program Protector XP v1.0]
signature = E8 ?? ?? ?? ?? 58 83 D8 05 89 C3 81 C3 ?? ?? ?? ?? 8B 43 64 50
ep_only = true

[Protect Shareware V1.1 -> eCompserv CMS]
signature = 53 00 74 00 72 00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F 00 00 00 ?? 01 00 00 01 00 30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00 01 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00
ep_only = false

[PROTECT! EXE/COM v6.0]
signature = 1E B4 30 CD 21 3C 02 73 ?? CD 20 BE ?? ?? E8
ep_only = true

[Protection Plus vx.x]
signature = 50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C ?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ?? ?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85
ep_only = true

[pscrambler 1.2 -> by p0ke]
signature = 55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 ?? ?? ?? ?? 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC B8 C4 54 00 10 E8 D9 EC FF FF 83 3D C4 54 00 10 00 0F 84 05 01 00 00 80 3D A0 40 00 10 00 74 41 A1 C4 54 00 10 E8 D9 ED FF FF E8 48 E0 FF FF 8B D8 A1 C4 54 00 10 E8 C8 ED FF FF 50 B8 C4 54 00 10 E8 65 EF FF FF 8B D3 59 E8 69 E1 FF FF 8B C3 E8 12 FA FF FF 8B C3 E8 33 E0 FF FF E9 AD 00 00 00 B8 05 01 00 00 E8 0C E0 FF FF 8B D8 53 68 05 01 00 00 E8 57 F3 FF FF 8D 45 DC 8B D3 E8 39 ED FF FF 8B 55 DC B8 14 56 00 10 B9 00 32 00 10 E8 BB ED FF FF 8B 15 14 56 00 10 B8 C8 54 00 10 E8 53 E5 FF FF BA 01 00 00 00 B8 C8 54 00 10 E8 8C E8 FF FF E8 DF E0 FF FF 85 C0 75 52 6A 00 A1 C4 54 00 10 E8 3B ED FF FF 50 B8 C4 54 00 10 E8 D8 EE FF FF 8B D0 B8 C8 54 00 10 59 E8 3B E6 FF FF E8 76 E0 FF FF B8 C8 54 00 10 E8 4C E6 FF FF E8 67 E0 FF FF 6A 00 6A 00 6A 00 A1 14 56 00 10 E8 53 EE FF FF 50 6A 00 6A 00 E8 41 F3 FF FF 80 3D 9C 40 00 10 00 74 05 E8 EF FB FF FF 33 C0 5A 59 59 64 89 10 68 EF 31 00 10 8D 45 DC BA 05 00 00 00 E8 7D EB FF FF C3 E9 23 E9 FF FF EB EB 5B E8 63 EA FF FF 00 00 00 FF FF FF FF 08 00 00 00 74 65 6D 70 2E 65 78 65
ep_only = true

[PUNiSHER v1.5 (DEMO) -> FEUERRADER/AHTeam]
signature = EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04
ep_only = true

[PUNiSHER v1.5 (DEMO) -> FEUERRADER/AHTeam]
signature = EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04 24 EB 04 64 6B 88 18 89 85 9C C2 41 00 EB 04 64 6B 88 18 58 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71 EE EB FA EB 83 C0 14 EB FF 70 ED
ep_only = true

[PUNiSHER V1.5 Demo-> FEUERRADER]
signature = EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00
ep_only = true

[PUNiSHER V1.5-> FEUERRADER]
signature = 3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32
ep_only = false

[PuNkMoD 1.x -> PuNkDuDe]
signature = 94 B9 ?? ?? 00 00 BC ?? ?? ?? ?? 80 34 0C
ep_only = false

[PureBasic 4.x -> Neil Hodgson]
signature = 68 ?? ?? 00 00 68 00 00 00 00 68 ?? ?? ?? 00 E8 ?? ?? ?? 00 83 C4 0C 68 00 00 00 00 E8 ?? ?? ?? 00 A3 ?? ?? ?? 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? ?? ?? 00 A3
ep_only = true

[PureBasic 4.x DLL -> Neil Hodgson]
signature = 83 7C 24 08 01 75 0E 8B 44 24 04 A3 ?? ?? ?? 10 E8 22 00 00 00 83 7C 24 08 02 75 00 83 7C 24 08 00 75 05 E8 ?? 00 00 00 83 7C 24 08 03 75 00 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? 0F 00 00 A3
ep_only = true

[PureBasic DLL -> Neil Hodgson]
signature = 83 7C 24 08 01 75 ?? 8B 44 24 04 A3 ?? ?? ?? 10 E8
ep_only = true

[QrYPt0r - by NuTraL]
signature = 80 F9 00 0F 84 8D 01 00 00 8A C3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32 C1 3C F3 75 89 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? BA D9 04 00 00 E8 00 00 00 00 5F 81 C7 16 01 00 00 80 2C 3A 01
ep_only = false

[QrYPt0r - by NuTraL]
signature = 86 18 CC 64 FF 35 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 64 89 25 00 00 00 00 BB 00 00 F7 BF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B8 78 56 34 12 87 03 E8 CD FE FF FF E8 B3
ep_only = false

[QrYPt0r - by NuTraL]
signature = EB 00 E8 B5 00 00 00 E9 2E 01 00 00 64 FF 35 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 64 89 25 00 00 00 00 8B 44 24 04
ep_only = true

[R!SC's Process Patcher v1.4]
signature = E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92
ep_only = false

[R!SC's Process Patcher v1.5.1]
signature = 68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83
ep_only = false

[RatPacker (Glue) stub]
signature = 40 20 FF 00 00 00 00 00 00 00 ?? BE 00 60 40 00 8D BE 00 B0 FF FF
ep_only = true

[RAZOR 1911 encruptor]
signature = E8 ?? ?? BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC
ep_only = true

[RCryptor 1.5 -> Vaska]
signature = 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? ?? EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor 1.6c -> Vaska]
signature = 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor 2.0 -> Vaska]
signature = F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF
ep_only = true

[RCryptor v1.1 --> Vaska]
signature = 8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0
ep_only = false

[RCryptor v1.1 --> Vaska]
signature = 8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = false

[RCryptor v1.3 / v1.4 --> Vaska]
signature = 55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50
ep_only = true

[RCryptor v1.3 / v1.4 --> Vaska]
signature = 55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor v1.3b --> Vaska]
signature = 61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7
ep_only = true

[RCryptor v1.3b --> Vaska]
signature = 61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor v1.5 (Private) --> Vaska]
signature = 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor v1.5 --> Vaska]
signature = 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F
ep_only = true

[RCryptor v1.6 -> Vaska]
signature = 33 D0 68 ?? ?? ?? ?? FF D2
ep_only = true

[RCryptor v1.6 -> Vaska]
signature = 33 D0 68 ?? ?? ?? ?? FF D2 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor v1.6b / v1.6c --> Vaska]
signature = 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68
ep_only = true

[RCryptor v1.6b / v1.6c --> Vaska]
signature = 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor v1.6d --> Vaska]
signature = 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68
ep_only = true

[RCryptor v1.6d --> Vaska]
signature = 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = false

[RCryptor V1.6d -> Vaska]
signature = 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor v1.6x --> Vaska]
signature = 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? C3
ep_only = true

[RCryptor v1.?? -> Vaska]
signature = 90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68
ep_only = true

[RCryptor v1.?? -> Vaska]
signature = 90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

[RCryptor v2.0 (Hide EP) --> Vaska]
signature = F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 DC 20 ?? 00 F7 D1 83 F1 FF E8 00 00 00 00 F7 D1 83 F1 FF C3
ep_only = true

[RCryptor v2.0 --> Vaska]
signature = F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? 02 00 00 F7 D1 83 F1 FF 59 BA 32 21 ?? 00 F7 D1 83 F1 FF F7 D1 83 F1 FF 80 02 E3 F7 D1 83 F1 FF C0 0A 05 F7 D1 83 F1 FF 80 02 6F F7 D1 83 F1 FF 80 32 A4 F7 D1 83 F1 FF 80 02 2D F7 D1 83 F1 FF 42 49 85 C9 75 CD 1C 4F 8D 5B FD 62 1E 1C 4F 8D 5B FD 4D 9D B9 ?? ?? ?? 1E 1C 4F 8D 5B FD 22 1C 4F 8D 5B FD 8E A2 B9 B9 E2 83 DB E2 E5 4D CD 1E BF 60 AB 1F 4D DB 1E 1E 3D 1E 92 1B 8E DC 7D EC A4 E2 4D E5 20 C6 CC B2 8E EC 2D 7D DC 1C 4F 8D 5B FD 83 56 8E E0 3A 7D D0 8E 9D 6E 7D D6 4D 25 06 C2 AB 20 CC 3A 4D 2D 9D 6B 0B 81 45 CC 18 4D 2D 1F A1 A1 6B C2 CC F7 E2 4D 2D 9E 8B 8B CC DE 2E 2D F7 1E AB 7D 45 92 30 8E E6 B9 7D D6 8E 9D 27 DA FD FD 1E 1E 8E DF B8 7D CF 8E A3 4D 7D DC 1C 4F 8D 5B FD 33 D7 1E 1E 1E A6 0B 41 A1 A6 42 61 6B 41 6B 4C 45 1E 21 F6 26 BC E2 62 1E 62 1E 62 1E 23 63 59 ?? 1E 62 1E 62 1E 33 D7 1E 1E 1E 85 6B C2 41 AB C2 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 20 33 9E 1E 1E 1E 85 A2 0B 8B C2 27 41 EB A1 A2 C2 1E C0 FD F0 FD 30 62 1E 33 7E 1E 1E 1E C6 2D 42 AB 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 C0 FD F0 8E 1D 1C 4F 8D 5B FD E0 00 33 5E 1E 1E 1E BF 0B EC C2 E6 42 A2 C2 45 1E C0 FD F0 FD 30 CE 36 CC F2 1C 4F 8D 5B FD
ep_only = true

[RE-Crypt v0.7x -> Crudd [RET] (h1)]
signature = 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B
ep_only = true

[RE-Crypt v0.7x -> Crudd [RET] (h2)]
signature = 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC 8B
ep_only = true

[Reflexive Arcade Wrapper]
signature = 55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8
ep_only = true

[Reg2Exe 2.20/2.21 - by Jan Vorel]
signature = 6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 32 12 00 00 A3 B0 44 40 00 68 F4 01 00 00 68 BC 44 40 00 FF 35 B8 44 40 00 E8 1E 12 00 00 B8 BC 44 40 00 89 C1 8A 30 40 80 FE 5C 75 02 89 C1 80 FE 00 75 F1 C6 01 00 E8 EC 18 00 00 E8 28 16 00 00 E8 4A 12 00 00 68 00 FA 00 00 68 08 00 00 00 FF 35 B0 44 40 00 E8 E7 11 00 00 A3 B4 44 40 00 8B 15 D4 46 40 00 E8 65 0A 00 00 BB 00 00 10 00 B8 01 00 00 00 E8 72 0A 00 00 74 09 C7 00 01 00 00 00 83 C0 04 A3 D4 46 40 00 FF 35 B4 44 40 00 E8 26 05 00 00 8D 0D B8 46 40 00 5A E8 CF 0F 00 00 FF 35 B4 44 40 00 FF 35 B8 46 40 00 E8 EE 06 00 00 8D 0D B4 46 40 00 5A E8
ep_only = true

[Reg2Exe 2.22/2.23 - by Jan Vorel]
signature = 6A 00 E8 2F 1E 00 00 A3 C4 35 40 00 E8 2B 1E 00 00 6A 0A 50 6A 00 FF 35 C4 35 40 00 E8 07 00 00 00 50 E8 1B 1E 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 C8 35 40 00 E8 76 16 00 00 83 C4 0C 8B 44 24 04 A3 CC 35 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 EC 1D 00 00 A3 C8 35 40 00 E8 62 1D 00 00 E8 92 1A 00 00 E8 80 16 00 00 E8 13 14 00 00 68 01 00 00 00 68 08 36 40 00 68 00 00 00 00 8B 15 08 36 40 00 E8 71 3F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 3F 00 00 FF 35 48 31 40 00 B8 00 01 00 00 E8 0D 13 00 00 8D 0D EC 35 40 00 5A E8 F2 13 00 00 68 00 01 00 00 FF 35 EC 35 40 00 E8 84 1D 00 00 A3 F4 35 40 00 FF 35 48 31 40 00 FF 35 F4 35 40 00 FF 35 EC 35 40 00 E8
ep_only = true

[Reg2Exe 2.24 - by Jan Vorel]
signature = 6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 8C 20 00 00 A3 F8 45 40 00 E8 02 20 00 00 E8 32 1D 00 00 E8 20 19 00 00 E8 A3 16 00 00 68 01 00 00 00 68 38 46 40 00 68 00 00 00 00 8B 15 38 46 40 00 E8 71 4F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 4F 00 00 FF 35 48 41 40 00 B8 00 01 00 00 E8 9D 15 00 00 8D 0D 1C 46 40 00 5A E8 82 16 00 00 68 00 01 00 00 FF 35 1C 46 40 00 E8 24 20 00 00 A3 24 46 40 00 FF 35 48 41 40 00 FF 35 24 46 40 00 FF 35 1C 46 40 00 E8 DC 10 00 00 8D 0D 14 46 40 00 5A E8 4A 16
ep_only = true

[Reg2Exe 2.25 - by Jan Vorel]
signature = 68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00 00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00 A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98 27 00 00 E8 93 20 00 00 68 01 00 00 00 68 D0 7D 40 00 68 00 00 00 00 8B 15 D0 7D 40 00 E8 89 8F 00 00 B8 00 00 10 00 68 01 00 00 00 E8 9A 8F 00 00 FF 35 A4 7F 40 00 68 00 01 00 00 E8 3A 23 00 00 8D 0D A8 7D 40 00 5A E8 5E 1F 00 00 FF 35 A8 7D 40 00 68 00 01 00 00 E8 2A 52 00 00 A3 B4 7D 40 00 FF 35 A4 7F 40 00 FF 35 B4 7D 40 00 FF 35 A8 7D 40 00 E8 5C 0C 00 00 8D 0D A0 7D 40 00 5A E8 26 1F 00 00 FF 35
ep_only = true

[ReversingLabsProtector 0.7.4 beta -> Ap0x]
signature = 68 00 00 41 00 E8 01 00 00 00 C3 C3
ep_only = true

[RJcrush v1.00]
signature = 06 FC 8C C8 BA ?? ?? 03 D0 52 BA ?? ?? 52 BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9
ep_only = true

[RJoiner 1.2 by Vaska (25.03.2007 16:58)]
signature = 55 8B EC 81 EC 0C 02 00 00 8D 85 F4 FD FF FF 56 50 68 04 01 00 00 FF 15 14 10 40 00 90 8D 85 F4 FD FF FF 50 FF 15 10 10 40 00 90 BE 00 20 40 00 90 83 3E FF 0F 84 84 00 00 00 53 57 33 FF 8D 46
ep_only = true

[RJoiner 1.2a -> Vaska]
signature = 55 8B EC 81 EC 0C 01 00 00 8D 85 F4 FE FF FF 56 50 68 04 01 00 00 FF 15 0C 10 40 00 94 90 94 8D 85 F4 FE FF FF 50 FF 15 08 10 40 00 94 90 94 BE 00 20 40 00 94 90 94 83 3E FF 74 7D 53 57 33 DB 8D 7E 04 94 90 94 53 68 80 00 00 00 6A 02 53 6A 01 68 00 00 00 C0 57 FF 15 04 10 40 00 89 45 F8 94 90 94 8B 06 8D 74 06 04 94 90 94 8D 45 FC 53 50 8D 46 04 FF 36 50 FF 75 F8 FF 15 00 10 40 00 94 90 94 FF 75 F8 FF 15 10 10 40 00 94 90 94 8D 85 F4 FE FF FF 6A 0A 50 53 57 68 20 10 40 00 53 FF 15 18 10 40 00 94 90 94 8B 06 8D 74 06 04 94 90 94 83 3E FF 75 89 5F 5B 33 C0 5E C9 C2 10 00 CC CC 24 11
ep_only = false

[RJoiner by Vaska (Sign from pinch 25.03.2007 17:00)]
signature = E8 03 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 6C 10 40 00 FF 25 70 10 40 00 FF 25 74 10 40 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10
ep_only = true

[RLP V0.7.3.beta -> ap0x]
signature = 2E 72 6C 70 00 00 00 00 00 50 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0
ep_only = false

[RLP v0.7.3beta -> ap0x]
signature = 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56
ep_only = false

[RLPack --> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 CD 09 00 00 89 85 14 0A 00 00 EB 14 60 FF B5 14 0A
ep_only = true

[RLPack --> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A
ep_only = true

[RLPack --> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 0C 00 00 EB 03 0C 00 00 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 47 02 00 00 EB 03 15 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 9B 0A
ep_only = true

[RLPack -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 CD 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 14 0A
ep_only = true

[RLPack -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 3A 0A
ep_only = true

[RLPack -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 ?? ?? ?? ?? EB 03 ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 9B 0A
ep_only = true

[RLPack 1.0 beta -> ap0x]
signature = 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5
ep_only = true

[RLPack 1.0 beta -> ap0x]
signature = 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5 48 02 00 00 56 FF D3 83 C4 08 8B B5 48 02 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 83 C0 04 89 85 44 02 00 00 EB 7A 56 FF 95 F1 01 00 00 89 85 40 02 00 00 8B C6 EB 4F 8B 85 44 02 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 44 02 00 00 C7 00 20 20 20 00 EB 06 FF B5 44 02 00 00 FF B5 40 02 00 00 FF 95 F5 01 00 00 89 07 83 C7 04 8B 85 44 02 00 00 EB 01 40 80 38 00 75 FA 40 89 85 44 02 00 00 80 38 00 75 AC EB 01 46 80 3E 00 75 FA 46 40 8B 38 83 C0 04 89 85 44 02 00 00 80 3E 01 75 81 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 48 02 00 00 FF 95 FD 01 00 00 61 68 ?? ?? ?? ?? C3 60 8B 74 24 24 8B 7C
ep_only = true

[RLPack 1.1 BasicEdition -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68
ep_only = true

[RLPack 1.18 (aPlib 0.43) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01
ep_only = true

[RLPack 1.18 (LZMA 4.30) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 ?? 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01
ep_only = true

[RLPack 1.18 Dll (aPlib 0.43) -> ap0x]
signature = 80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01
ep_only = true

[RLPack 1.18 Dll (LZMA 4.30) -> ap0x]
signature = 80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01
ep_only = true

[RLPack 1.20 Basic Edition [aPLib] -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00
ep_only = true

[RLPack 1.20 Basic Edition [LZMA] -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83
ep_only = true

[RLPack Full Edition 1.17 -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF
ep_only = true

[RLPack Full Edition 1.17 DLL -> Ap0x]
signature = 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8
ep_only = true

[RLPack Full Edition 1.17 DLL [aPLib] -> Ap0x]
signature = 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75
ep_only = true

[RLPack Full Edition 1.17 DLL [LZMA] -> Ap0x]
signature = 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85
ep_only = true

[RLPack Full Edition 1.17 iBox [aPLib] -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 79 29 00 00 8D 9D 2C 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34
ep_only = true

[RLPack Full Edition 1.17 iBox [LZMA] -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 67 30 00 00 8D 9D 66 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A
ep_only = true

[RLPack Full Edition 1.17 [aPLib] -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 74 1F 00 00 8D 9D 1E 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34
ep_only = true

[RLPack Full Edition 1.17 [LZMA] -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 73 26 00 00 8D 9D 58 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A
ep_only = true

[RLPack Full Edition V1.1X -> ap0x]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 10
ep_only = false

[RLPack V1.0.beta -> ap0x]
signature = 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB
ep_only = true

[RLPack V1.11 -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB
ep_only = true

[RLPack V1.12-V1.14 (aPlib 0.43) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF EB 0F FF ?? ?? ?? FF ?? ?? ?? D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB
ep_only = false

[RLPack V1.12-V1.14 (LZMA 4.30) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? 60
ep_only = false

[RLPack V1.15-V1.17 (aPlib 0.43) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB
ep_only = true

[RLPack V1.15-V1.17 (LZMA 4.30) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 83 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB 14
ep_only = true

[RLPack V1.15-V1.17 Dll -> ap0x]
signature = 80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8
ep_only = true

[RLPack v1.18 Basic DLL [aPLib] -> Ap0x]
signature = 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83
ep_only = true

[RLPack v1.18 Basic DLL [LZMA] -> Ap0x]
signature = 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A
ep_only = true

[RLPack v1.18 Basic [aPLib] -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83
ep_only = true

[RLPack v1.18 Basic [LZMA] -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A
ep_only = true

[RLPack V1.19 (aPlib 0.43) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3
ep_only = true

[RLPack V1.19 (LZMA 4.30) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3
ep_only = true

[RLPack V1.19 Dll (aPlib 0.43) -> ap0x]
signature = 80 7C 24 08 01 0F 85 89 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 48 04 00 00 00 74 0E 83 BD 4C 04 00 00 00 74 05 E8 B8 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 D1 03 00 00 89 85 5C 04 00 00 5B FF B5 5C 04 00 00 56 FF D3 83 C4 08 8B B5 5C 04 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 E9 94 00 00 00 56 FF 95 C9 03 00 00 85 C0 0F 84 B4 00 00 00 89 85 54 04 00 00 8B C6 EB 5B 8B 85 58 04 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 58 04 00 00 C7 00 20 20 20 00 EB 06 FF B5 58 04 00 00 FF B5 54 04 00 00 FF 95 CD 03 00 00 85 C0 74 71 89 07 83 C7 04 8B 85 58 04 00 00 EB 01 40 80 38 00 75 FA 40 89 85 58 04 00 00 66 81 78 02 00 80 74 A5 80 38 00 75 A0 EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 3C 04 00 00 83 C0 04 89 85 58 04 00 00 80 3E 01 0F 85 63 FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 5C 04 00 00 FF 95 D5 03 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3
ep_only = true

[RLPack V1.19 Dll (LZMA 4.30) -> ap0x]
signature = 80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3
ep_only = true

[ROD High TECH -> Ayman]
signature = 60 8B 15 1D 13 40 00 F7 E0 8D 82 83 19 00 00 E8 58 0C 00 00
ep_only = true

[RosAsm 2050a -> Betov]
signature = 55 8B EC 60 8B 5D 08 B9 08 00 00 00 BF ?? ?? ?? ?? 83 C7 07 FD 8A C3 24 0F 04 30 3C 39 76 02 04 07 AA C1 EB 04 E2 EE FC 68 00 10 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 61 8B E5 5D C2 04 00
ep_only = false

[Rpoly crypt by Vaska (20.03.07 18:41)]
signature = 58 ?? ?? ?? ?? ?? ?? ?? E8 00 00 00 58 E8 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? 04
ep_only = false

[RPolyCrypt v 1.0 (personal polycryptor) sign from pinch]
signature = 50 58 97 97 60 61 8B 04 24 80 78 F3 6A E8 00 00 00 00 58 E8 00 00 00 00 58 91 91 EB 00 0F 85 6B F4 76 6F E8 00 00 00 00 83 C4 04 E8 00 00 00 00 58 90 E8 00 00 00 00 83 C4 04 8B 04 24 80 78 F1
ep_only = true

[Safe 2.0]
signature = 83 EC 10 53 56 57 E8 C4 01 00
ep_only = false

[SafeDisc v4]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F
ep_only = false

[SafeGuard V1.0X -> simonzh2000]
signature = E8 00 00 00 00 EB 29 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 59 9C 81 C1 E2 FF FF FF EB 01 ?? 9D FF E1
ep_only = true

[SC Obfuscator -> SuperCRacker]
signature = 60 33 C9 8B 1D 00 ?? ?? ?? 03 1D 08 ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D 04 ?? ?? ?? 75 E7 A1 08 ?? ?? ?? 01 05 0C ?? ?? ?? 61 FF 25 0C
ep_only = false

[Sc Obfuscator -> SuperCRacker]
signature = 60 33 C9 8B 1D ?? ?? ?? ?? 03 1D ?? ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D ?? ?? ?? ?? 75 E7 A1 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? 61 FF 25 ?? ?? ?? ?? 00 00
ep_only = true

[SDC 1.2 (Self Decrypting Binary Generator) - by Claes M Nyberg]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00 00 85 C0 0F 85 A9 00 00 00 31 C0 83 C4 14 5B 5D C2 04 00 3D 94 00 00 C0 74 56 3D 96 00 00 C0 74 1E 3D 93 00 00 C0 75 E1 EB B5 3D 05 00 00 C0 8D B4 26 00 00 00 00 74 43 3D 1D 00 00 C0 75 CA C7 44 24 04 00 00 00 00 C7 04 24 04 00 00 00 E8 73 24 00 00 83 F8 01 0F 84 99 00 00 00 85 C0 74 A9 C7 04 24 04 00 00 00 FF D0 B8 FF FF FF FF EB 9B 31 DB 8D 74 26 00 E9 69 FF FF FF C7 44 24 04 00 00 00 00 C7 04 24 0B 00 00 00 E8 37 24 00 00 83 F8 01 74 7F 85 C0 0F 84 6D FF FF FF C7 04 24 0B 00 00 00 8D 76 00 FF D0 B8 FF FF FF FF E9 59 FF FF FF C7 04 24 08 00 00 00 FF D0 B8 FF FF FF FF E9 46 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 08 00 00 00 E8 ED 23 00 00 B8 FF FF FF FF 85 DB 0F 84 25 FF FF FF E8 DB 15 00 00 B8 FF FF FF FF E9 16 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 04 00 00 00 E8 BD 23 00 00 B8 FF FF FF FF E9 F8 FE FF FF C7 44 24 04 01 00 00 00 C7 04 24 0B 00 00 00 E8 9F 23 00 00 B8 FF FF FF FF E9 DA FE FF FF
ep_only = true

[SDProtect -> Randy Li]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05
ep_only = true

[SDProtector 1.x -> Randy Li]
signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41
ep_only = true

[SDProtector Basic/Pro Edition 1.10 -> Randy Li]
signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64
ep_only = true

[SDProtector Basic/Pro Edition 1.12 -> Randy Li]
signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E2
ep_only = true

[SDProtector Pro Edition 1.16 -> Randy Li]
signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41
ep_only = true

[SDProtector Pro Edition 1.16 -> Randy Li]
signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 93 03 00 00 03 C8 74 C4 75 C2 E8
ep_only = true

[SDProtector V1.1x -> Randy Li]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1
ep_only = true

[SEA-AXE]
signature = FC BC ?? ?? 0E 1F E8 ?? ?? 26 A1 ?? ?? 8B 1E ?? ?? 2B C3 8E C0 B1 ?? D3 E3
ep_only = true

[SEA-AXE v2.2]
signature = FC BC ?? ?? 0E 1F A3 ?? ?? E8 ?? ?? A1 ?? ?? 8B ?? ?? ?? 2B C3 8E C0 B1 03 D3 E3 8B CB BF ?? ?? 8B F7 F3 A5
ep_only = true

[SecuPack v1.5]
signature = 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 ?? E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 ?? 64 FF 30 64 89 20 6A ?? 68 80 ?? ?? ?? 6A 03 6A ?? 6A 01 ?? ?? ?? 80
ep_only = true

[SecureEXE 3.0 -> ZipWorx]
signature = E9 B8 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00
ep_only = true

[SecurePE 1.X -> www.deepzone.org]
signature = 8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55 34 40 00 89 AD 68 34 40 00 8D 85 BA 2F 40 00 50 C3
ep_only = true

[Securom7 -> Sony DADC]
signature = B8 ?? ?? ?? ?? 8B ?? ?? ?? ?? 0A ?? ?? ?? ?? ?? ?? E8
ep_only = true

[SEN Debug Protector???]
signature = BB ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 29 ?? ?? 4E E8
ep_only = true

[Sentinel SuperPro (Automatic Protection) v6.4.0 -> Safenet]
signature = 68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15
ep_only = true

[Sentinel SuperPro (Automatic Protection) v6.4.1 -> Safenet]
signature = A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00
ep_only = true

[Setup Factory v6.0.0.3 Setup Launcher]
signature = 55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89
ep_only = false

[Setup2Go Installer Stub]
signature = 5B 53 45 54 55 50 5F 49 4E 46 4F 5D 0D 0A 56 65 72
ep_only = false

[Sexe Crypter 1.1 - by santasdad]
signature = 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 D8 39 00 10 E8 30 FA FF FF 33 C0 55 68 D4 3A 00 10 64 FF 30 64 89 ?? ?? ?? ?? E4 3A 00 10 A1 00 57 00 10 50 E8 CC FA FF FF 8B D8 53 A1 00 57 00 10 50 E8 FE FA FF FF 8B F8 53 A1 00 57 00 10 50 E8 C8 FA FF FF 8B D8 53 E8 C8 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 14 57 00 10 E8 AD F6 FF FF B8 14 57 00 10 E8 9B F6 FF FF 8B CF 8B D6 E8 DA FA FF FF 53 E8 84 FA FF FF 8D 4D EC BA F8 3A 00 10 A1 14 57 00 10 E8 0A FB FF FF 8B 55 EC B8 14 57 00 10 E8 65 F5 FF FF B8 14 57 00 10 E8 63 F6 FF FF E8 52 FC FF FF 33 C0 5A 59 59 64 89 10 68 DB 3A 00 10 8D 45 EC E8 ED F4 FF FF C3 E9 83 EF FF FF EB F0 5F 5E 5B E8 ED F3 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 12 00 00 00 6B 75 74 68 37 36 67 62 62 67 36 37 34 76 38 38 67 79
ep_only = true

[Shegerd Dongle V4.78 -> MS.Co.]
signature = E8 32 00 00 00 B8 ?? ?? ?? ?? 8B 18 C1 CB 05 89 DA 36 8B 4C 24 0C
ep_only = true

[ShellModify 0.1 -> pll621]
signature = 55 8B EC 6A FF 68 98 66 41 00 68 3C 3D 41 00 64 A1 00 00 00 00
ep_only = true

[Shrink v1.0]
signature = 50 9C FC BE ?? ?? BF ?? ?? 57 B9 ?? ?? F3 A4 8B ?? ?? ?? BE ?? ?? BF ?? ?? F3 A4 C3
ep_only = true

[Shrink v2.0]
signature = E9 ?? ?? 50 9C FC BE ?? ?? 8B FE 8C C8 05 ?? ?? 8E C0 06 57 B9
ep_only = true

[Shrink Wrap v1.4]
signature = 58 60 8B E8 55 33 F6 68 48 01 ?? ?? E8 49 01 ?? ?? EB
ep_only = true

[Shrinker 3.2]
signature = 55 8B EC 56 57 75 65 68 00 01 00 00 E8 F1 E6 FF FF 83 C4 04
ep_only = false

[Shrinker 3.3]
signature = 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8
ep_only = false

[Shrinker 3.4]
signature = 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 11 0B 00 00 83 C4 04
ep_only = false

[Shrinker v3.2]
signature = 83 3D ?? ?? ?? ?? ?? 55 8B EC 56 57 75 65 68 00 01 ?? ?? E8 ?? E6 FF FF 83 C4 04 8B 75 08 A3 ?? ?? ?? ?? 85 F6 74 1D 68 FF
ep_only = true

[Shrinker v3.3]
signature = 83 3D ?? ?? ?? 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8
ep_only = true

[Shrinker v3.4]
signature = 83 3D B4 ?? ?? ?? ?? 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 ?? 0B 00 00 83 C4 04 8B 75 08 A3 B4 ?? ?? ?? 85 F6 74 23 83 7D 0C 03 77 1D 68 FF
ep_only = true

[Shrinker v3.4]
signature = BB ?? ?? BA ?? ?? 81 C3 07 00 B8 40 B4 B1 04 D3 E8 03 C3 8C D9 49 8E C1 26 03 0E 03 00 2B
ep_only = true

[Silicon Realms Install Stub]
signature = 55 8B EC 6A FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D ?? ?? 40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3
ep_only = false

[SimbiOZ -> Extranger]
signature = 50 60 E8 00 00 00 00 5D 81 ED 07 10 40 00 68 80 0B 00 00 8D 85 1F 10 40 00 50 E8 84 0B 00 00
ep_only = true

[SimbiOZ 1.3 -> Extranger]
signature = 57 57 8D 7C 24 04 50 B8 00 ?? ?? ?? AB 58 5F C3
ep_only = true

[SimbiOZ Poly 2.1 -> Extranger]
signature = 55 50 8B C4 83 C0 04 C7 00 ?? ?? ?? ?? 58 C3 90
ep_only = true

[SimbiOZ PolyCryptor v.xx-> Extranger]
signature = 55 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8
ep_only = true

[Simple UPX Cryptor V30.4.2005 -> MANtiCORE]
signature = 60 B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? ?? ?? ?? ?? E2 FA 61 68 ?? ?? ?? ?? C3
ep_only = true

[Simple UPX Cryptor v30.4.2005 [multi layer encryption] --> MANtiCORE]
signature = 60 B8 ?? ?? ?? 00 B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3
ep_only = true

[Simple UPX Cryptor v30.4.2005 [multi layer encryption] --> MANtiCORE]
signature = 60 B8 ?? ?? ?? ?? B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? ?? C3
ep_only = true

[Simple UPX Cryptor v30.4.2005 [One layer encryption] --> MANtiCORE]
signature = 60 B8 ?? ?? ?? 00 B9 ?? 01 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3
ep_only = true

[SimplePack 1.0X -> bagie]
signature = 60 E8 00 00 00 00 5B 8D 5B FA 6A 00 FF 93 ?? ?? 00 00 89 C5 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 8B 86 88 00 00 00 09 C0
ep_only = true

[SimplePack 1.11 Method 1 -> bagie[TMX]]
signature = 60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC
ep_only = true

[SimplePack 1.11 Method 1 -> bagie[TMX]]
signature = 60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC F3 A5 89 C1 83 E1 03 F3 A4 5F 5E 8B 04 24 89 EA 03 57 0C E8 3F 01 00 00 58 68 00 40 00 00 FF 77 10 50 FF 93 3C 03 00 00 83 C7 28 4E 75 9E BE ?? ?? ?? ?? 09 F6 0F 84 0C 01 00 00 01 EE 8B 4E 0C 09 C9 0F 84 FF 00 00 00 01 E9 89 CF 57 FF 93 30 03 00 00 09 C0 75 3D 6A 04 68 00 10 00 00 68 00 10 00 00 6A 00 FF 93 38 03 00 00 89 C6 8D 83 6F 02 00 00 57 50 56 FF 93 44 03 00 00 6A 10 6A 00 56 6A 00 FF 93 48 03 00 00 89 E5
ep_only = true

[SimplePack 1.11 Method 2(NT) -> bagie[TMX]]
signature = 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01
ep_only = true

[SimplePack 1.2.build.30.09 (Method2) -> bagie]
signature = 4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00
ep_only = false

[SimplePack 1.21.build.09.09 (Method2) -> bagie]
signature = 4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00
ep_only = false

[SimplePack 1.X (Method2) -> bagie]
signature = 4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00
ep_only = false

[SimplePack V1.1X (Method2) -> bagie]
signature = 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00
ep_only = false

[SimplePack V1.1X (Method2) -> bagie]
signature = 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00
ep_only = false

[SimplePack V1.1X-V1.2X (Method1) -> bagie]
signature = 60 E8 00 00 00 00 5B 8D 5B FA BD ?? ?? ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0
ep_only = true

[SkD Undetectabler 3 (No FSG 2 Method) -> SkD]
signature = 55 8B EC 81 EC 10 02 00 00 68 00 02 00 00 8D 85 F8 FD FF FF 50 6A 00 FF 15 38 10 00 01 50 FF 15 3C 10 00 01 8D 8D F8 FD FF FF 51 E8 4F FB FF FF 83 C4 04 8B 15 ?? 16 00 01 52 A1 ?? 16 00 01 50 E8 50 FF FF FF 83 C4 08 A3 ?? 16 00 01 C7 85 F4 FD FF FF 00 00 00 00 EB 0F 8B 8D F4 FD FF FF 83 C1 01 89 8D F4 FD FF FF 8B 95 F4 FD FF FF 3B 15 ?? 16 00 01 73 1C 8B 85 F4 FD FF FF 8B 0D ?? 16 00 01 8D 54 01 07 81 FA 74 10 00 01 75 02 EB 02 EB C7 8B 85 F4 FD FF FF 50 E8 ?? 00 00 00 83 C4 04 89 85 F0 FD FF FF 8B 8D F0 FD FF FF 89 4D FC C7 45 F8 00 00 00 00 EB 09 8B 55 F8 83 C2 01 89 55 F8 8B 45 F8 3B 85 F4 FD FF FF 73 15 8B 4D FC 03 4D F8 8B 15 ?? 16 00 01 03 55 F8 8A 02 88 01 EB D7 83 3D ?? 16 00 01 00 74
ep_only = true

[SkD Undetectabler Pro 2.0 (No UPX Method) -> SkD]
signature = 55 8B EC 83 C4 F0 B8 FC 26 00 10 E8 EC F3 FF FF 6A 0F E8 15 F5 FF FF E8 64 FD FF FF E8 BB ED FF FF 8D 40
ep_only = true

[SLVc0deProtector 0.60 -> SLV / ICU]
signature = EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD
ep_only = false

[SLVc0deProtector 1.1x -> SLV / ICU]
signature = E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C ?? ?? 00
ep_only = true

[SLVc0deProtector v0.6 -> SLV]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD FF FF FF 38 E8 E3 FF FF FF 66 E8 0D 00 00 00 04 E8 E3 FF FF FF 70 E8 CB FF FF FF 69 E8 DD FF FF FF 58 E8 DD FF FF FF 69 E8 E3 FF FF FF 79 E8 BF FF FF FF 69 83 C4 40 E8 00 00 00 00 5D 81 ED 97 11 40 00 8D B5 EF 11 40 00 B9 FE 2D 00 00 8B FE AC F8 ?? ?? ?? ?? ?? ?? 90
ep_only = true

[SLVc0deProtector v0.61 -> SLV]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00
ep_only = true

[SLVc0deProtector v0.61 -> SLV]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD FF FF FF 38 E8 E3 FF FF FF 66 E8 0D 00 00 00 04 E8 E3 FF FF FF 70 E8 CB FF FF FF 69 E8 DD FF FF FF 58 E8 DD FF FF FF 69 E8 E3 FF FF FF 79 E8 BF FF FF FF 69 83 C4 40 E8 00 00 00 00 5D 81 ED 9D 11 40 00 8D 95 B4 11 40 00 E8 CB 2E 00 00 33 C0 F7 F0 69 8D B5 05 12 40 00 B9 5D 2E 00 00 8B FE AC
ep_only = true

[SLVc0deProtector v1.1 -> SLV]
signature = E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C
ep_only = true

[SLVc0deProtector v1.1 -> SLV]
signature = E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6
ep_only = false

[SmartE -> Microsoft]
signature = EB 15 03 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 8F 07 00 00 89 85 83 07 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 2F 06 00 00 E8 8E 04 00 00 49 0F 88 23 06
ep_only = true

[SmokesCrypt v1.2]
signature = 60 B8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8A 14 08 80 F2 ?? 88 14 08 41 83 F9 ?? 75 F1
ep_only = true

[Soft Defender v1.0 - v1.1]
signature = 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD ?? 59 9C 50 74 0A 75 08 E8 59 C2 04 ?? 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 ?? ?? ?? ?? 58 05 BA 01 ?? ?? 03 C8 74 BE 75 BC E8
ep_only = true

[Soft Defender v1.1x -> Randy Li]
signature = 74 07 75 05 ?? ?? ?? ?? ?? 74 1F 75 1D ?? 68 ?? ?? ?? 00 59 9C 50 74 0A 75 08 ?? 59 C2 04 00 ?? ?? ?? E8 F4 FF FF FF ?? ?? ?? 78 0F 79 0D
ep_only = true

[SoftComp 1.x -> BG Soft PT]
signature = E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00
ep_only = false

[SoftDefender 1.x -> Randy Li]
signature = 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00
ep_only = true

[SoftDefender V1.1x -> Randy Li]
signature = 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44
ep_only = true

[SoftProtect -> SoftProtect.by.ru]
signature = EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C
ep_only = true

[SoftProtect -> www.softprotect.by.ru]
signature = E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? C7 00 00 00 00 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? 01
ep_only = true

[SoftSentry v2.11]
signature = 55 8B EC 83 EC ?? 53 56 57 E9 50
ep_only = true

[SoftSentry v3.0]
signature = 55 8B EC 83 EC ?? 53 56 57 E9 B0 06
ep_only = true

[Software Compress -> BG Software]
signature = E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8
ep_only = true

[Software Compress V1.2 ->  BG Software Protect Technologies]
signature = E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00
ep_only = true

[Software Compress v1.2 -> BG Software Protect Technologies]
signature = E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24
ep_only = true

[Software Compress v1.4 LITE -> BG Software Protect Technologies]
signature = E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A
ep_only = true

[Software Compress v1.4 LITE -> BG Software Protect Technologies]
signature = E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 4D 1A 41 00 89 44 24 1C 61 C2 04
ep_only = true

[SoftWrap]
signature = 52 53 51 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 36 ?? ?? ?? E8 ?? 01 ?? ?? 60 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F
ep_only = true

[SOFTWrapper for Win9x/NT (Evaluation Version)]
signature = E8 00 00 00 00 5D 8B C5 2D ?? ?? ?? 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00 00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57 8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF
ep_only = true

[SPEC b2]
signature = 55 57 51 53 E8 ?? ?? ?? ?? 5D 8B C5 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 09 89 85 ?? ?? ?? ?? 0F B6
ep_only = true

[SPEC b3]
signature = 5B 53 50 45 43 5D E8 ?? ?? ?? ?? 5D 8B C5 81 ED 41 24 40 ?? 2B 85 89 26 40 ?? 83 E8 0B 89 85 8D 26 40 ?? 0F B6 B5 91 26 40 ?? 8B FD
ep_only = true

[Special EXE Password Protector v1.0]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77
ep_only = true

[Special EXE Pasword Protector V1.01 (Eng) -> Pavol Cerven]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E
ep_only = true

[Special EXE Pasword Protector v1.01 (Eng) -> Pavol Cerven]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00
ep_only = true

[Splash Bitmap v1.00 (With Unpack Code) --> BoB / Bobsoft]
signature = E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 6A 40
ep_only = true

[Splash Bitmap v1.00 --> BoB / Bobsoft]
signature = E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 6A 00
ep_only = true

[Splasher v1.0 - v3.0]
signature = 9C 60 8B 44 24 24 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 50 E8 ED 02 ?? ?? 8C C0 0F 84
ep_only = true

[SPLayer v0.08]
signature = 8D 40 00 B9 ?? ?? ?? ?? 6A ?? 58 C0 0C ?? ?? 48 ?? ?? 66 13 F0 91 3B D9 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00
ep_only = false

[Splice 1.1 - by Tw1sted L0gic]
signature = 68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC 29 40 00 07 00 00 00 BC 28 40 00 07 00 00 00 74 28 40 00 07 00 00 00 2C 28 40 00 07 00 00 00 08 23 40 00 01 00 00 00 38 21 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 8C 21 40 00 08 ?? 40 00 01 00 00 00 AC 19 40 00 00 00 00 00 00 00 00 00 00 00 00 00 AC 19 40 00 4F 00 43 00 50 00 00 00 E7 AF 58 2F 9A 4C 17 4D B7 A9 CA 3E 57 6F F7 76
ep_only = true

[ST Protector V1.5 -> Silent Software]
signature = 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00
ep_only = false

[StarForce 3.0 -> StarForce Technology]
signature = 68 ?? ?? ?? ?? FF 25 ?? ?? 63
ep_only = true

[StarForce ProActive 1.1 -> StarForce Technology]
signature = 68 ?? ?? ?? ?? FF 25 ?? ?? 57
ep_only = true

[StarForce Protection Driver -> Protection Technology]
signature = 57 68 ?? 0D 01 00 68 00 ?? ?? 00 E8 50 ?? FF FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00
ep_only = true

[StarForce V1.X-V3.X -> StarForce Copy Protection System]
signature = 68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00
ep_only = true

[StarForce V3.X DLL -> StarForce Copy Protection System]
signature = E8 ?? ?? ?? ?? 00 00 00 00 00 00
ep_only = true

[Ste at lth PE 1.01 -> BGCorp]
signature = ?? ?? ?? ?? ?? BA ?? ?? ?? 00
ep_only = true

[Stealth PE v1.1]
signature = BA ?? ?? ?? 00 FF E2 BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 03 B8 ?? ?? ?? ?? 89 02 83 C2 FD FF E2
ep_only = true

[STNPEE 1.13]
signature = 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 3B 40 00
ep_only = true

[Stone's PE Encryptor v1.0]
signature = 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 63 3A 40 ?? 2B 95 C2 3A 40 ?? 83 EA 0B 89 95 CB 3A 40 ?? 8D B5 CA 3A 40 ?? 0F B6 36
ep_only = true

[Stone's PE Encryptor v1.13]
signature = 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 97 3B 40 ?? 2B 95 2D 3C 40 ?? 83 EA 0B 89 95 36 3C 40 ?? 01 95 24 3C 40 ?? 01 95 28
ep_only = true

[Stone's PE Encryptor v2.0]
signature = 53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 42 30 40 ?? FF 95 32 35 40 ?? B8 37 30 40 ?? 03 C5 2B 85 1B 34 40 ?? 89 85 27 34 40 ?? 83
ep_only = true

[Stone`s PE Encruptor v1.13]
signature = 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81
ep_only = true

[STUD RC4 1.0 Jamie Edition (ScanTime UnDetectable) - by MarjinZ]
signature = 68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4 18 40 00 07 00 00 00 7C 18 40 00 07 00 00 00 2C 18 40 00 07 00 00 00 E0 17 40 00 56 42 35 21 F0 1F 2A 00 00 00 00 00 00 00 00 00 00 00 00 00 7E 00 00 00 00 00 00 00 00 00 00 00 00 00 0A 00 09 04 00 00 00 00 00 00 E8 13 40 00 F4 13 40 00 00 F0 30 00 00 FF FF FF 08 00 00 00 01 00 00 00 00 00 00 00 E9 00 00 00 04 11 40 00 04 11 40 00 C8 10 40 00 78 00 00 00 7C 00 00 00 81 00 00 00 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 61 61 00 53 74 75 64 00 00 73 74 75 64 00 00 01 00 01 00 30 16 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 B4 16 40 00 10 30 40 00 07 00 00 00 24 12 40 00 0E 00 20 00 00 00 00 00 1C 9E 21 00 EC 11 40 00 5C 10 40 00 E4 1A 40 00 2C 34 40 00 68 17 40 00 58 17 40 00 78 17 40 00 8C 17 40 00 8C 10 40 00 62 10 40 00 92 10 40 00 F8 1A 40 00 24 19 40 00 98 10 40 00 9E 10 40 00 77 04 18 FF 04 1C FF 05 00 00 24 01 00 0D 14 00 78 1C 40 00 48 21 40 00
ep_only = true

[SuckStop v1.11]
signature = EB ?? ?? ?? BE ?? ?? B4 30 CD 21 EB ?? 9B
ep_only = true

[SuperDAT]
signature = 55 8B EC 6A FF 68 40 F3 42 00 68 A4 BF 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 08 F2 42 00 33 D2 8A D4 89 15 60 42 43 00 8B C8 81 E1 FF 00 00 00 89 0D
ep_only = true

[SVK Protector v1.32 (Eng) -> Pavol Cerven]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E
ep_only = true

[SVK Protector v1.3x (Eng) -> Pavol Cerven]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E
ep_only = true

[SVK Protector V1.3X -> Pavol Cerven]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

[SVK-Protector v1.051]
signature = 60 EB 03 C7 84 E8 EB 03 C7 84 9A E8 00 00 00 00 5D 81 ED 10 00 00 00 EB 03 C7 84 E9 64 A0 23 00 00 00 EB
ep_only = true

[SVK-Protector v1.11]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? 64 A0 23
ep_only = true

[SVK-Protector v1.32]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23
ep_only = true

[T-PACK v0.5c -m1]
signature = 68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 8E FE
ep_only = true

[T-PACK v0.5c -m2]
signature = 68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 CE FD
ep_only = true

[tElock 0.51 -> tE!]
signature = C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 FE C8 E8 00 00 00 00 32 C1 EB 02 82 0D AA EB 03 82 0D 58 EB 02 1D 7A 49 EB 05 E8 01 00 00 00 7F AE 14 7E A0 77 76 75 74
ep_only = true

[tElock 0.96 -> tE!]
signature = E9 59 E4 FF FF 00 00 00 00 00 00 00 ?? ?? ?? ?? EE ?? ?? 00 00 00 00 00 00 00 00 00 0E ?? ?? 00 FE ?? ?? 00 F6 ?? ?? 00 00 00 00 00 00 00 00 00 1B ?? ?? 00 06 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 ?? ?? 00 00 00 00 00 26 ?? ?? 00 00 00 00 00 39 ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C
ep_only = true

[tElock 0.98 -> tE!]
signature = E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E ?? ?? 00 00 00 00 00 00 00 00 00 3E ?? ?? 00 2E ?? ?? 00 26 ?? ?? 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 36 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 00 00 00 56 ?? ?? 00 00 00 00 00 69 ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65
ep_only = true

[tElock 0.98 Special Build -> forgot & heXer]
signature = E9 99 D7 FF FF 00 00 00 ?? ?? ?? ?? AA ?? ?? 00 00 00 00 00 00 00 00 00 CA
ep_only = true

[tElock 0.99 - 1.0 private -> tE!]
signature = E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00
ep_only = true

[tElock 0.99 -> tE!]
signature = E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05
ep_only = true

[tElock 0.99c (Private ECLIPSE) -> tE!]
signature = E9 3F DF FF FF 00 00 00 ?? ?? ?? ?? 04 ?? ?? 00 00 00 00 00 00 00 00 00 24 ?? ?? 00 14 ?? ?? 00 0C ?? ?? 00 00 00 00 00 00 00 00 00 31 ?? ?? 00 1C ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 00 00 00 3C ?? ?? 00 00 00 00 00 4F ?? ?? 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65
ep_only = true

[tElock v0.41x]
signature = 66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 50 8B FE 68 78 01 ?? ?? 59 EB 01 EB AC 54 E8 03 ?? ?? ?? 5C EB 08
ep_only = true

[tElock v0.42]
signature = C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 52 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08
ep_only = true

[tElock v0.4x - v0.5x]
signature = C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 ?? 8B FE 68 79 01 ?? ?? 59 EB 01
ep_only = true

[tElock v0.51]
signature = C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08
ep_only = true

[tElock v0.60]
signature = E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08
ep_only = true

[tElock v0.70]
signature = 60 E8 BD 10 00 00 C3 83 E2 00 F9 75 FA 70
ep_only = true

[tElock v0.71]
signature = 60 E8 ED 10 00 00 C3 83
ep_only = true

[tElock v0.71b2]
signature = 60 E8 44 11 00 00 C3 83
ep_only = true

[tElock v0.71b7]
signature = 60 E8 48 11 00 00 C3 83
ep_only = true

[tElock v0.80]
signature = 60 E8 F9 11 00 00 C3 83
ep_only = true

[tElock v0.85f]
signature = 60 E8 02 00 00 00 CD 20 E8 00 00 00 00 5E 2B C9 58 74 02
ep_only = true

[tElock v0.90]
signature = ?? ?? E8 02 00 00 00 E8 00 E8 00 00 00 00 5E 2B
ep_only = true

[tElock v0.98]
signature = E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E
ep_only = true

[tElock v0.98 -> tE!]
signature = E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00
ep_only = true

[tElock v0.99]
signature = E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00
ep_only = true

[tElock v0.99 Special Build -> heXer & forgot]
signature = E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00
ep_only = true

[tElock v0.99 Special Build -> heXer & forgot]
signature = E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00
ep_only = true

[The Guard Library]
signature = 50 E8 ?? ?? ?? ?? 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3
ep_only = true

[TheHyper's protector -> TheHyper]
signature = 55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ?? 01 01 ?? ?? 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8
ep_only = true

[Themida -> Oreans Technologies 2004]
signature = B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8
ep_only = true

[themida 1.0.0.5 -> http://www.oreans.com]
signature = B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44
ep_only = true

[Themida 1.0.x.x - 1.8.0.0 (compressed engine) -> Oreans Technologies]
signature = B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8
ep_only = true

[Themida 1.0.x.x - 1.8.0.0 (compressed engine) -> Oreans Technologies]
signature = B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 5A ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 5A ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01
ep_only = true

[Themida 1.0.x.x - 1.8.x.x (no compression) -> Oreans Technologies]
signature = 55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00
ep_only = false

[Themida 1.0.x.x - 1.8.x.x (no compression) -> Oreans Technologies]
signature = 55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8D 45 80 8B 5D 08 C7 85 7C FF FF FF 00 00 00 00 8B 8D 7C FF FF FF D1 C3 88 18 41 89 8D 7C FF FF FF 81 BD 7C FF FF FF 80 00 00 00 75 E3 C7 85 7C FF FF FF 00 00 00 00 8D BA ?? ?? ?? ?? 8D 75 80 8A 0E BB F4 01 00 00 B8 AB 37 54 78 D3 D0 8A 0F D3 D0 4B 75 F7 0F AF C3 47 46 8B 8D 7C FF FF FF 41 89 8D 7C FF FF FF 81 F9 80 00 00 00 75 D1 61 C9 C2 04 00 55 8B EC 83 C4 F0 8B 75 08 C7 45 FC 00 00 00 00 EB 04 FF 45 FC 46 80 3E 00 75 F7 BA 00 00 00 00 8B 75 08 8B 7D 0C EB 7F C7 45 F8 00 00 00 00 EB
ep_only = false

[Themida 1.2.0.1 (compressed) -> Oreans Technologies]
signature = B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8
ep_only = true

[Themida 1.2.0.1 -> Oreans Technologies]
signature = 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25
ep_only = false

[Themida 1.8.x.x -> Oreans Technologies]
signature = B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67
ep_only = true

[Themida 1.8.x.x -> Oreans Technologies]
signature = B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ??