C:\Portable\PEiD v0.95 With Plugins\userdb.

txt

04 August 2015 15:14

[>EP (ExE Pack) V1:0 -> Elite Coding Group]

signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10
ep_only = true
[>EP(ExE Pack)
signature = 60
?? ?? ?? ?? 6A
6D 00 00 00 73
00 00 00 10 C0
74 4D 11 C9 EB
7F 77 02 41 41
ep_only = true

V1:0 -> 6aHguT

68 ?? ?? ?? ??
40 FF D0 89 05
F6 31 C9 E8 64
73 F7 75 3F AA
1C 91 48 C1 E0
95 89 E8 B3 01

& g-l-u-k *
B8 ?? ?? ??
?? ?? ?? ??
00 00 00 73
EB D4 E8 4D
08 AC E8 2C
56 89 FE 29

Sign:By:fly]
?? FF 10 68 ??
89 C7 BE ?? ??
1C 31 C0 E8 5B
00 00 00 29 D9
00 00 00 3D 00
C6 F3 A4 5E EB

[>EP(ExE Pack)
signature = 60
?? ?? ?? ?? 6A
6D 00 00 00 73
ep_only = true

V1:0 -> 6aHguT

68 ?? ?? ?? ??
40 FF D0 89 05
F6 31 C9 E8 64

& g-l-u-k]
B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68
?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8
00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41

[>EP(ExE Pack) V1:4 lite b2 -> 6aHguT & g-l-u-k

signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ??
00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00
?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
44 4C 4C 00 55 53 45 52 33 32 2E 44 4C 4C 00 00
00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64
72 79 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78
6C 6C 6F 63 00 47 6C 6F 62 61 6C 46 72 65 65 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00
ep_only = false
[>EP(ExE Pack)
signature = 00
00 ?? ?? ?? ??
?? ?? 00 00 00
ep_only = true

??
??
00
10
00
00

* Sign:By:fly]
?? ?? ?? ?? ??
00 00 00 00 00
?? ?? 00 00 00
00 47 65 74 50
6C 65 41 00 00
41 00 00 00 00
00 00 00 00 00
00 00 00 00 00

??
60
00
E8
00
D2

??
00
00
72
00
00
00
00

50
FC
73
42
73
75

??
00
4B
6F
4C
EB
00
00

B8
B2
23
00
0A
05

??
00
45
63
6F
4C
00
00

??
80
B3
00
80
8A

00
00
52
41
61
47
00
00

??
31
02
00
FC
16

00
00
4E
64
64
6C
00
00

??
DB
41
EB
05
46

00
00
45
64
4C
6F
00
00

??
A4
B0
28
73
10

00
00
4C
72
69
62
00
00

FF
B3
10
AC
06
D2

00
00
33
65
62
61
00
00

10
02
E8
D1
83
C3

00
??
32
73
72
6C
00
00

68
E8
4F
E8
F8

00
??
2E
73
61
41
00
00

V1:4 lite b2 -> 6aHguT & g-l-u-k]

00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00
?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ??
00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45

[>EP(ExE Pack) V1:4 lite final -> 6aHguT & g-l-u-k

signature = 90 90 90 90 61 B8 ?? ?? ?? ?? FF E0 55
00 EB 04 8B 1C 24 C3 81 C3 00 02 00 00 53 57 8B 07
B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16 46 12 D2
C0 02 D2 75 05 8A 16 46 12 D2 0F 83 D6 00 00 00 02
8A 16 46 12 D2 13 C0 02 D2 75 05 8A 16 46 12 D2 13
57 2B F8 8A 07 5F 88 07 47 EB A0 B8 01 00 00 00 02
8A 16 46 12 D2 72 EA 83 E8 02 75 28 B9 01 00 00 00
05 8A 16 46 12 D2 72 EA 56 8B F7 2B F5 F3 A4 5E E9
01 00 00 00 02 D2 75 05 8A 16 46 12 D2 13 C9 02 D2
73 1A 3D 00 05 00 00 72 0E 41 56 8B F7 2B F0 F3 A4
56 8B F7 2B F0 F3 A4 5E E9 03 FF FF FF 8A 06 46 33
2B F0 F3 A4 5E E9 E7 FE FF FF 5D 2B 7D 0C 89 7D FC
ep_only = false
[>EP(ExE Pack)
signature = 90
00 EB 04 8B 1C
B2 80 8A 06 46
ep_only = true

??
??
00
75
7D
8E

* Sign:By:fly]
8B EC 60 55 8B
89 03 83 C7 04
73 EF 02 D2 75
D2 75 05 8A 16
C0 02 D2 75 05
D2 75 05 8A 16
02 D2 75 05 8A
58 FF FF FF 48
75 05 8A 16 46
5E E9 18 FF FF
C9 C0 E8 01 74
61 5D C3

75
83
05
46
8A
46
16
C1
12
FF
12

08
C3
8A
12
16
12
46
E0
D2
83
83

8B
04
16
D2
46
D2
12
08
72
F8
D1

7D
4E
46
13
12
13
D2
8A
EA
7F
02

0C
75
12
C0
D2
C0
13
06
3D
77
8B

E8
F3
D2
02
13
02
C9
46
00
03
E8

02
5F
73
D2
C0
D2
02
8B
7D
83
56

00
5E
4A
75
74
75
D2
E8
00
C1
8B

00
FC
33
05
06
05
75
B9
00
02
F7

V1:4 lite final -> 6aHguT & g-l-u-k]

90 90 90 61 B8 ?? ?? ?? ?? FF E0 55 8B EC 60 55 8B 75 08 8B 7D 0C E8 02 00 00
24 C3 81 C3 00 02 00 00 53 57 8B 07 89 03 83 C7 04 83 C3 04 4E 75 F3 5F 5E FC
88 07 47 02 D2 75 05 8A 16 46 12 D2 73 EF 02 D2 75 05 8A 16 46 12

[>EPack V1:4 lite final -> 6aHguT]

signature = 33 C0 8B C0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? 00 00 00 68 ?? ?? ?? ?? 68 ?? ??
?? ?? E8 ?? 00 00 00
ep_only = true
-1-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[$pirit v1:5]
signature = ?? ?? ?? 5B 24 55 50 44 FB 32 2E 31 5D
ep_only = true
[:BJFnt v1:1b]
signature = EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56
ep_only = true
[:BJFnt v1:2 RC]
signature = EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB
ep_only = true
[:BJFnt v1:3]
signature = EB ?? 3A ?? ?? 1E EB ?? CD 20 9C EB ?? CD 20 EB ?? CD 20 60 EB
ep_only = true
[:BJFnt v1:3]
signature = EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60
ep_only = true
[:NET DLL -> Microsoft]
signature = 00 00 00 00 00 00 00 00 5F 43 6F 72 44 6C 6C 4D 61 69 6E 00 6D 73 63 6F 72 65 65
2E 64 6C 6C 00 00 ?? 00 00 FF 25
ep_only = false
[:NET executable -> Microsoft]
signature = 00 00 00 00 00 00 00 00 5F 43 6F 72 45 78 65 4D 61 69 6E 00 6D 73 63 6F 72 65 65
2E 64 6C 6C 00 00 00 00 00 FF 25
ep_only = false
[:NET executable]
signature = FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true
[32Lite v0:03a]
signature = 60 06 FC 1E 07 BE ?? ?? ?? ?? 6A 04 68 ?? 10 ?? ?? 68
ep_only = true
[3DMark Database file]
signature = 33 44 4D 61 72 6B 20 44 61 74 61 62 61 73 65 20 46 69 6C 65
ep_only = false
[624 (Six to Four) v1:0]
signature = 50 55 4C 50 83 ?? ?? FC BF ?? ?? BE ?? ?? B5 ?? 57 F3 A5 C3 33 ED
ep_only = true
[A program by Jupiter ::]
signature = 2B C0 74 05 68 ?? ?? ?? ?? 50
ep_only = true
[A3E (TXT2COM)]
signature = 1E 33 C0 50 BE ?? ?? 81 C6 ?? ?? B8 ?? ?? 8E C0 BF ?? ?? B9 ?? ?? F3 A5 CB
ep_only = true
[Aase Crypter - by santasdad]
signature = 55 8B EC 83 C4 F0
68 00 43 00 10 68 0C 43 00 10
10 00 75 13 6A 00 68 18 43 00
?? ?? ?? ?? DF FF FF 50 E8 0E
43 00 10 68 38 43 00 10 6A 00

53
E8
10
DF
E8

B8
42
68
FF
15

A0
DF
1C
FF
DF

3E
FF
43
A3
FF

00
FF
00
94
FF

10
50
10
66
68

E8
E8
6A
00
48

-2-

93
44
00
10
43

DE
DF
E8
83
00

FF
FF
4B
3D
10

FF
FF
DF
94
68

68
A3
FF
66
0C

F8
98
FF
00
43

42
66
68
10
00

00
00
2C
00
10

10
10
43
75
E8

E8
83
00
13
D6

79
3D
10
6A
DE

DF
98
68
00
FF

FF
66
0C
68
FF

FF
00
43
18
50

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

E8 D8 DE FF FF A3 A0 66 00 10 83 3D A0 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 58 43 00 10
6A 00 E8 DF DE FF FF 68 6C 43 00 10 68 0C 43 00 10 E8 A0 DE FF FF 50 E8 A2 DE FF FF
ep_only = true
[Aase Crypter - by santasdad]
signature = 55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF
68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00
10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00
ep_only = true
[ABC Cryptor 1:0 - by ZloY]
signature = 68 FF 64 24 F0 68 58 58 58 58 90 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB
FF 68 ?? ?? ?? ?? BF 00 ?? ?? ?? B9 00 ?? ?? ?? 80 37 ?? 47 39 CF 75 F8
ep_only = true
[ABKprot v1:00]
signature = B4 30 CD 21 86 E0 3D ?? ?? 73 J3 9C 8C C0 06 5B 59 51 53 BA ?? ?? 87 F2 56 CF 0E
1F 0E 07
ep_only = true
[ACE Archive]
signature = ?? ?? ?? ?? ?? ?? ?? 2A 2A 41 43 45 2A 2A
ep_only = false
[AcidCrypt]
signature = 60 B9 ?? ?? ?? 00 BA ?? ?? ?? 00 BE ?? ?? ?? 00 02 38 40 4E 75 FA 8B C2 8A 18 32
DF C0 CB
ep_only = true
[AcidCrypt]
signature = BE ?? ?? ?? ?? 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB
ep_only = true
[ACProtect 1:09g -> Risco software Inc:]
signature = 60 F9 50 E8 01 00 00 00 7C 58 58 49 50 E8 01 00 00 00 7E 58 58 79 04 66 B9 B8 72
E8 01 00 00 00 7A 83 C4 04 85 C8 EB 01 EB C1 F8 BE 72 03 73 01 74 0F 81 01 00 00 00 F9 EB 01
75 F9 E8 01 00 00
ep_only = true
[ACProtect 1:3x - 1:4x DLL -> Risco Software Inc:]
signature = 80 7C 24 08 01 0F 85
ep_only = true
[ACProtect 1:41 -> AntiCrack Software]
signature = E8 01 00 00 00 ?? 83
ep_only = false
[ACProtect 1:4x -> RISCO soft]
signature = 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48
61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F
63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70
ep_only = false
[ACProtect 1:4x -> RISCO soft]
signature = 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48
61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F
63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F
45 6E 64 73 73 00
ep_only = false
[ACProtect v1:35 -> risco software Inc: & Anticrack Software (h)]
signature = 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
-3-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

?? ?? ?? ?? ?? ?? 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 47 65 74 50 72 6F 63
ep_only = false
[ACProtect V1:3X -> risco]
signature = 60 50 E8 01 00 00 00 75 83
ep_only = true
[ACProtect V1:4X -> risco]
signature = 60 E8 01 00 00 00 7C 83 04 24 06 C3
ep_only = true
[ACProtect v1:90g -> Risco software Inc:]
signature = 60 0F 87 02 00 00 00 1B F8 E8 01 00 00 00 73 83 04 24 06 C3
ep_only = true
[ACProtect V2:0 -> risco]
signature = 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? C3 C3
ep_only = true
[ACProtect/UltraProtect
signature = 00 00 00 00
00 ?? ?? ?? ?? ?? ?? ??
52 4E 45 4C 33 32 2E 44
ep_only = true

1:0X-2:0X -> RiSco]

00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00
?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45
4C 4C 00

[ACProtect/UltraProtect
signature = 00 00 00 00
00 ?? ?? ?? ?? ?? ?? ??
52 4E 45 4C 33 32 2E 44
55 53 45 52 33 32 2E 44
?? ?? ?? ?? ?? ?? ?? ??
47 65 74 4D 6F 64 75 6C
00 00 00 45 78 69 74 50
69 6E 65 49 6D 70 6F 72
ep_only = false

V1:0X-V2:0X
00 00 00 00
?? ?? ?? ??
4C 4C 00 ??
4C 4C 00 ??
00 00 00 00
65 48 61 6E
72 6F 63 65
74 5F 45 6E

->
??
??
??
??
00
64
73
64

RiSco
?? ??
?? 00
?? ??
?? ??
00 47
6C 65
73 00
73 73

* Sign:By:fly]
?? ?? ?? ?? ??
00 00 00 00 00
?? ?? ?? ?? ??
00 00 00 00 ??
65 74 50 72 6F
41 00 00 00 4C
00 00 4D 65 73
00

??
00
??
??
63
6F
73

??
00
??
??
41
61
61

??
00
??
??
64
64
67

??
00
??
??
64
4C
65

00
00
??
??
72
69
42

00
00
??
??
65
62
6F

00
00
??
??
73
72
78

00
00
00
??
73
61
41

00
00
00
??
00
72
00

00
4B
00
??
00
79
90

00
45
00
??
00
41
4D

[ActiveMark -> Trymedia Systems Inc:]

signature = 89 25 ?? ?? ?? ?? EB
ep_only = true
[ActiveMARK 5:x -> Trymedia Systems
signature = 20 2D 2D 4D 50 52 4D 4D
73 73 61 67 65 42 6F 78 41 00 54 68
6F 74 20 72 75 6E 20 77 69 74 68 20
ep_only = false

Inc: (h)]
47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65
69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E
61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67

[ActiveMARK 5:x -> Trymedia Systems;Inc: (h)]

signature = 20 2D 2D 4D 50 52 4D 4D 47 56 41 2D
73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61
6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61
69 6E 20 6D 65 6D 6F 72 79 2E 0D 0A 50 6C 65 61
65 62 75 67 67 65 72 20 61 6E 64 20 72 65 73 74
74 69 6F 6E 2E 00 57 61 72 6E 69 6E 67
ep_only = false

2D
70
63
73
61

00
70
74
65
72

75
6C
69
20
74

73
69
76
75
20

65
63
65
6E
74

72
61
20
6C
68

33
74
64
6F
65

32
69
65
61
20

2E
6F
62
64
61

64
6E
75
20
70

6C
20
67
74
70

6C
63
67
68
6C

00
61
65
65
69

4D
6E
72
20
63

65
6E
20
64
61

[ActiveMARK[TM]
signature = 79 11 7F AB 9A 4A 83 B5 C9 6B 1A 48 F9 27 B4 25
ep_only = true
[Added HYPDOC v:1:0]
signature = E9 J1 J1 E8 ?? ?? E8 ?? ?? E8 ?? ?? 2E C6 ?? ?? ?? ?? 2E C6 06 ?? ?? ?? B9 ?? ??
-4-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

2E 8A 26 ?? ?? B0 ?? E8 ?? ?? 2E
ep_only = true
[AdFlt2]
signature = 68 00 01 9C 0F A0 0F A8 60 FD 6A 00 0F A1 BE ?? ?? AD
ep_only = true
[Adlib Sample Audio file]
signature = 47 4F 4C 44 20 53 41 4D 50 4C 45
ep_only = false
[Ady's Glue 1:10]
signature = 2E ?? ?? ?? ?? 0E 1F BF ?? ?? 33 DB 33 C0 AC
ep_only = true
[Ady`s Glue v0:10]
signature = 2E 8C 06 ?? ?? 0E 07 33 C0 8E D8 BE ?? ?? BF ?? ?? FC B9 ?? ?? 56 F3 A5 1E 07 5F
ep_only = true
[AEP v1:00]
signature = E8 J1 J1 E4 21 2E ?? ?? ?? 33 C0 8B D8 5D B9 ?? ?? 50 B8 ?? ?? E6 21 0F A9 E6 ??
53
ep_only = true
[AHpack 0:1 ->
signature = 60
00 ?? ?? ?? 6A
6D 00 00 00 73
00 00 00 10 C0
74 4D 11 C9 EB
7F 77 02 41 41
ep_only = true

FEUERRADER (h)]
68 54 ?? ?? ?? B8
40 FF D0 89 05 CA
F6 31 C9 E8 64 00
73 F7 75 3F AA EB
1C 91 48 C1 E0 08
95 89 E8 B3 01 56

48
??
00
D4
AC
89

??
??
00
E8
E8
FE

??
??
73
4D
2C
29

??
89
1C
00
00
C6

FF
C7
31
00
00
F3

10
BE
C0
00
00
A4

68
00
E8
29
3D
5E

B3
10
5B
D9
00
EB

??
??
00
75
7D
8E

??
??
00
10
00
00

??
60
00
E8
00
D2

50
FC
73
42
73
75

B8
B2
23
00
0A
05

44
80
B3
00
80
8A

??
31
02
00
FC
16

??
DB
41
EB
05
46

??
A4
B0
28
73
10

FF
B3
10
AC
06
D2

10
02
E8
D1
83
C3

68
E8
4F
E8
F8

[AHPack 0:1 -> FEUERRADER]

signature = 60 68 54 ?? ?? 00 B8 48 ?? ?? 00 FF 10 68 B3 ?? ?? 00 50 B8 44 ?? ?? 00 FF 10 68
00
ep_only = true
[AHpack 0:1 ->
signature = 60
00 ?? ?? ?? 6A
6D 00 00 00 73
ep_only = true

FEUERRADER]
68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68
40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8
F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41

[AHTeam EP Protector 0:3 - 0:41 -> FEUERRADER]

signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 90 90 90 FF E0
ep_only = true
[AHTeam EP Protector v0:3 -> FEUERRADER]
signature = 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0
ep_only = true
[AINEXE v2:1]
signature = A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 36 A3 ?? ?? 05 ?? ?? 36 A3 ?? ?? 2E A1 ??
?? 8A D4 B1 04 D2 EA FE C9
ep_only = true
[AINEXE v2:30]
signature = 0E 07 B9 ?? ?? BE ?? ?? 33 FF FC F3 A4 A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8
ep_only = true
-5-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

[Alex Protector 0:4 beta 1

signature = 60 E8 01 00 00
83 C4 04 B9 ?? 00 00 00 E8
8B 2C 24 83 C4 04 E8 01 00
ep_only = false

04 August 2015 15:14

by
00
01
00

Alex]
C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68
00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04
00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68

[Alex Protector 1:0 -> Alex]

signature = 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00
ep_only = true
[Alex Protector 1:0 beta 2
signature = 60 E8 00 00 00
EB 03 C7 EB FB E8 01 00 00
EB 03 EB 03 C7 EB FB E8 01
ep_only = false

by
00
00
00

Alex]
5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03
A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04
00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25

[Alex Protector 1:0 beta 2

signature = 60 E8 00 00 00
EB 03 C7 EB FB E8 01 00 00
EB 03 EB 03 C7 EB FB E8 01
EB 01 E9 FF FF 60 EB 03 EB
EB FB E8 01 00 00 00 A8 83
2B C3 EB 03 EB 03 C7 EB FB
E8 01 00 00 00 A8 83 C4 04
EB 05 68 F0 0F C7 C8 EB 03
FB E8 01 00 00 00 A8 83 C4
ep_only = true

by
00
00
00
03
C4
E8
13
EB
04

Alex]
5D 81
A8 83
00 00
C7 EB
04 8B
01 00
D1 0F
03 C7
85

[Alex Protector v0:4

signature = 60 E8 01
83 C4 04 B9 ?? 00 00
8B 2C 24 83 C4 04 E8
00 00 00 00 E8 00 00
00 00 C7 83 C4 04 8D
03 04 05 68 90 60 8B
E8 64 00 00 00 73 1C
3F AA EB D4 E8 4D 00
C1 E0 08 AC E8 2C 00
ep_only = true

ED
C4
A8
FB
CA
00
31
EB

06
04
83
E8
EB
00
2B
FB

10
83
C4
01
03
A8
C3
E8

40
80
04
00
EB
83
EB
01

00
B8
50
00
03
C4
03
00

E8
00
64
00
C7
04
EB
00

24
00
FF
A8
EB
1B
03
00

00
00
35
83
FB
D1
C7
A8

00
02
00
C4
E8
0F
EB
83

00
33
00
04
01
31
FB
C4

EB
C0
00
0F
00
03
E8
04

01
EB
00
31
00
C3
01
1B

E9
01
64
8B
00
EB
00
D1

8B
E9
89
D8
A8
03
00
EB

44
C3
25
EB
83
EB
00
03

24
58
00
03
C4
03
A8
EB

0C
83
00
EB
04
C7
83
03

EB
C4
00
03
0F
EB
C4
C7

03
04
00
C7
31
FB
04
EB

beta 1 by Alex]
00 00 00 C7 83 C4
00 E8 01 00 00 00
01 00 00 00 A9 83
00 00 49 E8 01 00
95 63 14 40 00 E8
74 24 24 8B 7C 24
33 C0 E8 5B 00 00
00 00 2B CB 75 10
00 00 3D 00

04
68
C4
00
01
28
00
E8

33
83
04
00
00
FC
73
42

C9
C4
81
68
00
B2
23
00

E8
04
ED
83
00
80
B3
00

01
E8
3C
C4
C7
33
02
00

00
00
13
04
83
DB
41
EB

00
00
40
85
C4
A4
B0
28

00
00
00
C9
04
B3
10
AC

68
00
E8
75
90
02
E8
D1

83
E8
01
DF
90
E8
4F
E8

C4
01
00
E8
90
6D
00
74

04
00
00
B9
E8
00
00
4D

E8
00
00
02
CA
00
00
13

01
00
68
00
01
00
12
C9

00
C7
83
00
00
73
C0
EB

00
83
C4
E8
00
F6
73
1C

00
C4
04
01
01
33
F7
91

68
04
E8
00
02
C9
75
48

07
01
68
00
8D
03
40
C4

30
00
D8
58
B5
6A
00
33

40
00
01
83
00
00
8D
40

00
89
00
C0
33
6A
85
00

87
85
00
05
40
00
56
FF

[Alex Protector v1:0 -> Alex]

signature = 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B
ep_only = true
[Alias PIX/Vivid IMG Graphics format]
signature = ?? ?? ?? ?? 00 00 ?? ?? 00 18 ?? ?? ?? ?? 01
ep_only = false
[Alloy 4:x -> PGWare
signature = 9C 60 E8
DD 6A 04 68 00 10 00
2E 33 40 00 83 BD E8
50 FF 95 CC 33 40 00
EB 0C 68 D8 01 00 00
00 AC 0A C0 74 03 AA
68 00 00 00 80 FF B5
33 40 00 8D 9D 5E 33
B5 32 33 40 00 FF 95
ep_only = true

LLC]
02 00
00 68
32 40
50 8D
50 FF
EB F8
2E 33
40 00
B8 33

00
00
00
85
95
83
40
8D
40

00
02
01
28
C0
BD
00
8D
00

33
00
74
33
33
DC
FF
66
8B

C0
00
0D
40
40
32
95
33
85

8B
6A
83
00
00
40
B4
40

C4
00
BD
50
8B
00
33
00

83
FF
E4
FF
BD
01
40
51

C0
95
32
B5
2E
74
00
53

[Alloy 4:x -> PGWare LLC]

-6-

04
A8
40
2E
33
7A
83
50

93
33
00
33
40
6A
F8
FF

8B
40
01
40
00
00
FF
B5

E3
00
74
00
03
68
74
32

8B
0B
2A
FF
F8
80
57
33

5B
C0
8B
95
C6
00
89
40

FC
0F
F8
D0
07
00
85
00

81
84
EB
33
5C
00
32
FF

EB
F6
3E
40
47
6A
33
95

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87
DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85
2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68
ep_only = true
[Alloy v1:x:2000]
signature = 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 ?? 87
DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95 46 23 40 ?? 0B
ep_only = true
[Aluwain v8:09]
signature = 8B EC 1E E8 ?? ?? 9D 5E
ep_only = true
[Amiga AIFF 8SFX Audio file]
signature = 46 4F 52 4D ?? ?? ?? ?? 38 53 56 58 56 48 44 52
ep_only = false
[Amiga IFF/ILBM Graphics format]
signature = 46 4F 52 4D ?? ?? ?? ?? 49 4C 42 4D 42 4D 48 44
ep_only = false
[ANDpakk2 0:06
signature = 60
1E 46 12 DB 72
48 02 DB 75 05
ep_only = true

- by Dmitry
FC BE D4 00
F4 33 C0 40
8A 1E 46 12

"AND"
40 00
02 DB
DB 13

Andreev]
BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A
75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E
C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74

[ANDpakk2 0:06
signature = 60
1E 46 12 DB 72
48 02 DB 75 05
E8 EB 09 02 DB
05 8A 1E 46 12
56 8D 34 2F F3
ep_only = true

- by Dmitry
FC BE D4 00
F4 33 C0 40
8A 1E 46 12
75 05 8A 1E
DB 13 C9 02
A4 5E E9 73

&quot=AND&quot= Andreev]
40 00 BF 00 10 00 01 57 83
02 DB 75 05 8A 1E 46 12 DB
DB 13 C0 EB DC 83 E8 03 72
46 12 DB 13 C9 02 DB 75 05
DB 75 05 8A 1E 46 12 DB 73
FF FF FF C3

CD
13
0F
8A
EA

FF
C0
C1
1E
83

33
02
E0
46
C1

C9
DB
08
12
02

F9
75
AC
DB
81

EB
05
83
13
FD

05
8A
F0
C9
00

A4
1E
FF
75
FB

02
46
74
1A
FF

DB
12
4D
41
FF

75
DB
D1
02
83

05
72
F8
DB
D1

8A
0E
8B
75
01

[ANDpakk2 0:18
signature = FC
46 12 DB 72 F4
02 DB 75 05 8A
EB 09 02 DB 75
8A 1E 46 12 DB
8D 34 2F F3 A4
ep_only = true

- by Dmitry
BE D4 00 40
33 C0 40 02
1E 46 12 DB
05 8A 1E 46
13 C9 02 DB
5E E9 73 FF

&quot=AND&quot= Andreev]
00 BF 00 ?? ?? 00 57 83 CD
DB 75 05 8A 1E 46 12 DB 13
13 C0 EB DC 83 E8 03 72 0F
12 DB 13 C9 02 DB 75 05 8A
75 05 8A 1E 46 12 DB 73 EA
FF FF C3

FF
C0
C1
1E
83

33
02
E0
46
C1

C9
DB
08
12
02

F9
75
AC
DB
81

EB
05
83
13
FD

05
8A
F0
C9
00

A4
1E
FF
75
FB

02
46
74
1A
FF

DB
12
4D
41
FF

75
DB
D1
02
83

05
72
F8
DB
D1

8A
0E
8B
75
01

1E
48
E8
05
56

[Anskya Binder v1:1 -> Anskya]

signature = BE ?? ?? ?? 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11
ep_only = true
[Anskya NTPacker Generator
signature = 55 8B EC 83 C4
00 10 50 E8 71 FB FF FF 8B
A1 14 31 00 10 50 E8 5F FB
ep_only = true

->
F0
D8
FF

Anskya]
53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31
85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53
FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70

[Anskya NTPacker Generator

signature = 55 8B EC 83 C4
00 10 50 E8 71 FB FF FF 8B
A1 14 31 00 10 50 E8 5F FB
E8 F2 F6 FF FF 00 00 48 45
ep_only = true

->
F0
D8
FF
41

Anskya]
53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31
85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53
FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70 FC FF FF 5B
52 54

-7-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Anslym Crypter]
signature = 55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64
FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27
49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B
ep_only = true
[Anslym FUD Crypter > Sign
signature = 55 8B EC 83 C4
FF 30 64 89 20 EB 08 FC FC
49 FB FF E8 EA 47 FB FF 6A
ep_only = true

by fly]
F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64
FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27
0A

[Anti007 -> NsPacK Private

signature = 00 00 00 00 00
00 00 00 00 00 00 00 00 00
?? ?? ?? ?? ?? 00 10 00 00
00 E0 ?? ?? ?? ?? ?? ?? ??
00 00 00 00 00 00 00 60 00
?? ?? ?? ?? 00 00 00 00 00
ep_only = false

* Sign:By:fly]
00 00 00 00 00
00 00 00 00 00
00 00 00 00 ??
?? ?? ?? ?? ??
00 E0 ?? ?? ??
00 00 00 00 00

00
00
??
??
??
00

00
00
??
??
??
00

00
00
??
??
??
60

00
00
00
??
??
00

00
00
00
??
??
00

00
00
00
??
??
E0

00
00
00
??
??

00
00
00
??
??

00
00
00
??
??

00
00
00
??
??

00
??
00
??
??

00
??
00
??
??

00
??
00
00
??

00
??
00
00
00

00
??
00
00
00

00
??
60
00
00

00
??
00
00
00

[Anti007 -> NsPacK Private]

signature = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? 00 10 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00
ep_only = true
[Anti007 V1:0-V2:X -> NsPacK Private *
signature = 00 00 00 4C 6F 61 64 4C 69
64 72 65 73 73 00 00 00 56 69 72 74 75
6C 41 6C 6C 6F 63 00 00 00 56 69 72 74
65 73 73 00 00 00
ep_only = false

Sign:By:fly]
62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64
61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61
75 61 6C 46 72 65 65 00 00 00 45 78 69 74 50 72 6F 63

[Anti007 V1:0-V2:X -> NsPacK Private]

signature = 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64
64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61
6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 45 78 69 74
ep_only = true
[Anti007 V2:5-V2:6 -> NsPacK Private]
signature = 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64
64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61
6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53
ep_only = true
[Anti007 V2:6 -> LiuXingPing > Sign
signature = 00 00 00 4C 6F 61 64 4C
64 72 65 73 73 00 00 00 56 69 72 74
6C 41 6C 6C 6F 63 00 00 00 56 69 72
6D 44 69 72 65 63 74 6F 72 79 41 00
74 65 46 69 6C 65 00 00 00 43 6C 6F
65 73 73 00 00
ep_only = false

by
69
75
74
00
73

[Anti007 V2:7-V3:5 -> NsPacK Private *

signature = 00 00 00 4C 6F 61 64 4C 69
64 72 65 73 73 00 00 00 56 69 72 74 75
6C 41 6C 6C 6F 63 00 00 00 56 69 72 74
61 74 68 41 00 00 00 43 72 65 61 74 65
00 00 43 6C 6F 73 65 48 61 6E 64 6C 65

fly]
62 72
61 6C
75 61
00 43
65 48

61
50
6C
72
61

72
72
46
65
6E

79
6F
72
61
64

41
74
65
74
6C

00
65
65
65
65

00
63
00
46
00

00
74
00
69
00

47
00
00
6C
00

65
00
47
65
45

74
00
65
41
78

50
56
74
00
69

72
69
53
00
74

6F
72
79
00
50

63
74
73
57
72

41
75
74
72
6F

64
61
65
69
63

Sign:By:fly]
62 72 61 72 79
61 6C 50 72 6F
75 61 6C 46 72
46 69 6C 65 41
00 00 00 45 78

41
74
65
00
69

00
65
65
00
74

00
63
00
00
50

00
74
00
57
72

47
00
00
72
6F

65
00
47
69
63

74
00
65
74
65

50
56
74
65
73

72
69
54
46
73

6F
72
65
69
00

63
74
6D
6C
00

41
75
70
65
00

64
61
50
00

-8-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = false
[Anti007 V2:7-V3:5 -> NsPacK Private]
signature = 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64
64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61
6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 54
ep_only = true
[Anticrack Software Protector v1:09 (ACProtect)]
signature = 60 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 04 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? 01
ep_only = true
[Anticrack Software Protector
signature = 60 ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? 01 ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? 00 ?? ?? ??
01 ?? ?? ?? ?? 00 00 ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ??
ep_only = true

v1:09
?? ??
00 00
?? ??
?? ??
?? ??
?? ??
?? ??

(ACProtect)]
?? ?? E8 01 00
?? ?? ?? 04 ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
00 00 ?? ?? ??
?? ?? ?? ?? ??

00
??
??
??
??
??
??

00
??
??
??
??
??
??

??
??
??
66
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
00

??
00
??
??
??
??
00

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
00
??
??

??
??
??
00
??
??

??
??
??
00
78
??

??
??
??
??
03
??

??
??
??
??
79
??

[Anticrack Software Protector

signature = 60 ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? 00 ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

v1:09
?? ??
?? ??
?? ??
?? ??
?? ??
?? ??
?? ??
?? ??

(ACProtect)]
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
00 00 ?? ?? ??
?? ?? 01 ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
00
01
??
??
??
??
??

??
00
??
??
??
??
??
??

??
??
??
??
??
??
66
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

[Anticrack Software Protector

signature = 60 ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ??
00 00 ?? ?? ?? 04 ?? ?? ?? ??
?? ?? ?? 00 ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? 00 00 ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? 00 ?? ??
?? ?? ?? ?? ?? ?? 00
ep_only = true

v1:09
?? ??
?? ??
?? ??
?? ??
?? ??
?? ??
?? ??
?? ??

(ACProtect)]
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
00
04

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
00
??
??
??

??
??
??
??
??
??
00
??

??
??
??
??
??
??
00
??

??
??
??
??
??
??
??
??

[Anticrack Software Protector v1:09 (ACProtect)]

signature = 60 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00
00 ?? 83 04 24 06 C3 ?? ?? ?? ?? ?? 00
ep_only = true
[Anticrack Software Protector
signature = 60 ?? ?? ?? ?? ??
00 ?? 83 04 24 06 C3 ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? 00
?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? 00 ?? ?? ?? ?? ?? ?? ?? ??

v1:09
?? ??
?? ??
?? ??
?? 00
00 ??
?? ??
?? ??
?? ??

(ACProtect)]
?? 00 00 ?? ??
00 ?? ?? ?? ??
?? ?? ?? ?? ??
00 ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
-9-

??
??
??
??
??
??
01
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
66

??
??
??
??
??
??
??

??
??
??
??
??
??
??

E8
??
??
??
??
??
??

01
??
??
??
??
??
??

00
??
??
??
??
??
??

00
??
??
??
??
??
??

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[AntiDote 1:0 beta -> Spy Instructor]
signature = E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00
E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0
C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08
ep_only = true
[AntiDote 1:0 beta -> Spy Instructor]
signature = E8 BB FF FF FF 84 C0 74 2F
E8 40 FF FF FF 50 68 78 11 60 00 68 68
C2 10 00 90 90 90 8B 4C 24 08 56 8B 74
40 0F AF C1 5E C3 90 8B 44 24 04 53 55
F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8
66 8B 41 06 89 54 24 14 8D 68 FF 85 ED
1A 8B C1 33 D2 F7 F6 85 D2 75 04 03 F9
FF FF 00 00 3B C5 7E CB 8B C7 5F 5E 5D
FF 68 50 22 60 00 64 A1 00 00 00 00
ep_only = true

68
11
24
56
47
7C
EB
5B

04
60
08
8B
0F
37
0C
C3

01
00
33
48
AF
33
8B
90

00
68
D2
3C
FE
C0
C1
90

00
C0
8B
57
33
8B
33
90

68
23
C6
03
C0
4C
D2
90

C0
60
F7
C8
33
24
F7
90

23
00
F1
33
DB
14
F6
90

60
E8
8B
D2
66
8D
40
90

00
AB
C6
8B
8B
04
0F
90

6A
FD
85
79
41
80
AF
90

00
FF
D2
54
14
8B
C6
90

FF
FF
74
8B
8D
4C
03
90

15
83
08
71
54
C1
F8
90

08
C4
33
38
08
08
43
55

10
10
D2
8B
18
85
8B
8B

60
33
F7
C7
33
C9
C3
EC

00
C0
F1
F7
C0
74
25
6A

[AntiDote 1:0:Demo -> SIS-Team]

signature = 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74
56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41
00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52
ep_only = true
[AntiDote 1:0:Demo -> SIS-Team]
signature = 00 00 00 00 09 01 47
56 65 72 73 69 6F 6E 45 78 41 00
00 00 7A 03 57 61 69 74 46 6F 72
65 54 68 72 65 61 64 00 00 29 03
57 72 69 74 65 50 72 6F 63 65 73
6C 6F 63 45 78 00 00 A6 02 52 65
74 54 68 72 65 61 64 43 6F 6E 74
41 00 00 4B 45 52 4E 45 4C 33 32
26 00 43 68 61 72 4C 6F 77 65 72
73 74 72 00 00 91 02 6D 61 6C 6C
00 00 DA 00 5F 66 69 6C 62 75 66
6F 70 65 6E 00 49 00 5F 5F 43 78
2E 64 6C 6C 00 00
ep_only = false

65
73
53
53
73
61
65
2E
41
6F
00
78

74
01
69
65
4D
64
78
64
00
63
64
46

[AntiDote 1:2 Beta (Demo) -> SIS-Team]

signature = 68 69 D6 00 00 E8 C6 FD FF
FF 84 C0 74 2F 68 04 01 00 00 68 B0 21
10 60 00 68 78 10 60 00 68 B0 21 60 00
90 90 90 90 90 90 90 8B 4C 24 08 56 8B
F1 40 0F AF C1 5E C3 90 8B 44 24 04 53
F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B
C0
ep_only = true

43
47
6E
74
65
50
74
6C
00
00
02
72

6F
65
67
54
6D
72
00
6C
55
00
66
61

6D
74
6C
68
6F
6F
00
00
53
5E
74
6D

6D
4D
65
72
72
63
62
00
45
02
65
65

61
6F
4F
65
79
65
00
DC
52
66
6C
48

6E
64
62
61
00
73
43
01
33
72
6C
61

64
75
6A
64
00
73
72
4D
32
65
00
6E

4C
6C
65
43
6B
4D
65
65
2E
65
62
64

69
65
63
6F
03
65
61
73
64
00
02
6C

6E
46
74
6E
56
6D
74
73
6C
00
66
65

65
69
00
74
69
6F
65
61
6C
4C
73
72

41
6C
BF
65
72
72
50
67
00
02
65
00

00
65
02
78
74
79
72
65
00
66
65
4D

DB
4E
52
74
75
00
6F
42
C5
63
6B
53

01
61
65
00
61
CA
63
6F
02
6C
00
56

47
6D
73
00
6C
01
65
78
73
6F
57
43

65
65
75
94
41
47
73
41
74
73
02
52

74
41
6D
03
6C
65
73
00
72
65
66
54

FF
60
E8
74
55
F8

68
00
A4
24
56
47

69
6A
FD
08
8B
0F

D6
00
FF
33
48
AF

00
FF
FF
D2
3C
FE

00
15
83
8B
57
33

E8
08
C4
C6
03
C0

BC
10
10
F7
C8
33

FD
60
33
F1
33
DB

FF
00
C0
8B
D2
66

FF
E8
C2
C6
8B
8B

83
29
10
85
79
41

C4
FF
00
D2
54
14

08
FF
90
74
8B
8D

E8
FF
90
08
71
54

A4
50
90
33
38
08

FF
68
90
D2
8B
18

FF
88
90
F7
C7
33

[AntiDote 1:2:Demo -> SIS-Team]

signature = E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00
00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26
11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08 61 0F 1D 1D
2A 01 87 35 4C 07 39 0B
ep_only = true
[AntiDote 1:2:DLL:Demo -> SIS-Team]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80
7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06
-10-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B
ep_only = true
[AntiDote 1:2:DLL:Demo -> SIS-Team]
signature = EB 10 66 62 3A 43 2B 2B
7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE
46 88 07 47 01 DB 75 07 8B 1E 83 EE
11 DB 11 C0 01 DB 73 EF 75 09 8B 1E
46 83 F0 FF 74 74 89 C5 01 DB 75 07
DB 11 C9 75 20 41 01 DB 75 07 8B 1E
DB 73 E4 83 C1 02 81 FD 00 F3 FF FF
F7 E9 63 FF FF FF 90 8B 02 83 C2 04
ep_only = true
[AntiDote 1:2/1:4
signature = EB 10
7C 24 08 01 0F 85
46 88 07 47 01 DB
11 DB 11 C0 01 DB
ep_only = true

SE
66
??
75
73

48
??
FC
83
8B
83
83
89

4F
??
11
EE
1E
EE
D1
07

4F
??
DB
FC
83
FC
01
83

4B
??
72
11
EE
11
8D
C7

90
8D
ED
DB
FC
DB
14
04

DLL -> SIS-Team]

62 3A 43 2B 2B 48
?? ?? ?? 60 BE ??
07 8B 1E 83 EE FC
?? 75 ?? 8B 1E 83

4F
??
11
EE

4F
??
DB
FC

4B
??
72
11

90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80
8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06
ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC
DB

FF
FF
FF
FF
A4
56

68
FF
84
FF
10
8B

90
68
C0
68
60
74

03
69
74
69
00
24

00
D6
4F
D6
68
08

00
00
68
00
94
33

E8
00
04
00
10
D2

BC
E8
01
E8
60
8B

FD
9C
00
5E
00
C6

FF
FD
00
FD
68
F7

FF
FF
68
FF
10
F1

68
FF
10
FF
22
8B

90
50
22
50
60
C6

03
E8
60
E8
00
85

00
96
00
58
E8
D2

00
FD
6A
FD
58
74

E8
FF
00
FF
FD
08

B2
FF
FF
FF
FF
33

> Sign by fly]

01 47 65 74 43
41 00 73 01 47
6F 72 53 69 6E
29 03 53 65 74
65 73 73 4D 65
52 65 61 64 50
6E 74 65 78 74
33 32 2E 64 6C
6C 00 00 5E 02
91 02 6D 61 6C
65 6E 00 C5 02

6F
65
67
54
6D
72
00
6C
66
6C
73

6D
74
6C
68
6F
6F
00
00
72
6F
74

6D
4D
65
72
72
63
62
00
65
63
72

61
6F
4F
65
79
65
00
26
65
00
73

6E
64
62
61
00
73
43
00
00
00
74

64
75
6A
64
00
73
72
43
00
64
72

4C
6C
65
43
6B
4D
65
68
4C
02
00

69
65
63
6F
03
65
61
61
02
66
00

6E
46
74
6E
56
6D
74
72
66
74
4D

65
69
00
74
69
6F
65
4C
63
65
53

41
6C
BF
65
72
72
50
6F
6C
6C
56

00
65
02
78
74
79
72
77
6F
6C
43

DB
4E
52
74
75
00
6F
65
73
00
52

01
61
65
00
61
CA
63
72
65
62
54

47
6D
73
00
6C
01
65
41
00
02
2E

65
65
75
94
41
47
73
00
00
66
64

74
41
6D
03
6C
65
73
00
DA
73
6C

[AntiDote 1:4 SE -> SIS-Team]

signature = 68 90 03 00 00 E8
FD FF FF 50 E8 AC FD FF FF 50
50 E8 90 FD FF FF 83 C4 20 E8
15 08 10 60 00 68 90 03 00 00
50 E8 52 FD FF FF E8 DD FE FF
FF 83 C4 20 33 C0 C2 10 00 8B
D2 F7 F1 40 0F AF C1 5E C3
ep_only = true
[AntiDote V1:2 ->
signature = 00 00
56 65 72 73 69 6F
00 00 7A 03 57 61
65 54 68 72 65 61
57 72 69 74 65 50
6C 6F 63 45 78 00
74 54 68 72 65 61
41 00 00 4B 45 52
55 53 45 52 33 32
00 5F 66 69 6C 62
65 65 6B 00 57 02
6C 00 00
ep_only = false

SIS-Team
00 00 09
6E 45 78
69 74 46
64 00 00
72 6F 63
00 A6 02
64 43 6F
4E 45 4C
2E 64 6C
75 66 00
66 6F 70

C6
E8
78
E8
FF
4C

FD
A6
FF
68
50
24

FF
FD
FF
FD
68
08

E9
BE
B8
73
11
11
2F
83

08
??
01
E4
DB
C9
83
E9

32
??
00
31
11
01
FD
04

90
??
00
C9
C9
DB
FC
77

90
??
00
83
01
73
76
F1

90
57
01
E8
DB
EF
0F
01

90
83
DB
03
75
75
8A
CF

90
CD
75
72
07
09
02
E9

90
FF
07
0D
8B
8B
42
4C

90
EB
8B
C1
1E
1E
88
FF

90
0B
1E
E0
83
83
07
FF

90
90
83
08
EE
EE
47
FF

90
8A
EE
8A
FC
FC
49

80
06
FC
06
11
11
75

[AntiDote V1:2:Demo -> SIS-Team]

signature = E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00
00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26
11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08
ep_only = true
[AntiDote v1:4
signature = 68
FD FF FF 68 90
9C FD FF FF 50
ep_only = true

osCE *Sing by osC++CoDeR]

95 01 00 00 E8 D0 FD FF FF 68 95 01 00 00 E8 C3 FD FF FF 68 90 03 00 00 E8 BC
03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8
E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74

[AntiDote V1:x -> SIS-Team]

signature = 68 ?? ?? 00 00 E8 ?? FD FF FF 68 ?? ?? 00 00 E8 ?? FD FF FF 68 90 03 00 00 E8 ??
FD FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? FD FF FF
ep_only = true
-11-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[AntiVirus Vaccine v:1:03]

signature = FA 33 DB B9 ?? ?? 0E 1F 33 F6 FC AD 35 ?? ?? 03 D8 E2
ep_only = true
[aPack v0:62]
signature = 1E 06 8C C8 8E D8 ?? ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B6
ep_only = true
[aPack v0:82]
signature = 1E 06 8C CB BA ?? ?? 03 DA 8D ?? ?? ?? FC 33 F6 33 FF 48 4B 8E C0 8E DB
ep_only = true
[aPack v0:98 -m]
signature = 1E 06 8C C8 8E D8 05 ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B2 ?? BD ?? ?? 33 C9 50 A4
BB ?? ?? 3B F3 76
ep_only = false
[aPack v0:98b (com)]
signature = BE ?? ?? BF ?? ?? 8B CF FC 57 F3 A4 C3 BF ?? ?? 57 57 BE ?? ?? B2 ?? BD ?? ?? 50
A4
ep_only = false
[aPack v0:98b (DS & ES not saved)]
signature = 8C CB BA ?? ?? 03 DA FC 33 F6 33 FF 4B 8E DB 8D ?? ?? ?? 8E C0 B9 ?? ?? F3 A5 4A
75
ep_only = false
[aPack v0:98b (exe)]
signature = 93 07 1F 05 ?? ?? 8E D0 BC ?? ?? EA
ep_only = false
[APatch GUI v1:1]
signature = 52 31 C0 E8 FF FF FF FF
ep_only = true
[Apex 3:0 alpha -> 500mhz]
signature = 5F B9 14 00 00 00 51 BE 00 10 40 00 B9 00 ?? ?? 00 8A 07 30 06 46 E2 FB 47 59 E2
EA 68 ?? ?? ?? 00 C3
ep_only = false
[APEX_C (BLT Apex 4:0) -> 500mhz]
signature = 68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24
80 36 FD 46 E2 FA C3
ep_only = true
[Apex_c beta -> 500mhz]
signature = 68 ?? ?? ??
80 36 FD 46 E2 FA C3 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
ep_only = true

??
00
00
00
00
00
00
00
00

B9
00
00
00
00
00
00
00
00

FF
00
00
00
00
00
00
00
00

FF
00
00
00
00
00
00
00

FF
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

01
00
00
00
00
00
00
00

D0
00
00
00
00
00
00
00

F7
00
00
00
00
00
00
00

E2
00
00
00
00
00
00
00

72
00
00
00
00
00
00
00

01
00
00
00
00
00
00
00

48
00
00
00
00
00
00
00

E2
00
00
00
00
00
00
00

F7
00
00
00
00
00
00
00

B9
00
00
00
00
00
00
00

FF
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

8B
00
00
00
00
00
00
00

34
00
00
00
00
00
00
00

24
00
00
00
00
00
00
00

[Apex_c beta -> 500mhz]

signature = 68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24
80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
-12-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[App Encryptor -> Silent Team]
signature = 60 E8 00 00 00 00 5D 81 ED 1F 1F 40 00 B9 7B 09 00 00 8D BD 67 1F 40 00 8B F7 AC
ep_only = true
[App Protector
signature = E9
65 63 74 6F 72
72 65 0D 0A 54
20 69 73 20 53
6D 70 72 69 6D
61 6D 99 0D 0A
00 00 E8 EB 08
01 00 00 00 69
E4 69 FF A5 E4
ep_only = true

->
97
0D
68
50
61
60
EB
58
24

Silent Team]
00 00 00 0D 0A
0A 43 72 65 61
65 6E 6B 7A 20
61 6B 65 64 20
74 69 6F 6E 20
E8 01 00 00 00
02 CD 20 FF 24
66 BF 4D 4A E8
40 00 E9 E8 B9

[App Protector
signature = E9
65 63 74 6F 72
72 65 0D 0A 54
ep_only = true

->
97
0D
68

Silent Team]
00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74
0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61
65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A

53
74
74
41
73
E8
24
BF
FF

69
65
6F
70
79
83
9A
01

6C
64
20
70
73
C4
66
00

65
20
44
6C
74
04
BE
00

6E
62
6F
69
65
E8
47
8D

74
79
63
63
6D
01
46
52

20
20
68
61
20
00
E8
F9

54
53
74
74
69
00
01
E8

65
69
6F
69
73
00
00
01

61
6C
72
6F
20
E9
00
00

6D
65
20
6E
AE
5D
00
00

20
6E
58
0D
53
81
9A
00

41
74
0D
0A
69
ED
59
E8

70
20
0A
53
6C
76
8D
5B

70
53
0D
50
65
22
95
68

20
6F
0A
41
6E
40
C8
CC

50
66
54
4B
74
00
22
FF

72
74
68
20
20
E8
40
E2

6F
77
69
63
54
04
00
9A

74
61
73
6F
65
02
E8
FF

[ARC-SFX Archive]
signature = 8C C8 8C DB 8E D8 8E C0 89 ?? ?? ?? 2B C3 A3 ?? ?? 89 ?? ?? ?? BE ?? ?? B9 ?? ??
BF ?? ?? BA ?? ?? FC AC 32 C2 8A D8
ep_only = true
[ARJ SFX Custom]
signature = B8 ?? ?? ?? ?? 66 9C 60 50 8D 90 5C 01 00 00 68 00 00 40 00 83 3A 00 0F 84 C6 C1
FF FF 8B 04 24 8B 0A 0F BA F1 1F 73 13 FD 8B F0 8B F8 03 72 04 03 7A 08 F3 A5 83 C2 0C FC EB
D9 83 C2 10 8B 5A
ep_only = true
[ARJ SFX Custom]
signature = 60 BE 15 F0 40 00 8D BE EB 1F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46
88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11
DB 11 C0 01 DB 73
ep_only = true
[ARJ SFX Custom]
signature = 64 A1 00 00 00 00 55 8B EC 6A FF 68 18 C0 40 00 68 C4 A1 40 00 50 64 89 25 00 00
00 00 83 EC 60 53 56 57 89 65 E8 FF 15 38 03 41 00 A3 D0 D6 40 00 33 C0 A0 D1 D6 40 00 A3 DC
D6 40 00 A1 D0 D6
ep_only = true
[ARM Protector 0:1 by SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D
EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00
8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0
ep_only = false
[ARM Protector 0:2-> SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D
EB 01 00 81 ED 09 20 40 00 EB 02 83 09 8D B5 9A 20 40 00 EB 02 83 09 BA 0B 12 00 00 EB 01 00
8D 8D A5 32 40 00
ep_only = false
[ARM Protector v0:1 by SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D
EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00
-13-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

8D 8D 92 31 40 00
EB 04 58 40 50 C3
83 C3 07 53 C3 00
EB 09 2A C2 5B EB
ep_only = false

8B
8A
EB
01

09
06
04
00

E8
46
5B
43

04 August 2015 15:14

14
EB
43
53

00
01
53
C3

00
00
C3
88

00
D0
EB
07

83
C8
01
EB

EB
E8
00
01

01
14
32
00

[Armadillo 3:00a -> Silicon Realms Toolworks]

signature = 60 E8 00 00 00 00 5D 50 51 EB 0F ??
EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59
EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9
EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6
C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D
7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ??
08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8
24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71
?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D
33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ??
9C BD 26 42
ep_only = true

00
00
C2
47

8B
00
E8
4A

FE
00
0B
75

E8 00 00 00 00 58 83 C0 07 50 C3 00
83 EB 01 00 2A C2 E8 00 00 00 00 5B
00 00 00 00 32 C1 EB 01 00 C0 C0 02
B4

EB
58
F3
F2
??
EB
09
07
61
??

0F
50
EB
EB
72
0F
00
??
83
??

??
51
E4
08
0E
??
00
??
ED
79

EB
EB
FC
FD
79
EB
00
40
06
09

07
0F
??
EB
F1
08
E8
8B
33
74

??
??
59
E9
??
FD
E8
DB
FF
F0

EB
EB
58
F3
??
EB
23
7A
47
EB

0F
0F
50
EB
??
0B
00
11
60
87

??
??
51
E4
79
F2
00
EB
33
??

EB
EB
EB
FC
09
EB
00
08
C9
7A

08
07
0F
??
74
F5
7A
??
75
F0

FD
??
??
59
F0
EB
23
EB
02
??

EB
EB
EB
58
??
F6
??
F7
EB
??

0B
0F
0F
60
87
F2
8B
EB
15
61

F2
??
??
33
DB
EB
04
C3
??
8B

[Armadillo 3:00a -> Silicon Realms Toolworks]

signature = 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2
EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ??
EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F
ep_only = true
[Armadillo 3:01; 3:05]
signature = 60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2
EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90
EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F
ep_only = false
[Armadillo 3:10]
signature = 55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1
FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1
ep_only = false
[Armadillo 3:6x -> Silicon
signature = 60 E8 00 00 00
EB F5 EB F6 F2 EB 08 FD EB
EB 08 FD EB 0B F2 EB F5 EB
EB 07 ?? EB 0F ?? EB 08 FD
C9 75 02 EB 15 ?? 33 C9 75
7A F0 ?? ?? 61 50 51 EB 0F
08 FD EB E9 F3 EB E4 FC ??
24 EB 03 7A 29 ?? C6 00 90
?? 7A E9 70 DA 7B D1 71 F3
33 C9 75 18 7A 0C 70 0E EB
9C BD AB 76
ep_only = true

Realms Toolworks]
00 5D 50 51 EB 0F
E9 F3 EB E4 FC ??
F6 F2 EB 08 FD EB
EB 0B F2 EB F5 EB
18 7A 0C 70 0E EB
?? EB 0F ?? EB 07
59 58 60 9C 33 C0
C3 ?? 70 F0 87 D2
?? 7B F3 71 D6 ??
0D ?? 72 0E 79 F1

??
59
E9
F6
0D
??
E8
71
9D
??

EB
58
F3
F2
??
EB
09
07
61
??

0F
50
EB
EB
72
0F
00
??
83
??

??
51
E4
08
0E
??
00
??
ED
79

EB
EB
FC
FD
79
EB
00
40
06
09

07
0F
??
EB
F1
08
E8
8B
33
74

??
??
59
E9
??
FD
E8
DB
FF
F0

EB
EB
58
F3
??
EB
23
7A
47
EB

0F
0F
50
EB
??
0B
00
11
60
87

??
??
51
E4
79
F2
00
EB
33
??

EB
EB
EB
FC
09
EB
00
08
C9
7A

08
07
0F
??
74
F5
7A
??
75
F0

FD
??
??
59
F0
EB
23
EB
02
??

EB
EB
EB
58
??
F6
??
F7
EB
??

0B
0F
0F
60
87
F2
8B
EB
15
61

F2
??
??
33
DB
EB
04
C3
??
8B

[Armadillo 3:7x -> Silicon

signature = 60 E8 00 00 00
EB F5 EB F6 F2 EB 08 FD EB
EB 08 FD EB 0B F2 EB F5 EB
EB 07 ?? EB 0F ?? EB 08 FD
C9 75 02 EB 15 ?? 33 C9 75
7A F0 ?? ?? 61 50 51 EB 0F
08 FD EB E9 F3 EB E4 FC ??
24 EB 03 7A 29 ?? C6 00 90
?? 7A E9 70 DA 7B D1 71 F3

Realms Toolworks]
00 5D 50 51 EB 0F
E9 F3 EB E4 FC ??
F6 F2 EB 08 FD EB
EB 0B F2 EB F5 EB
18 7A 0C 70 0E EB
?? EB 0F ?? EB 07
59 58 60 9C 33 C0
C3 ?? 70 F0 87 D2
?? 7B F3 71 D6 ??

??
59
E9
F6
0D
??
E8
71
9D

EB
58
F3
F2
??
EB
09
07
61

0F
50
EB
EB
72
0F
00
??
83

??
51
E4
08
0E
??
00
??
ED

EB
EB
FC
FD
79
EB
00
40
06

07
0F
??
EB
F1
08
E8
8B
B8

??
??
59
E9
??
FD
E8
DB
3B

EB
EB
58
F3
??
EB
23
7A
01

0F
0F
50
EB
??
0B
00
11
00

??
??
51
E4
79
F2
00
EB
00

EB
EB
EB
FC
09
EB
00
08
03

08
07
0F
??
74
F5
7A
??
C5

FD
??
??
59
F0
EB
23
EB
33

EB
EB
EB
58
??
F6
??
F7
DB

0B
0F
0F
60
87
F2
8B
EB
81

F2
??
??
33
DB
EB
04
C3
C3

-14-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

01 01 01 01 31 18 81 38 78 54 00 00 74 04 31 18 EB EC
ep_only = true
[Armadillo 3:X-5:X -> Silicon
signature = 60 E8 00 00 00 00
EB 0F 90 EB 08 FD EB 0B F2 EB
59 58 50 51 0F CA F7 D2 9C F7
ep_only = true
[Armadillo 4:00:0053
signature = 55 8B EC
00 00 83 EC 58 53 56
FF 00 00 00 89 0D A0
ep_only = false

->
6A
57
A1

Realms Toolworks]
5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9
F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1
D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08

Silicon Realms
FF 68 20 8B 4B
89 65 E8 FF 15
4B 00 C1 E1 08

Toolworks]
00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00
88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1
03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1

[Armadillo 4:10 -> Silicon

signature = 55 8B EC 6A FF
00 00 83 EC 58 53 56 57 89
FF 00 00 00 89 0D 78 A5 4C
ep_only = false

Realms Toolworks]
68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00
65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1
00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5

[Armadillo 4:20 -> Silicon

signature = 55 8B EC 6A FF
00 00 83 EC 58 53 56 57 89
FF 00 00 00 89 0D 80 A5 4C
ep_only = false

Realms Toolworks]
68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00
65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1
00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5

[Armadillo 4:30 signature = 55 8B

00 00 83 EC 58 53
FF 00 00 00 89 0D
ep_only = false

4:40 -> Silicon Realms Toolworks]

EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00
56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1
2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24

[Armadillo 4:30a -> Silicon Realms Toolworks

signature = 44 64 65 44 61 74 61 20 69 6E 69
20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72
00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69
2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61
00 00 00 00 50 75 74 53 74 72 69 6E 67 28 27
2C 20 66 61 6C 73 65 00 00 47 65 74 53
ep_only = false

(h)]
74 69
65 20
61 6C
72 65
25 73

61
27
69
20
27

6C
25
7A
27
29

69
73
65
25
00

7A
27
64
53
47

65
20
20
27
65

64
61
28
20
74

20
6E
55
61
53

28
64
4E
6E
74

41
20
49
64
72

4E
27
43
20
69

53
25
4F
27
6E

49
73
44
25
67

29
27
45
53
28

2C
00
29
27
29

[Armadillo 4:30a -> Silicon Realms Toolworks]

signature = 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C
20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00
00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43
ep_only = true
[Armadillo 4:40 -> Silicon
signature = 31 2E 31 2E 34
EB D8 6F 50 B4 B5 29 24 FA
57 FC 55 0A DD 44 BE 2A 02
05 42 55 53 79 73 74 65 6D
50 72 6F 63 65 73 73 69 6E
00 6F 00 63 00 65 00 73 00
45 00 00 00 00 00 3C 00 00
ep_only = false

Realms Toolworks (h)]

00 00 00 C2 E0 94 BE 93
45 08 04 52 D5 1B D2 8C
97 6B 65 15 AA 31 E9 28
00 00 53 00 79 00 73 00
67 00 00 53 77 50 44 44
73 00 69 00 6E 00 67 00
00

[Armadillo 4:40 -> Silicon

signature = 31 2E 31 2E 34
EB D8 6F 50 B4 B5 29 24 FA
57 FC 55 0A DD 44 BE 2A 02

Realms Toolworks]
00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF
45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69
97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8
-15-

FC
8A
7D
74
45
00

DE
1E
49
00
00
00

C6
6E
1B
65
00
00

B6
FF
DF
00
44
00

24
8C
B5
6D
00
53

83
5F
5D
00
44
00

F7
42
08
00
00
77

D2
89
A8
00
45
00

A4
F1
BA
00
00
50

92
83
A8
00
20
00

77
B1
73
44
00
44

40
27
DC
44
50
00

27
C5
F6
45
00
44

CF
69
D1
20
72
00

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[Armadillo 4:44a public
signature = 55 8B EC 83
FC 51 B9 00 08 00 00 B9
41 83 C1 03 41 41 41 41
83 C1 0A 49 52 BA 04 00
?? ?? ?? ?? 33 0D ?? ??
45 F8 50 FF 15 ?? ?? ??
50 FF 15 ?? ?? ?? ?? 83
00 00 00 F7 D3 0F C8 F7
5B 89 45 F4 8B 0D ?? ??
CA 01 89 55 F8 8B 45 F8
53 56 57 8B 45 08 50 FF
EB F9 53 BB FF FF 00 00
FE CD 22 E5 B1 70 80 E9
E9 10 FE C9 FE C9 80 C1
C9 FE C9 80 E9 10 80 E9
0F C8 FE C1 80 C1 02 22
80 00 00 00 BB 72 00 00
0F C8 23 C3 5B F7 D8 1B
ep_only = false

build
EC 0C
06 00
41 41
00 00
?? ??
?? 83
C4 04
D3 43
?? ??
50 FF
15 ??
23 C3
02 FE
0C FE
01 FE
C1 59
00 F7
C0 40

[Armadillo 5:00 -> Silicon

signature = E8 E3 40 00 00
3B CF 76 2E 6A E0 58 33 D2
57 57 57 57 E8 C7 12 00 00
ep_only = true

->
53
00
49
03
D1
C4
89
43
33
15
??
51
C9
C9
C9
5B
D3
5A

Silicon Realms
56 57 8B 45 08
00 F7 D1 0F C8
41 FE C1 FE C1
CA 41 5A 0F C8
E1 89 4D F8 83
04 5F 5E 5B 8B
45 FC 8B 45 FC
83 E0 00 83 C3
0D ?? ?? ?? ??
?? ?? ?? ?? 83
?? ?? 83 C4 04
B5 2C 80 ED 01
FE C9 FE C9 80
FE C9 FE C9 70
FE C9 FE C9 FE
85 C0 0F 85 94
0F C8 F7 D3 43
8B C8 51 8B 45

Toolworks (h)]
50 FF 15 ?? ??
F7 D1 41 41 41
FE C1 83 C1 0D
23 C1 59 F7 D8
7D F4 00 74 09
E5 5D C3 55 8B
53 BB 80 00 00
08 4B 51 B9 04
D1 E1 89 4D F8
C4 04 5F 5E 5B
89 45 FC 8B 45
80 ED 20 FE CD
E9 06 F6 D0 0F
07 7C 03 EB 05
C9 FE C9 FE C9
00 00 00 8B 45
43 83 C3 08 4B
FC 52 BA FF FF

??
41
FE
1B
8B
EC
00
00
83
8B
FC
FE
C9
C7
FE
FC
51

??
41
C1
C0
55
83
EB
00
7D
E5
70
CD
F6
74
C9
53
B9

83
41
FE
F7
F8
EC
05
00
F4
5D
07
80
D0
FB
FE
BB
04

C4
41
C1
D8
83
0C
BB
03
00
C3
7C
ED
0F
EB
C9
00
00

04
83
FE
5A
CA
53
04
D9
74
55
03
04
C9
F9
F7
08
00

89
C1
C1
89
01
56
00
43
09
8B
EB
FE
FE
FE
D1
00
00

45
04
FE
45
89
57
00
59
8B
EC
05
CD
C9
C9
0F
00
03

FC
41
C1
F4
55
8B
00
0F
55
83
E9
80
FE
FE
C8
EB
D9

8B
41
FE
8B
F8
45
BB
C8
F8
EC
74
ED
C9
C9
F7
05
43

45
41
C1
0D
8B
08
32
40
83
0C
FB
03
80
FE
D1
BB
59

Realms Toolworks]
E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF
F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57
83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75

[Armadillo 5:00 Dll -> Silicon Realms Toolworks]

signature = 83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE
FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33
D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57
ep_only = true
[Armadillo v1:60a]
signature = 55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 58
ep_only = true
[Armadillo v1:71]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1
ep_only = false
[Armadillo v1:72 - v1:73]
signature = 55 8B EC 6A FF 68 E8 C1 ?? ?? 68 F4 86 ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ??
?? ?? 83 EC 58
ep_only = true
[Armadillo v1:77]
signature = 55 8B EC 6A FF 68 B0 71 40 00 68 6C 37 40 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 58
ep_only = true
[Armadillo v1:80]
signature = 55 8B EC 6A FF 68 E8 C1 00 00 68 F4 86 00 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 58
ep_only = true
[Armadillo v1:82]
signature = 55 8B EC 6A FF 68 E0 C1 40 00 68 74 81 40 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 58
-16-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[Armadillo v1:83]
signature = 55 8B EC 6A FF 68 E0 C1 40 00 68 64 84 40 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 58
ep_only = true
[Armadillo v1:84]
signature = 55 8B EC 6A FF 68 E8 C1 40 00 68 F4 86 40 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 58
ep_only = true
[Armadillo v1:90]
signature = 55 8B EC 6A FF 68 10 F2 40 00 68 64 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 58
ep_only = true
[Armadillo v1:90a]
signature = 55 8B EC 64 FF 68 10 F2 40 00 68 14 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 58
ep_only = true
[Armadillo v1:90b1]
signature = 55 8B EC 6A FF 68 E0 C1 40 00 68 04 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 58
ep_only = true
[Armadillo v1:90b2]
signature = 55 8B EC 6A FF 68 F0 C1 40 00 68 A4 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 58
ep_only = true
[Armadillo v1:90b3]
signature = 55 8B EC 6A FF 68 08 E2 40 00 68 94 95 40 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 58
ep_only = true
[Armadillo v1:90b4]
signature = 55 8B EC 6A FF 68 08 E2 40 00 68 B4 96 40 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 58
ep_only = true
[Armadillo v1:90c]
signature = 55 8B EC 6A FF 68 10 F2 40 00 68 74 9D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 58
ep_only = true
[Armadillo v1:9x]
signature = 55 8B EC 6A FF 68 98 ?? ?? ?? 68 10 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ??
?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15
ep_only = true
[Armadillo v1:xx - v2:xx]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6
ep_only = true
[Armadillo v2:00]
signature = 55 8B EC 6A FF 68 00 02 41 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 58
ep_only = true
[Armadillo v2:00b2-2:00b3]
-17-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 55 8B EC 6A FF 68 00 F2 40 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 58
ep_only = true
[Armadillo v2:01]
signature = 55 8B EC 6A FF 68 08 02 41 00 68 04 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 58
ep_only = true
[Armadillo v2:10b2]
signature = 55 8B EC 6A FF 68 18 12 41 00 68 24 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 58
ep_only = true
[Armadillo v2:20]
signature = 55 8B EC 6A FF 68 10 12 41 00 68 F4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 58
ep_only = true
[Armadillo v2:20b1]
signature = 55 8B EC 6A FF 68 30 12 41 00 68 A4 A5 40 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 58
ep_only = true
[Armadillo v2:50]
signature = 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0
ep_only = true
[Armadillo v2:50b3]
signature = 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ??
?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0
ep_only = true
[Armadillo v2:51]
signature = 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ??
?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20
ep_only = true
[Armadillo v2:52 beta2]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? B0 ?? ?? ?? ?? 68 60 64 A1 00 00 00 00 50 64 89 25
00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 24
ep_only = true
[Armadillo v2:52]
signature = 55 8B EC 6A FF 68 E0 ?? ?? ?? 68 D4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ??
?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 38
ep_only = true
[Armadillo v2:52]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? E0 ?? ?? ?? ?? 68 D4 64 A1 00 00 00 00 50 64 89 25
00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 38
ep_only = true
[Armadillo v2:52b2]
signature = 55 8B EC 6A FF 68 B0 ?? ?? ?? 68 60 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ??
?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 24
ep_only = true
[Armadillo v2:53]
signature = 55 8B EC 6A FF 68 40 ?? ?? ?? 68 54 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ??
?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC
-18-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[Armadillo v2:53]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 40 ?? ?? ?? ?? 68 54 64 A1 00 00 00 00 50 64 89 25
00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 58 33 D2 8A D4 89
ep_only = true
[Armadillo v2:53b3]
signature = 55 8B EC 6A FF 68 D8 ?? ?? ?? 68 14 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ??
?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15
ep_only = true
[Armadillo v2:5x - v2:6x]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC
ep_only = true
[Armadillo v2:60]
signature = 55 8B EC 6A FF 68 D0 ?? ?? ?? 68 34 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ??
?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 68 ?? ?? ?? 33 D2 8A D4 89 15 84
ep_only = true
[Armadillo v2:60a]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 94 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ??
?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 B4
ep_only = true
[Armadillo v2:60b1]
signature = 55 8B EC 6A FF 68 50 ?? ?? ?? 68 74 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ??
?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 FC
ep_only = true
[Armadillo v2:60b2]
signature = 55 8B EC 6A FF 68 90 ?? ?? ?? 68 24 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ??
?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 60 ?? ?? ?? 33 D2 8A D4 89 15 3C
ep_only = true
[Armadillo v2:60c]
signature = 55 8B EC 6A FF 68 40 ?? ?? ?? 68 F4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ??
?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 F4
ep_only = true
[Armadillo v2:61]
signature = 55 8B EC 6A FF 68 28 ?? ?? ?? 68 E4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ??
?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 0C
ep_only = true
[Armadillo v2:65b1]
signature = 55 8B EC 6A FF 68 38 ?? ?? ?? 68 40 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ??
?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 F4
ep_only = true
[Armadillo v2:75a]
signature = 55 8B EC 6A FF 68 68 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ??
?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24
ep_only = true
[Armadillo v2:85]
signature = 55 8B EC 6A FF 68 68 ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ??
?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24
ep_only = true

-19-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Armadillo v2:xx (CopyMem II)]

signature = 6A ?? 8B B5 ?? ?? ?? ?? C1 E6 04 8B 85 ?? ?? ?? ?? 25 07 ?? ?? 80 79 05 48 83 C8
F8 40 33 C9 8A 88 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 81 E2 07 ?? ?? 80 79 05 4A 83 CA F8 42 33 C0
8A 82
ep_only = true
[Armadillo v3:00]
signature = 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2
EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9
ep_only = true
[Armadillo v3:00a]
signature = 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2
EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB
ep_only = true
[Armadillo v3:01 - v3:50a -> Silicon Realms Toolworks]
signature = 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ??
EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51
EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4
EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08
C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E
7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ??
08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00
24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ??
?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED
33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79
9C BD B8 43
ep_only = true
[Armadillo v3:01;
signature = 60 E8
EB F5 EB F6 F2 EB
EB 08 FD EB 0B F2
EB 07 B9 EB 0F 90
C9 75 02 EB 15 EB
7A F0 A0 33 61 50
08 FD EB E9 F3 EB
24 EB 03 7A 29 E9
E8 7A E9 70 DA 7B
ep_only = true

EB
EB
FC
FD
79
EB
00
40
06
09

07
0F
??
EB
F1
08
E8
8B
33
74

??
??
59
E9
??
FD
E8
DB
FF
F0

EB
EB
58
F3
??
EB
23
7A
47
EB

0F
0F
50
EB
??
0B
00
11
60
87

??
??
51
E4
79
F2
00
EB
33
??

EB
EB
EB
FC
09
EB
00
08
C9
7A

08
07
0F
??
74
F5
7A
??
75
F0

FD
??
??
59
F0
EB
23
EB
02
??

EB
EB
EB
58
??
F6
??
F7
EB
??

0B
0F
0F
60
87
F2
8B
EB
15
61

F2
??
??
33
DB
EB
04
C3
??
8B

v3:05]
00 00 00
08 FD EB
EB F5 EB
EB 08 FD
33 C9 75
51 EB 0F
E4 FC E9
C6 00 90
D1 71 F3

00
E9
F6
EB
18
B9
59
C3
E9

5D
F3
F2
0B
7A
EB
58
E8
7B

50
EB
EB
F2
0C
0F
60
70

51
E4
08
EB
70
B8
9C
F0

EB
FC
FD
F5
0E
EB
33
87

0F
E9
EB
EB
EB
07
C0
D2

B9
59
E9
F6
0D
B9
E8
71

EB
58
F3
F2
E8
EB
09
07

0F
50
EB
EB
72
0F
00
E9

B8
51
E4
08
0E
90
00
00

EB
EB
FC
FD
79
EB
00
40

07
0F
E9
EB
F1
08
E8
8B

B9
B9
59
E9
FF
FD
E8
DB

EB
EB
58
F3
15
EB
23
7A

0F
0F
50
EB
00
0B
00
11

90
B8
51
E4
79
F2
00
EB

EB
EB
EB
FC
09
EB
00
08

08
07
0F
E9
74
F5
7A
E9

FD
B9
B9
59
F0
EB
23
EB

EB
EB
EB
58
EB
F6
A0
F7

0B
0F
0F
60
87
F2
8B
EB

F2
90
B8
33
DB
EB
04
C3

EC
56
8C
59
00
A4
50
08
44

6A
57
A1
85
E8
50
FF
8B
00

FF
89
44
C0
FB
FF
75
09
01

68
65
00
75
11
15
9C
89
75

E0
E8
C1
08
00
38
56
4D
05

97
FF
E1
6A
00
40
56
98

44
15
08
1C
A3
44
FF
50

00
4C
03
E8
E0
00
15
51

68
41
CA
B0
A1
E8
7C
E8

20
44
89
00
44
77
41
B5

C0
00
0D
00
00
0E
44
0C

42
33
88
00
E8
00
00
00

00
D2
A1
59
A4
00
50
00

64
8A
44
89
0F
89
E8
59

A1
D4
00
75
00
45
49
59

00
89
C1
FC
00
9C
D4
C3

00
15
E8
E8
E8
F6
FE
8B

00
90
10
3D
E6
45
FF
65

00
A1
A3
13
0E
D0
89
E8

50
44
84
00
00
01
45
FF

64
00
A1
00
00
74
A0
75

89
8B
44
FF
E8
06
50
98

25
C8
00
15
4E
0F
E8
E8

00
81
33
30
F6
B7
3C
2E

00
E1
F6
40
FF
45
F6
F6

[Armadillo V3:X-V5:X
signature = 60 E8 00
EB 0F 90 EB 08 FD EB
59 58 50 51 0F CA F7
EB F5 EB F6 F2 EB 08
F7 D2 0F CA EB 0F B9
E9 F3 EB E4 FC E9 9D
ep_only = true

->
00
0B
D2
FD
EB
0F

Silicon Realms
00 00 5D 50 51
F2 EB F5 EB F6
9C F7 D2 0F CA
EB E9 F3 EB E4
0F B8 EB 07 B9
C9 8B CA F7 D1

Sign:By:fly]
9C F7 D2 0F CA
EB E9 F3 EB E4
0F B8 EB 07 B9
C9 8B CA F7 D1
08 FD EB 0B F2
C9 75 02 EB 15

EB
FC
EB
59
EB
EB

0F
E9
0F
58
F5
33

B9
9D
90
50
EB

EB
0F
EB
51
F6

0F
C9
08
0F
F2

B8
8B
FD
CA
EB

EB
CA
EB
F7
08

07
F7
0B
D2
FD

B9
D1
F2
9C
EB

[Armadillo v3:10]
signature = 55 8B
00 00 83 EC 58 53
FF 00 00 00 89 0D
56 E8 72 16 00 00
44 00 A3 84 B7 44
FF 89 75 D0 8D 45
D4 EB 03 6A 0A 58
FF FF 8B 45 EC 8B
FF FF 83 3D E8 A1
ep_only = true

Toolworks *
0F CA F7 D2
F2 EB 08 FD
EB 0F B9 EB
FC E9 9D 0F
EB 0F 90 EB
59 58 60 33

-20-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Armadillo v3:xx]
signature = 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2
EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58
ep_only = true
[Armadillo v4:00:0053 -> Silicon
signature = 55 8B EC 6A FF 68 20
00 00 83 EC 58 53 56 57 89 65 E8
FF 00 00 00 89 0D A0 A1 4B 00 C1
56 E8 78 16 00 00 59 85 C0 75 08
4B 00 A3 A4 B7 4B 00 E8 01 12 00
FF 89
ep_only = false

Realms Toolworks]
8B 4B 00 68 80 E4
FF 15 88 31 4B 00
E1 08 03 CA 89 0D
6A 1C E8 B0 00 00
00 A3 F8 A1 4B 00

[Armadillo v4:10 -> Silicon Realms Toolworks]

signature = 55 8B EC 6A FF 68 F8 8E 4C 00 68 D0
00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C
FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89
56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00
4C 00 A3 84 BB 4C 00 E8 01 12 00 00 A3 D0 A5 4C
FF 89
ep_only = false
[Armadillo v4:20 -> Silicon Realms Toolworks]
signature = 55 8B EC 6A FF 68 F8 8E 4C 00 68 F0
00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C
FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89
56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00
4C 00 A3 84 BB 4C 00 E8 01 12 00 00 A3 D8 A5 4C
FF 89
ep_only = false

48
33
9C
00
E8

00
D2
A1
59
AA

64
8A
4B
89
0F

A1
D4
00
75
00

00
89
C1
FC
00

00
15
E8
E8
E8

00
A4
10
43
EC

00
A1
A3
13
0E

50
4B
98
00
00

64
00
A1
00
00

89
8B
4B
FF
E8

25
C8
00
15
2D

00
81
33
8C
FA

00
E1
F6
30
FF

EA
00
0D
00
00

49
33
74
00
E8

00
D2
A5
59
AA

64
8A
4C
89
0F

A1
D4
00
75
00

00
89
C1
FC
00

00
15
E8
E8
E8

00
7C
10
43
EC

00
A5
A3
13
0E

50
4C
70
00
00

64
00
A5
00
00

89
8B
4C
FF
E8

25
C8
00
15
2D

00
81
33
8C
FA

00
E1
F6
30
FF

EA
00
0D
00
00

49
33
7C
00
E8

00
D2
A5
59
AA

64
8A
4C
89
0F

A1
D4
00
75
00

00
89
C1
FC
00

00
15
E8
E8
E8

00
84
10
43
EC

00
A5
A3
13
0E

50
4C
78
00
00

64
00
A5
00
00

89
8B
4C
FF
E8

25
C8
00
15
2D

00
81
33
8C
FA

00
E1
F6
30
FF

[Armadillo v4:30 - 4:40

signature = 60 E8 00 00
EB 0F 90 EB 08 FD EB 0B
59 58 50 51 0F CA F7 D2
EB F5 EB F6 F2 EB 08 FD
F7 D2 0F CA EB 0F B9 EB
E9 F3
ep_only = false

->
00
F2
9C
EB
0F

Silicon Realms
00 5D 50 51 0F
EB F5 EB F6 F2
F7 D2 0F CA EB
E9 F3 EB E4 FC
B8 EB 07 B9 EB

Toolworks]
CA F7 D2 9C
EB 08 FD EB
0F B9 EB 0F
E9 9D 0F C9
0F 90 EB 08

F7
E9
B8
8B
FD

D2
F3
EB
CA
EB

0F
EB
07
F7
0B

CA
E4
B9
D1
F2

EB
FC
EB
59
EB

0F
E9
0F
58
F5

B9
9D
90
50
EB

EB
0F
EB
51
F6

0F
C9
08
0F
F2

B8
8B
FD
CA
EB

EB
CA
EB
F7
08

07
F7
0B
D2
FD

B9
D1
F2
9C
EB

[Armadillo v4:30 - 4:40

signature = 55 8B EC 6A
00 00 83 EC 58 53 56 57
FF 00 00 00 89 0D 2C ??
56 E8 78 16 00 00 59 85
?? 00 A3 24
ep_only = false

->
FF
89
??
C0

Silicon Realms
68 40 ?? ?? 00
65 E8 FF 15 88
00 C1 E1 08 03
75 08 6A 1C E8

Toolworks]
68 80 ?? ??
?? ?? 00 33
CA 89 0D 28
B0 00 00 00

00
D2
??
59

64
8A
??
89

A1
D4
00
75

00
89
C1
FC

00
15
E8
E8

00
30
10
43

00
??
A3
13

50
??
24
00

64
00
??
00

89
8B
??
FF

25
C8
00
15

00
81
33
8C

00
E1
F6
??

* Sign:By:fly]
24 04 8B 4C 24
8B 4D 08 33 FF
0C 00 00 00 57
75 08 3B F7 75
83 E6 F0 89 75
E8 ?? ?? ?? ??
57 53 E8 ?? ??
3B DF 75 4C 39
C7 0F 84 50 FF
C3

10
3B
57
03
0C
59
??
3D
FF

8B
CF
57
33
8B
89
??
??
FF

54
76
57
F6
45
45
83
??
C7

24
2E
57
46
08
E4
C4
??
00

0C
6A
E8
33
3B
C7
0C
??
0C

E8
E0
??
DB
05
45
3B
74
00

??
58
??
89
??
FC
DF
33
00

??
33
??
5D
??
FE
75
56
00

[Armadillo V5:00-V5:X Dll -> Silicon Realms Toolworks

signature = 83 7C 24 08 01 75 05 E8 ?? ?? ?? ?? FF 74
?? ?? 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ??
D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 ?? ?? ?? ?? C7 00
?? 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89
E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F
?? ?? 77 37 6A 04 E8 ?? ?? ?? ?? 59 89 7D FC FF 75 08
FF FF FF E8 ?? ?? ?? ?? 8B 5D E4 3B DF 74 11 FF 75 08
61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8
E8 ?? ?? ?? ?? 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B
E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 ?? ?? ?? ?? 59
ep_only = true
-21-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Armadillo V5:0X -> Silicon Realms Toolworks

signature = E8 E3 40 00 00 E9 16 FE FF FF 6A
3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B
57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9
03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83
0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8
59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00
FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ??
3D ?? ?? ?? ?? 74 33 56 E8 AF F9 FF FF 59 85
FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF
ep_only = true

* Sign:By:fly]
0C 68 ?? ?? ??
C0 40 75 1F E8
D5 00 00 00 0F
3D ?? ?? ?? ??
48 11 00 00 59
00 8B 5D E4 3B
?? ?? ?? FF 15
C0 0F 85 72 FF
8B 75 0C 6A 04

15
00
8B
83
??
FF
??
45
00

00
C7
F1
C6
75
75
8B
10
00

00
00
89
0F
08
08
D8
3B
59

8B
0C
75
83
E8
57
3B
C7
C3

4D
00
08
E6
01
53
DF
0F

08
00
3B
F0
49
E8
75
84

33
00
F7
89
00
66
4C
50

FF
57
75
75
00
D3
39
FF

[Armadillo V5:20 -> Silicon Realms Toolworks

signature = E8 38 3D 00 00 E9 16 FE FF FF 6A
3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B
57 57 57 57 E8 7D 1C 00 00 83 C4 14 33 C0 E9
03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83
0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8
59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00
FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ??
3D ?? ?? ?? ?? 74 33 56 E8 C0 FA FF FF 59 85
FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF
8B 45 10 3B C7 74 06 C7 00 0C 00 00 00 8B C3
45 FC 50 FF 75 0C FF 75 08 E8 CA FE FF FF 8B
E8 C9 1B 00 00 85 C0 74 07 E8 C0 1B 00 00 89
1D 00 00 8B 75 08 85 F6 74 75 83 3D ?? ?? ??
56 E8 84 3C 00 00 59 89 45 E4 85 C0 74 09 56
0B 00 00 00 83 7D E4 00 75 37 FF 75 08 EB 0A
ep_only = true

* Sign:By:fly * 20080214]
0C 68 ?? ?? ?? ?? E8 98 1E
C0 40 75 1F E8 EC 1C 00 00
D5 00 00 00 0F AF 4D 0C 8B
3D ?? ?? ?? ?? ?? 75 4B 83
FE 1A 00 00 59 89 7D FC FF
00 8B 5D E4 3B DF 74 11 FF
?? ?? ?? FF 15 ?? ?? ?? ??
C0 0F 85 72 FF FF FF 8B 45
8B 75 0C 6A 04 E8 A4 19 00
E8 CC 1D 00 00 C3 55 8B EC
F8 83 C4 0C 85 FF 75 19 56
30 5E 8B C7 5F C9 C3 6A 0C
?? ?? 75 43 6A 04 E8 FF 19
50 E8 A0 3C 00 00 59 59 C7
6A 04 E8 ED 18 00 00 59 C3

00
C7
F1
C6
75
75
8B
10
00
51
8B
68
00
45

00
00
89
0F
08
08
D8
3B
59
83
75
??
00
FC

8B
0C
75
83
E8
57
3B
C7
C3
65
FC
??
59
FE

4D
00
08
E6
56
53
DF
0F
3B
FC
85
??
83
FF

08
00
3B
F0
45
E8
75
84
DF
00
F6
??
65
FF

33
00
F7
89
00
96
4C
50
75
57
74
E8
FC
FF

FF
57
75
75
00
D3
39
FF
0D
8D
10
3B
00
E8

* Sign:By:fly * 20080214]
?? ?? ?? ?? E8 9E 16 00 00
75 1F E8 F5 14 00 00 C7 00
00 00 0F AF 4D 0C 8B F1 89
?? ?? ?? ?? 75 4B 83 C6 0F
00 00 59 89 7D FC FF 75 08
5D E4 3B DF 74 11 FF 75 08
?? FF 15 ?? ?? ?? ?? 8B D8
85 72 FF FF FF 8B 45 10 3B
0C 6A 04 E8 AD 11 00 00 59

8B
0C
75
83
E8
57
3B
C7
C3

4D
00
08
E6
AC
53
DF
0F

08
00
3B
F0
47
E8
75
84

33
00
F7
89
00
7C
4C
50

FF
57
75
75
00
D3
39
FF

8B
0C
75
83
E8
57
3B
C7
C3

4D
00
08
E6
B1
53
DF
0F

08
00
3B
F0
46
E8
75
84

33
00
F7
89
00
86
4C
50

FF
57
75
75
00
D3
39
FF

[Armadillo V5:20:Beta1 -> Silicon Realms Toolworks

signature = E8 8E 3F 00 00 E9 16 FE FF FF 6A 0C 68
3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40
57 57 57 57 E8 86 14 00 00 83 C4 14 33 C0 E9 D5 00
03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ??
0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 07 13
59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B
FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ??
3D ?? ?? ?? ?? 74 33 56 E8 C7 F9 FF FF 59 85 C0 0F
FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75
ep_only = true
[Armadillo V5:40 -> Silicon Realms Toolworks
signature = E8 93 3E 00 00 E9 16 FE FF FF 6A
3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B
57 57 57 57 E8 40 1D 00 00 83 C4 14 33 C0 E9
03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83
0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8
59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00
FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ??
3D ?? ?? ?? ?? 74 33 56 E8 C4 FA FF FF 59 85
FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF
ep_only = true

??
36
AF
03
89
DF
??
FF
E8

E8
13
4D
75
7D
74
??
FF
EE

44
00
0C
4B
FC
11
??
8B
0F

* Sign:By:fly * 20080214]
0C 68 ?? ?? ?? ?? E8 B4 1F
C0 40 75 1F E8 AF 1D 00 00
D5 00 00 00 0F AF 4D 0C 8B
3D ?? ?? ?? ?? ?? 75 4B 83
C1 1B 00 00 59 89 7D FC FF
00 8B 5D E4 3B DF 74 11 FF
?? ?? ?? FF 15 ?? ?? ?? ??
C0 0F 85 72 FF FF FF 8B 45
8B 75 0C 6A 04 E8 67 1A 00

00
C7
F1
C6
75
75
8B
10
00

00
00
89
0F
08
08
D8
3B
59

[AsCrypt V0:1 -> SToRM * Sign:By:fly]

signature = B9 ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? ?? 83 04 24 04 ?? 90 90 90 83 E9 03 E2 EC EB ??
00 00 00 00 00 00 00 00 00 00
ep_only = false
[AsCrypt v0:1 -> SToRM - needs to be added]
signature = 80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 83 ?? ?? E2
-22-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = false
[AsCrypt v0:1 -> SToRM - needs to be added]
signature = 80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 E2
ep_only = false
[AsCrypt v0:1 -> SToRM - needs to be added]
signature = 83 ?? ?? E2 ?? ?? E2 ?? FF
ep_only = false
[AsCrypt v0:1 -> SToRM - needs to be added]
signature = 81 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? E2 ?? EB
ep_only = false
[ASDPack -> asd *
signature = 00 00
00 00 00 00 00 00
33 32 2E 64 6C 6C
ep_only = false

Sign:By:fly]
00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00
00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C
00 8D 49 00 1F 01 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 90

[ASPack 1:08]
signature = 90 90 90 75 01 90 E9
ep_only = true
[ASPack v1:00b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED 92 1A 44 ?? B8 8C 1A 44 ?? 03 C5 2B 85 CD 1D 44 ?? 89
85 D9 1D 44 ?? 80 BD C4 1D 44
ep_only = true
[ASPack v1:01b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED D2 2A 44 ?? B8 CC 2A 44 ?? 03 C5 2B 85 A5 2E 44 ?? 89
85 B1 2E 44 ?? 80 BD 9C 2E 44
ep_only = true
[ASPack v1:02a]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED 3E D9 43 ?? B8 38 ?? ?? ?? 03 C5 2B 85 0B DE 43 ?? 89
85 17 DE 43 ?? 80 BD 01 DE 43 ?? ?? 75 15 FE 85 01 DE 43 ?? E8 1D ?? ?? ?? E8 79 02 ?? ?? E8
12 03 ?? ?? 8B 85 03 DE 43 ?? 03 85 17 DE 43 ?? 89 44 24 1C 61 FF
ep_only = true
[ASPack v1:02b]
signature = 60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5
ep_only = true
[ASPack v1:02b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED 96 78 43 ?? B8 90 78 43 ?? 03 C5 2B 85 7D 7C 43 ?? 89
85 89 7C 43 ?? 80 BD 74 7C 43
ep_only = true
[ASPack v1:03b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED AE 98 43 ?? B8 A8 98 43 ?? 03 C5 2B 85 18 9D 43 ?? 89
85 24 9D 43 ?? 80 BD 0E 9D 43
ep_only = true
[ASPack v1:04b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 12 9D ?? 89
85 1E 9D ?? ?? 80 BD 08 9D
ep_only = true
[ASPack v1:05b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89
85 C1 3E 44 ?? 80 BD AC 3E 44
-23-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[ASPack v1:061b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED EA A8 43 ?? B8 E4 A8 43 ?? 03 C5 2B 85 78 AD 43 ?? 89
85 84 AD 43 ?? 80 BD 6E AD 43
ep_only = true
[ASPack v1:06b]
signature = 90 90 90 75 00 E9
ep_only = true
[ASPack v1:06b]
signature = 90 90 75 00 E9
ep_only = true
[ASPack v1:06b]
signature = 90 75 00 E9
ep_only = true
[ASPack v1:07b (DLL)]
signature = 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5
ep_only = true
[ASPack v1:07b]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 0B DE ?? 89
85 17 DE ?? ?? 80 BD 01 DE
ep_only = true
[ASPack v1:07b]
signature = 90 90 90 75 ?? E9
ep_only = true
[ASPack v1:07b]
signature = 90 75 ?? E9
ep_only = true
[ASPack v1:07b]
signature = 90 90 75 ?? E9
ep_only = true
[ASPack v1:08:01]
signature = 90 90 90 75 ?? 90 E9
ep_only = true
[ASPack v1:08:01]
signature = 90 75 ?? 90 E9
ep_only = true
[ASPack v1:08:01]
signature = 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 ?? BB 10
?? 44 ?? 03 DD 2B 9D
ep_only = true
[ASPack v1:08:01]
signature = 60 EB ?? 5D EB ?? FF ?? ?? ?? ?? ?? E9
ep_only = true
[ASPack v1:08:01]
signature = 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 00 BB 10
?? 44 00 03 DD 2B 9D
ep_only = true

-24-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[ASPack v1:08:01]
signature = 90 90 75 ?? 90 E9
ep_only = true
[ASPack v1:08:02]
signature = 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ED 23 6A 44 00 BB 10
?? 44 00 03 DD 2B 9D 72
ep_only = true
[ASPack v1:08:02]
signature = 90 90 75 01 90 E9
ep_only = true
[ASPack v1:08:02]
signature = 90 75 01 90 E9
ep_only = true
[ASPack v1:08:03]
signature = 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD 2B 9D B1 50 44 00 83
BD AC 50 44 00 00 89 9D BB 4E
ep_only = true
[ASPack v1:08:03]
signature = 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD
ep_only = true
[ASPack v1:08:03]
signature = 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D B1 50 44 00 83
BD AC 50 44 00 00 89 9D BB 4E
ep_only = true
[ASPack v1:08:03]
signature = 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD
ep_only = true
[ASPack v1:08:04]
signature = 60 E8 ?? ?? ?? ?? EB
ep_only = true
[ASPack v1:08:04]
signature = 60 E8 41 06 00 00 EB 41
ep_only = true
[ASPack v1:08:x]
signature = 60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 00 BB 10 6A 44 00 03 DD 2B 9D 2A
ep_only = true
[ASPack v1:08]
signature = 90 90 75 01 FF E9
ep_only = true
[ASPack v1:08]
signature = 90 75 01 FF E9
ep_only = true
[ASPack v1:08]
signature = 90 90 90 75 01 FF E9
ep_only = true
[ASPack v2:000]
signature = 60 E8 70 05 00 00 EB 4C
ep_only = true
-25-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[ASPack v2:001]
signature = 60 E8 72 05 00 00 EB 4C
ep_only = true
[ASPack v2:11]
signature = 60 E9 3D 04 00 00
ep_only = true
[ASPack v2:11b]
signature = 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 3D 04 00 00
ep_only = true
[ASPack v2:11c]
signature = 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 59 04 00 00
ep_only = true
[ASPack v2:11d]
signature = 60 E8 02 00 00 00 EB 09 5D 55
ep_only = true
[Aspack v2:12 -> www:aspack:com]
signature = ?? ?8 0? ?0 00 ?? ?? ?? ?? ?D ?? ?? ?? ?? ?? ?? ?? ?? ?? 5? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? 0? ?3 ?? ?? 0? ?? 0? ?? ?? ?? ?? ?? 0? ?? ?F ?? ?? ?3 0? ?? ?? 8? ?? ?? ?? ??
?? ?? ?? ?? 0? ?0 0? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?F 95 ?? ?? ?? ?? 8? ?? ?D ?? ??
?? ?? 5
ep_only = true
[Aspack v2:12 -> www:aspack:com]
signature = ?? ?8 0? ?0 00 ?? ?? ?? ?? ?D ?? ?? ?? ?? ?? ?? ?? ?? ?? 5? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? 0? ?3 ?? ?? 0? ?? 0? ?? ?? ?? ?? ?? 0? ?? ?F ?? ?? ?3 0? ?? ?? 8? ?? ?? ?? ??
?? ?? ?? ?? 0? ?0 0? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?F 95 ?? ?? ?? ?? 8
ep_only = false
[ASPack v2:12]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD
81 EB
ep_only = true
[ASPack v2:12]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01
ep_only = false
[ASPack v2:1]
signature = 60 E8 72 05 00 00 EB 33 87 DB 90 00
ep_only = true
[ASPack v2:xx]
signature = A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00
8D 8D 3B 04 00 00 51 50 FF 95
ep_only = true
[ASPack v2:xx]
signature = A8 03 ?? ?? 61 75 08 B8 01 ?? ?? ?? C2 0C ?? 68 ?? ?? ?? ?? C3 8B 85 26 04 ?? ??
8D 8D 3B 04 ?? ?? 51 50 FF 95
ep_only = true
[ASPR Stripper v2:x unpacked]
signature = BB ?? ?? ?? ?? E9 ?? ?? ?? ?? 60 9C FC BF ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 AA 9D 61
C3 55 8B EC
ep_only = true

-26-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[ASProtect 1:23 RC4 build 08:07 (dll) -> Alexey

signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55
81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28
D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00
ep_only = false

Solodovnikov (h)]
C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD
83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5
00 00 00 00 00 00 00 00 00 00 00

[ASProtect 1:23 RC4 build 08:07 (exe) -> Alexey

signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45
DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24
B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00
ep_only = false

Solodovnikov (h)]
55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03
28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF
00 00 00 00 00 00 00 00 00 00 00

[ASProtect 1:33 - 2:1 Registered -> Alexey Solodovnikov]

signature = 68 01 ?? ?? ?? E8 01 00 00 00 C3 C3
ep_only = true
[ASProtect 2:0]
signature = 68 01 ?? 40 00 E8 01 00 00 00 C3 C3
ep_only = false
[ASProtect 2:3 SKE build 04:26 Beta]
signature = 68 01 60 40 00 E8 01 00 00 00 C3 C3 0D 6C 65 3E 09 84 BB 91 89 38 D0 5A 1D 60 6D
AF D5 51 2D A9 2F E1 62 D8 C1 5A 8D 6B 6E 94 A7 F9 1D 26 8C 8E FB 08 A8 7E 9D 3B 0C DF 14 5E
62 14 7D 78 D0 6E
ep_only = false
[ASProtect SKE 2:1/2:2 (dll) -> Alexey
signature = 60 E8 03 00 00 00 E9 EB 04
81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B
ED 09 00 00 8D 45 35 50 E9 82 00 00 00
ep_only = false

Solodovnikov (h)]
5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD
74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5
00 00 00 00 00 00 00 00 00 00 00 00 00 00

[ASProtect SKE
signature = 60
81 EB 00 ?? ??
ED 09 00 00 8D
00 00 00 00 00
F8 C0 A5 23 74
07 52 52 FF 75
61 75 06 6A 01
ep_only = true

2:1/2:2 (dll) -> Alexey

E8 03 00 00 00 E9 EB 04
?? 80 7D 4D 01 75 0C 8B
45 35 50 E9 82 00 00 00
00 01 00 00 00 00 B8 F8
35 33 D2 56 6A 00 56 FF
35 FF D0 8B 45 35 85 C0
58 C2 0C 00 33 C0 F7 D8

Solodovnikov (h)]
5D 45 55 C3 E8 01
74 24 28 83 FE 01
00 00 00 00 00 00
C0 A5 23 50 50 03
75 4E FF D0 5E 83
74 0D 68 00 80 00
1B C0 40 C2 0C 00

[ASProtect SKE 2:1/2:2 (exe) -> Alexey

signature = 90 60 E8 03 00 00 00 E9 EB
DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C
B5 ED 09 00 00 8D 45 35 50 E9 82 00 00
00 00 00 00 00 00 00 00 00 00 00 00 B8
FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56
74 07 52 52 FF 75 35 FF D0 8B 45 35 85
DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7
ep_only = false

Solodovnikov (h)]
04 5D 45 55 C3 E8
8B 74 24 28 83 FE
00 00 00 00 00 00
F8 C0 A5 23 50 50
FF 75 4E FF D0 5E
C0 74 0D 68 00 80
D8 1B C0 40 C2 0C

[ASProtect SKE 2:1/2:2 (exe) -> Alexey

signature = 90 60 E8 03 00 00 00 E9 EB
DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C
B5 ED 09 00 00 8D 45 35 50 E9 82 00 00
00 00 00 00 00 00 00 00 00 00 00 00 B8
FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56
74 07 52 52 FF 75 35 FF D0 8B 45 35 85
DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7
ep_only = false

Solodovnikov (h)]
04 5D 45 55 C3 E8
8B 74 24 28 83 FE
00 00 00 00 00 00
F8 C0 A5 23 50 50
FF 75 4E FF D0 5E
C0 74 0D 68 00 80
D8 1B C0 40 C2 0C

-27-

00
89
00
45
FE
00

00
5D
00
4E
00
6A

00
4E
00
5B
75
00

EB
75
00
85
24
FF

5D
31
00
C0
33
75

BB
8D
00
74
D2
35

ED
45
00
1C
8B
FF

FF
53
00
EB
45
55

FF
50
00
01
41
3D

FF
53
00
E8
85
5B

03
FF
00
81
C0
0B

DD
B5
00
FB
74
DB

01
01
00
03
83
00
00

00
89
00
45
FE
00

00
5D
00
4E
00
6A

00
4E
00
5B
75
00

EB
75
00
85
24
FF

5D
31
00
C0
33
75

BB
8D
00
74
D2
35

ED
45
00
1C
8B
FF

FF
53
00
EB
45
55

FF
50
00
01
41
3D

FF
53
00
E8
85
5B

03
FF
00
81
C0
0B

01
01
00
03
83
00

00
89
00
45
FE
00

00
5D
00
4E
00
6A

00
4E
00
5B
75
00

EB
75
00
85
24
FF

5D
31
00
C0
33
75

BB
8D
00
74
D2
35

ED
45
00
1C
8B
FF

FF
53
00
EB
45
55

FF
50
00
01
41
3D

FF
53
00
E8
85
5B

03
FF
00
81
C0
0B

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[ASProtect SKE 2:1/2:2 (exe) -> Alexey

signature = 90 60 E8 03 00 00 00 E9 EB
DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C
B5 ED 09 00 00 8D 45 35 50 E9 82 00 00
ep_only = false

Solodovnikov (h)]
04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03
8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF
00 00 00 00 00 00 00 00 00 00 00 00 00 00

[ASProtect SKE 2:3 -> Alexey Solodovnikov

signature = 90 60 E8 03 00 00 00 E9 EB 04
DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B
B5 E5 0B 00 00 8D 45 35 50 E9 82 00 00 00
00 00 00 00 00 00 00 ?? 00 00 00 00 B8 F8
FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF
74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0
DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8
ep_only = false

(h)]
5D 45
74 24
00 00
C0 A5
75 4E
74 0D
1B C0

55
28
00
23
FF
68
40

C3
83
00
50
D0
00
C2

E8
FE
00
50
5E
80
0C

01
01
00
03
83
00

00
89
00
45
FE
00

00
5D
00
4E
00
6A

00
4E
00
5B
75
00

EB
75
00
85
24
FF

5D
31
00
C0
33
75

BB
8D
00
74
D2
35

ED
45
00
1C
8B
FF

FF
53
00
EB
45
55

FF
50
00
01
41
3D

FF
53
00
E8
85
5B

03
FF
00
81
C0
0B

[ASProtect v1:0]
signature = 60 E8 01 ?? ?? ?? 90 5D 81 ED ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D
ep_only = true
[ASProtect v1:1 BRS]
signature = 60 E9 ?? 05
ep_only = true
[ASProtect v1:1 MTE]
signature = 60 E9 ?? ?? ?? ?? 91 78 79 79 79 E9
ep_only = true
[ASProtect v1:1 MTEb]
signature = 90 60 E9 ?? 04
ep_only = true
[ASProtect v1:1 MTEc]
signature = 90 60 E8 1B ?? ?? ?? E9 FC
ep_only = true
[ASProtect v1:1]
signature = 60 E9 ?? 04 ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? EE
ep_only = true
[ASProtect v1:2 -> Alexey Solodovnikov (h1)]
signature = 90 60 E8 1B 00 00 00 E9 FC 8D B5 0F 06 00 00 8B FE B9 97 00 00 00 AD 35 78 56 34
12 AB 49 75 F6 EB 04 5D 45 55 C3 E9 ?? ?? ?? 00
ep_only = false
[ASProtect v1:23 RC1]
signature = 68 01 ?? ?? 00 E8 01 00 00 00 C3 C3
ep_only = true
[ASProtect v1:23 RC4
signature = 60 E8 03
81 EB 00 ?? ?? ?? 80
D5 09 00 00 8D 45 35
00 00 00 00 00 00 01
F8 C0 A5 23 74 35 33
07 52 52 FF 75 35 FF
61 75 06 6A 01 58 C2
ep_only = true

build
00 00
7D 4D
50 E9
00 00
D2 56
D0 8B
0C 00

08:07
00 E9
01 75
82 00
00 00
6A 00
45 35
33 C0

(dll)
EB 04
0C 8B
00 00
B8 F8
56 FF
85 C0
F7 D8

->
5D
74
00
C0
75
74
1B

Alexey Solodovnikov (h)]

45 55 C3 E8 01 00 00 00 EB
24 28 83 FE 01 89 5D 4E 75
00 00 00 00 00 00 00 00 00
A5 23 50 50 03 45 4E 5B 85
4E FF D0 5E 83 FE 00 75 24
0D 68 00 80 00 00 6A 00 FF
C0 40 C2 0C 00

5D
31
00
C0
33
75

BB
8D
00
74
D2
35

ED
45
00
1C
8B
FF

FF
53
00
EB
45
55

FF
50
00
01
41
3D

FF
53
00
E8
85
5B

03
FF
00
81
C0
0B

DD
B5
00
FB
74
DB

[ASProtect v1:23 RC4 build 08:07 (exe) -> Alexey Solodovnikov (h)]
signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03
DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF
-28-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

B5 D5 09 00 00 8D
00 00 00 00 00 00
FB F8 C0 A5 23 74
74 07 52 52 FF 75
DB 61 75 06 6A 01
ep_only = false

45
00
35
35
58

35
00
33
FF
C2

50
00
D2
D0
0C

04 August 2015 15:14

E9
00
56
8B
00

82
00
6A
45
33

00
00
00
35
C0

00
B8
56
85
F7

00
F8
FF
C0
D8

00
C0
75
74
1B

00
A5
4E
0D
C0

00
23
FF
68
40

00
50
D0
00
C2

00
50
5E
80
0C

00
03
83
00
00

00
45
FE
00

00
4E
00
6A

00
5B
75
00

00
85
24
FF

00
C0
33
75

00
74
D2
35

00
1C
8B
FF

00
EB
45
55

00
01
41
3D

00
E8
85
5B

00
81
C0
0B

[ASProtect v1:2]
signature = 68 01 ?? ?? ?? C3
ep_only = true
[ASProtect v1:2x (New Strain)]
signature = 68 01 ?? ?? ?? E8 01 ?? ?? ?? C3 C3
ep_only = true
[ASProtect v1:2x]
signature = 00 00 68 01 ?? ?? ?? C3 AA
ep_only = true
[ASProtect V2:X DLL -> Alexey Solodovnikov]
signature = 60 E8 03 00 00 00 E9 ?? ?? 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ?? ?? ?? ?? 03 DD
ep_only = true
[ASProtect v?:? -> If you know this
signature = 90 60 E8 03 00 00 00 E9
DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75
B5 DD 09 00 00 8D 45 35 50 E9 82 00
00 00 00 00 00 00 00 00 00 00 00
ep_only = false

version;
EB 04 5D
0C 8B 74
00 00 00

post on PEiD board (h2)]

45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03
24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

[ASProtect v?:? -> If you know this

signature = 90 60 E8 03 00 00 00 E9
DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75
B5 DD 09 00 00 8D 45 35 50 E9 82 00
ep_only = true

version;
EB 04 5D
0C 8B 74
00 00 00

post on PEiD board]

45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03
24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF
00 00 00 00 00 00 00 00 00 00 00 00

[ASProtect vx:x]
signature = 90 60 ?? ?? ?? 00 00
ep_only = true
[ASProtect vx:x]
signature = 60 ?? ?? ?? ?? ?? 90 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 03 DD
ep_only = true
[ass - crypter
signature = 55
68 78 51 00 10
53 A1 E0 97 00
ep_only = true

->
8B
64
10

by
EC
??
50

santasdad]
83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55
?? ?? ?? 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8
E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B

[ASYLUM Music File v:1:0]

signature = 41 53 59 4C 55 4D 20 4D 75 73 69 63 20 46 6F 72 6D 61 74 20 56 31 2E 30 00
ep_only = false
[Audio-CD file]
signature = 52 49 46 46 ?? ?? ?? ?? 43 44 44 41 66 6D 74
ep_only = false
[AutoDesk Animation file]
signature = ?? ?? ?? 00 12 AF ?? ?? 40 01 C8
ep_only = false

-29-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[AverCryptor 1:0 -> os1r1s]

signature = 60 E8 00 00 00 00
18 40 00 03 C5 80 30 05 83 F9
33 C0 51 33 C9 66 B9 FA 00 66
F8 02 75 06 81 C2 00 02 00 00
8B F1 E8 27 00 00 00 8B C8 5F
EB 8A 8B 85 98 18 40 00 89 44
ep_only = true
[AverCryptor 1:02
signature = 60 E8
18 40 00 03 C5 80
33 C0 51 33 C9 66
F8 02 75 06 81 C2
8B F1 E8 27 00 00
EB 8A 8B 85 2F 18
ep_only = true

5D
00
83
51
B8
24

81
74
F9
8B
BC
1C

ED
71
00
4F
18
61

75
81
74
10
40
FF

17
7F
49
83
00
E0

40
1C
8B
F8
03
56

00
AB
57
02
C5
57

8B
00
0C
75
E8
4F

BD
00
03
06
24
F7

9C
00
95
81
00
D7

18
75
A0
E9
00
23

40
62
18
00
00
F7

00
8B
40
02
59
8B

8B
57
00
00
49
C6

8D
0C
8B
00
EB
5F

A4
03
85
57
B1
5E

18
95
A8
BF
59
C3

40
A0
18
C8
83

00
18
40
00
C7

B8
40
00
00
28

BC
00
83
00
49

beta -> os1r1s]

00 00 00 00 5D 81
30 05 83 F9 00 74
B9 F7 00 66 83 F9
00 02 00 00 51 8B
00 8B C8 5F B8 51
40 00 89 44 24 1C

ED
71
00
4F
18
61

0C
81
74
10
40
FF

17
7F
49
83
00
E0

40
1C
8B
F8
03
56

00
AB
57
02
C5
57

8B
00
0C
75
E8
4F

BD
00
03
06
24
F7

33
00
95
81
00
D7

18
75
37
E9
00
23

40
62
18
00
00
F7

00
8B
40
02
59
8B

8B
57
00
00
49
C6

8D
0C
8B
00
EB
5F

3B
03
85
57
B1
5E

18
95
3F
BF
59
C3

40
37
18
C8
83

00
18
40
00
C7

B8
40
00
00
28

51
00
83
00
49

[AVI movie file]

signature = 52 49 46 46 ?? ?? ?? ?? 41 56 49 ?? 4C 49 53 54
ep_only = false
[AVP Antiviral Database]
signature = 41 56 50 20 41 6E 74 69 76 69 72 61 6C 20 44 61 74 61 62 61 73 65
ep_only = false
[AVP Inspector Database]
signature = 47 68 6F 73 74 20 42 75 73 74 65 72
ep_only = false
[AVPACK v1:20]
signature = 50 1E 0E 1F 16 07 33 F6 8B FE B9 ?? ?? FC F3 A5 06 BB ?? ?? 53 CB
ep_only = true
[AZProtect 0001 signature = FC 33
73 09 66 35 20 83
66 8B C1 C3 F0 DA
ep_only = true

by
C9
66
55

AlexZ
49 8B
81 F3
8B EC

aka AZCRC]
D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8
B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10
53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83

[AZProtect 0x0001 -> AlexZ aka AZCRC]

signature = EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D
61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40
B7 30 00 00
ep_only = true
[AZProtect]
signature = EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D
61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40
B7 30
ep_only = true
[BamBam 0:01]
signature = 6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3
BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00
B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1
ep_only = false
[bambam V0:01 -> bedrock >
signature = 6A 14 E8 9A 05
BF ?? ?? ?? ?? 53 F3 A5 E8
B9 ?? ?? ?? ?? 2B CF 89 45

Sign by fly]
00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3
8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ??
E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66
-30-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0
ep_only = true
[bambam V0:01 -> bedrock]
signature = 6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF
ep_only = true
[bambam V0:01 -> bedrock]
signature = 6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3
BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ??
B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1
ep_only = true
[BamBam v0:01]
signature = 6A 14
BF FB ?? ?? 00 53
B9 80 ?? ?? 00 2B
8B 48 06 66 8B 50
C6 45 FF 00 8D 7D
3A D1 75 0E 83 C6
8B 43 10 85 C0 0F
89 45 F8 C7 45 F4
8B D1 03 F7 8B F8
ep_only = false

E8
F3
CF
14
E8
02
84
00
C1

9A
A5
89
81
8B
83
DD
00
E9

05
E8
45
E1
F3
C7
00
00
02

[bambam V0:04 -> bedrock >

signature = BF ?? ?? ?? ??
11 0A 00 00 83 C4 0C 68 ??
AE F7 D1 49 BF ?? ?? ?? ??
?? ?? 83 C9 FF 33 C0 F2 AE
ep_only = true

00
8D
E8
FF
8A
02
00
00
F3

00
05
89
FF
0E
84
00
74
A5

8B
00
0D
00
8A
C0
8B
61

D8
00
6B
00
17
75
43
8B

53
8B
??
8D
8A
DC
08
15

68
3D
??
5C
C1
33
50
07

FB
03
00
02
3A
C0
E8
??

??
??
66
18
CA
EB
D7
??

??
??
89
8D
75
05
04
00

00
00
55
41
1E
1B
00
8B

E8
A1
EC
FF
84
C0
00
35

6C
2B
8B
85
C0
83
8A
6B

FD
??
41
C0
74
D8
4D
??

FF
??
3C
0F
16
FF
FF
??

FF
00
33
8E
8A
85
83
00

B9
66
D2
39
56
C0
C4
8B

05
8B
03
01
01
75
04
7B

00
15
C1
00
8A
04
84
0C

00
2F
83
00
4F
C6
C9
2B

00
??
C4
89
01
45
8B
CA

8B
??
10
45
8A
FF
4B
03

F3
00
66
F0
C2
01
08
F2

Sign by fly]
83 C9 FF 33 C0
?? ?? ?? FF 15
8B D1 68 ?? ??
F7 D1 49 51 68

68
??
??
??

??
??
??
??

??
??
C1
??

??
??
E9
??

??
8B
02
E8

F2
F0
F3
C0

AE
BF
AB
09

F7
??
8B
00

D1 49 51 68 ?? ?? ?? ?? E8
?? ?? ?? 83 C9 FF 33 C0 F2
CA 83 E1 03 F3 AA BF ?? ??
00

[bambam V0:04 -> bedrock]

signature = BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8
11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2
AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3
ep_only = true
[BAT2COM v1:5 (c) Douglas Boling; PC Magazine]
signature = EB J3 FC BD ?? ?? 8B ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? B4 4A CD 21 A1 ?? ?? 89
ep_only = true
[BDC HelpSystem Help file]
signature = 42 44 43 20 48 65 6C 70 53 79 73 74 65 6D
ep_only = false
[beria v0:07 public WIP
signature = 83 EC 18 53
74 0D 89 AE 20 07 00 00
F5 74 09 89 2E E8 3C FE
8B 46 0C 3B C5 8B 3D 04
C5 74 06 50 FF D7 89 6E
A4 40 ?? ?? FF D3 8B F0
8B 35 30 30 ?? ?? A3 D4
ep_only = true

->
8B
E8
FF
30
10
3B
43

symbiont
1D 00 30
88 0F 00
FF EB 02
?? ?? 89
8B 46 14
F5 74 09
?? ?? 8B

(h)]
?? ??
00 EB
33 F6
2E 89
3B C5
E8 08
00 03

[beria v0:07 public WIP

signature = 83 EC 18 53
74 0D 89 AE 20 07 00 00
F5 74 09 89 2E E8 3C FE
ep_only = true

->
8B
E8
FF

symbiont]
1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5
88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B
FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0

55
02
6A
6E
74
12
D0

56
33
18
04
0A
00
52

57
F6
55
89
50
00
03

-31-

68
6A
89
6E
FF
8B
C8

30
10
35
08
D7
C6
51

07
55
D8
74
89
EB
FF

00
89
43
06
6E
02
D6

00
35
??
50
14
33
8B

33
30
??
FF
EB
C0
3D

ED
40
FF
D7
02
8B
24

55
??
D3
89
33
48
30

FF
??
8B
6E
F6
08
??

D3
FF
F0
0C
6A
8B
??

8B
D3
3B
8B
10
51
50

F0
8B
F5
46
55
04
FF

3B
F0
74
10
89
8B
D7

F5
3B
37
3B
35
09

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Berio 1:00 beta (h)]

signature = 90 90 90 90
90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90
00 EB 5D BB ED FF FF FF
65 03 00 00 8D 85 2E 04
ep_only = true

90
90
90
90
90
90
90
90
E9
03
00

90
90
90
90
90
90
90
90
01
DD
00

90
90
90
90
90
90
90
90
12
81
50

90
90
90
90
90
90
90
90
00
EB
FF

90
90
90
90
90
90
90
90
00
00
95

90
90
90
90
90
90
90
90
90
B0
4D

90
90
90
90
90
90
90
90
60
01
0F

90
90
90
90
90
90
90
90
E8
00

90
90
90
90
90
90
90
90
03
83

90
90
90
90
90
90
90
90
00
BD

90
90
90
90
90
90
90
90
00
22

90
90
90
90
90
90
90
90
00
04

90
90
90
90
90
90
90
90
E9
00

90
90
90
90
90
90
90
90
EB
00

90
90
90
90
90
90
90
90
04
00

90
90
90
90
90
90
90
90
5D
89

90
90
90
90
90
90
90
90
45
9D

90
90
90
90
90
90
90
90
55
22

90
90
90
90
90
90
90
90
C3
04

90
90
90
90
90
90
90
90
E8
00

90
90
90
90
90
90
90
90
01
00

90
90
90
90
90
90
90
90
00
0F

90
90
90
90
90
90
90
90
00
85

[Berio 2:00 beta (h)]

signature = 90 90 90 90
90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90
ep_only = true

90
90
90
90
90
90
90
90
E9

90
90
90
90
90
90
90
90
01

90
90
90
90
90
90
90
90
74

90
90
90
90
90
90
90
90
01

90
90
90
90
90
90
90
90

90
90
90
90
90
90
90
90

90
90
90
90
90
90
90
90

90
90
90
90
90
90
90
90

90
90
90
90
90
90
90
90

90
90
90
90
90
90
90
90

90
90
90
90
90
90
90
90

90
90
90
90
90
90
90
90

90
90
90
90
90
90
90
90

90
90
90
90
90
90
90
90

90
90
90
90
90
90
90
90

90
90
90
90
90
90
90
90

90
90
90
90
90
90
90
90

90
90
90
90
90
90
90
90

90
90
90
90
90
90
90
90

90
90
90
90
90
90
90
90

90
90
90
90
90
90
90
90

90
90
90
90
90
90
90
90

90
90
90
90
90
90
90
90

[BeRo Tiny Pascal

signature = E9 ??
50 61 73 63 61 6C
6E 6A 61 6D 69 6E
ep_only = true

->
??
20
20

BeRo]
?? ?? 20 43 6F 6D 70 69 6C 65 64 20 62 79 3A 20 42 65 52 6F 54 69 6E 79
2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 32 30 30 36 2C 20 42 65
27 42 65 52 6F 27 20 52 6F 73 73 65 61 75 78 20

[BeRoEXEPacker v1:00 (DLL) -> BeRo / Farbrausch]

signature = 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB
A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41
B0 10
ep_only = true
[BeRoEXEPacker
signature = 83
E8 ?? ?? ?? ??
73 F0 29 3E 03
ep_only = true

v1:00
7C 24
BE ??
F1 03

(DLL)
08 01
?? ??
F9 EB

->
0F
??
E8

BeRo / Farbrausch]
85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ??
B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02
BA ?? ?? ?? ?? 8D B2

[BeRoEXEPacker
signature = 83
E8 ?? ?? ?? ??
73 F0 29 3E 03
ep_only = true

v1:00
7C 24
BE ??
F1 03

(DLL)
08 01
?? ??
F9 EB

-> BeRo / Farbrausch]

0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ??
?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02
E8

[BeRoEXEPacker v1:00 (LZMA)]

signature = 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9
04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8
ep_only = true
[BeRoEXEPacker V1:00
signature = BA ?? ??
75 02 8B DF 03 DA 03
0F BA F0 1F 72 04 8D
04 EB D8 83 C6 14 EB
ep_only = false

->
??
FA
44
AA

BeRo > Sign

?? 8D B2 ??
52 57 50 FF
?? ?? 51 52
61 C3

by
??
15
57

fly]
?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB
?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22
50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74 0B AB 83 C3

-32-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[BeRoEXEPacker v1:00 -> BeRo / Farbrausch]

signature = 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9
04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 BA
?? ?? ?? ?? 8D B2
ep_only = false
[BeRoEXEPacker
signature = 60
C9 E8 64 00 00
?? ?? ?? ?? D4
ep_only = true

v1:00 -> BeRo / Farbrausch]

BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC ?? ?? ?? ?? A4 ?? ?? ?? ?? 00 ?? ?? ?? ?? 33
00 73 1C ?? ?? ?? ?? 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7
E8

[BeRoEXEPacker V1:00
signature = BA ?? ??
75 02 8B DF 03 DA 03
0F BA F0 1F 72 04 8D
ep_only = false

->
??
FA
44

BeRo]
?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB
52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22
?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74

[BeRoEXEPacker v1:00 [LZBRR]]

signature = 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33
C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10
ep_only = true
[BeRoEXEPacker
signature = 60
72 03 A4 EB F2
03 AC 12 C0 C3
ep_only = true

v1:00 [LZBRS]]
BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ??
E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75
33

[BeRoEXEPacker
signature = 60
72 03 A4 EB F2
03 AC 12 C0 C3
ep_only = true

v1:00 [LZBRS]]
BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 1C 00 00 00
E8 1A 00 00 00 8D 51 FF E8 12 00 00 00 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75
33

[BeRoEXEPacker
signature = 83
B0 80 3B FB 73
F7 2B F2 F3 A4
ep_only = true

v1:00
7C 24
3B E8
5E EB

DLL [LZBRS]]
08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07
?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B
DB 02 C0 75 03 AC 12 C0 C3 33

[BeRoEXEPacker
signature = 83
B0 80 3B FB 73
F7 2B F2 F3 A4
ep_only = true

v1:00
7C 24
3B E8
5E EB

DLL [LZBRS]]
08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07
1C 00 00 00 72 03 A4 EB F2 E8 1A 00 00 00 8D 51 FF E8 12 00 00 00 56 8B
DB 02 C0 75 03 AC 12 C0 C3 33

[BGI Stroked Font v:1:1]

signature = 50 4B 08 08 42 47 49 20 53 74 72 6F 6B 65 64 20 46 6F 6E 74 20 56 31 2E 31
ep_only = false
[BIN-Lock (tm) 1994]
signature = EB J3 31 C0 8E C0 26 ?? ?? ?? ?? ?? ?? 26 ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 26 ??
?? ?? ?? 2E ?? ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? CC CD 01 EB
ep_only = true
[BlackEnergy DDoS Bot Crypter]
signature = 55 ?? ?? 81 EC 1C 01 00 00 53 56 57 6A 04 BE 00 30 00 00 56 FF 35 00 20 11 13 6A
00 E8 ?? 03 00 00 ?? ?? 83 C4 10 ?? FF 89 7D F4 0F
ep_only = true
[Blade Joiner v1:5]
-33-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 55 8B EC 81 C4 E4 FE FF FF 53 56 57 33 C0 89 45 F0 89 85
ep_only = true
[BlindSpot 1:0
signature = 55
FF FF 68 00 01
FF FF 68 00 00
8D 45 F8 8B 1D
00 39 75 F8 0F
68 04 01 00 00
00 FF 15 10 10
40 00 8D 85 E4
ep_only = true

->
8B
00
00
18
84
50
40
FE

s134k]
EC 81 EC
00 33 F6
80 50 FF
10 40 00
76 01 00
FF 15 14
00 EB 12
FF FF 68

[BlindSpot 1:0
signature = 55
FF FF 68 00 01
FF FF 68 00 00
ep_only = true

->
8B
00
00

s134k]
EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD
00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD
80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15

[BobPack v1:00
signature = 60
?? ?? ?? ?? 89
01 00 00 E8 01
ep_only = true

-> BoB / BobSoft]

E8 00 00 00 00 8B 0C 24 89 CD 83 E9 06 81 ED ?? ?? ?? ?? E8 3D 00 00 00 89 85
C2 B8 5D 0A 00 00 8D 04 08 E8 E4 00 00 00 8B 70 04 01 D6 E8 76 00 00 00 E8 51
01

50
50
15
56
00
10
8D
54

02
56
20
50
A1
40
85
10

00
FF
10
6A
90
00
E4
40

00
15
40
34
12
EB
FE
00

8D
24
00
FF
40
2C
FF
50

85
10
56
35
00
66
FF

B0
40
56
90
66
3D
68

FE
00
68
12
8B
02
04

FF
56
00
40
40
00
01

FF
68
08
00
30
75
00

53
80
00
FF
66
14
00

56
00
00
75
3D
8D
50

A3
00
50
FC
01
85
FF

90
00
89
FF
00
E4
15

12
6A
45
D3
75
FE
0C

40
03
FC
85
14
FF
10

00
56
FF
C0
8D
FF
40

57
56
15
0F
85
50
00

8D
8D
1C
84
E4
68
8B

85
85
10
7F
FE
04
3D

B0
B0
40
01
FF
01
08

FD
FD
00
00
FF
00
10

[BobSoft Mini Delphi -> BoB / BobSoft]

signature = 55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8
ep_only = true
[BobSoft Mini Delphi -> BoB / BobSoft]
signature = 55 8B EC 83 C4 F0 53 56 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64
FF 30 64 89 20 B8
ep_only = true
[BobSoft Mini Delphi -> BoB / BobSoft]
signature = 55 8B EC 83 C4 F0 53 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF
30 64 89 20 B8 ?? ?? ?? ?? E8
ep_only = true
[BookManager v9510]
signature = FC A3 ?? ?? 89 1E ?? ?? 49 89 0E ?? ?? BB ?? ?? 8C 1F 83 ?? ?? 89 ?? ?? B8 ?? ??
50 89 ?? ?? F7 D0 50
ep_only = true
[BopCrypt v1:0]
signature = 60 BD ?? ?? ?? ?? E8 ?? ?? 00 00
ep_only = true
[Borland C / Borland Builder]
signature = 3B CF 76 05 2B CF FC F3 AA 59
ep_only = false
[Borland C++ 1991]
signature = 2E 8C 06 ?? ?? 2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F
ep_only = true
[Borland C++ 1992; 1994]
signature = 8C C8 8E D8 8C 1E ?? ?? 8C 06 ?? ?? 8C 06 ?? ?? 8C 06
ep_only = true
[Borland C++ 1994]
-34-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 8C CA 2E 89 ?? ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA A3 ?? ?? 8C
ep_only = true
[Borland C++ DLL]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 A1 C1 E0 02 A3 8B
ep_only = true
[Borland C++ DLL]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9
ep_only = false
[Borland C++ DLL]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 ?? ?? ?? ?? A1 ?? ?? ?? ?? C1 E0 02 A3
?? ?? ?? ?? 8B
ep_only = true
[Borland C++ DLL]
signature = A1 ?? ?? ?? ?? C1 E0 02 A3
ep_only = true
[Borland C++ for Win16 1991]
signature = 9A FF FF 00 00 0B C0 75 ?? E9 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ??
?? 89 ?? ?? ?? B8 FF FF 50 9A FF FF 00 00
ep_only = true
[Borland C++ for Win32 1994]
signature = A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? 75 ?? 57 51 33 C0 BF
ep_only = true
[Borland C++ for Win32 1995]
signature = A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 57 51 33 C0 BF ?? ?? ?? ?? B9 ?? ?? ?? ??
3B CF 76
ep_only = true
[Borland C++ for Win32 1995]
signature = A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? 75 ?? 80 ?? ?? ?? ?? ?? ??
74
ep_only = true
[Borland C++ for Win32 1999]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90
ep_only = false
[Borland C++ for Win32 1999]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 ?? ?? ?? ?? A1 ?? ?? ?? ?? C1 E0 02 A3
?? ?? ?? ?? 52
ep_only = true
[Borland C++ v5:0 for Windows]
signature = EB J3 53 51 06 33 C0 50 9A ?? ?? ?? ?? 58 07 59 5B 9A
ep_only = true
[Borland C++]
signature = A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 57 51 33 C0 BF ?? ?? ?? ?? B9 ?? ?? ?? ??
3B CF 76 05 2B CF FC F3 AA 59 5F
ep_only = true
[Borland Delphi 3 -> Portions Copyright (c) 1983;96 Borland (h)]
signature = 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33
2C 39 36 20 42 6F 72 6C 61 6E 64 00
ep_only = false

-35-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Borland Delphi 3 -> Portions Copyright (c) 1983;97 Borland (h)]

signature = 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33
2C 39 37 20 42 6F 72 6C 61 6E 64 00
ep_only = false
[Borland Delphi 3:0]
signature = A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? 0F ?? ?? ?? ?? ?? 80 ?? ??
?? ?? ?? ?? 74
ep_only = true
[Borland Delphi 5 -> Portions Copyright (c) 1983;99 Borland (h)]
signature = 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33
2C 39 39 20 42 6F 72 6C 61 6E 64 00
ep_only = false
[Borland Delphi DLL]
signature = 55 8B EC 83 C4 B4 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 40
ep_only = true
[Borland Delphi Setup Module]
signature = 55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8
ep_only = true
[Borland Delphi v2:0]
signature = E8 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 05 ?? ??
?? ?? C7 05 ?? ?? ?? ?? 0A ?? ?? ?? B8 ?? ?? ?? ?? C3
ep_only = true
[Borland Delphi v3:0]
signature = 50 6A ?? E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 E8 ?? ?? ??
?? 5A 58 E8 ?? ?? ?? ?? C3 55 8B EC 33 C0
ep_only = true
[Borland Delphi v3:0]
signature = 55 8B EC 83
?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ??
ep_only = true

C4
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
00

??
??
??
??
??

??
??
??
??
??

??
??
??
??
??

??
??
??
??
??

??
??
??
??
??

[Borland Delphi v4:0 - v5:0]

signature = 50 6A ?? E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 C7 42 08 ??
?? ?? ?? C7 42 0C ?? ?? ?? ?? E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3
ep_only = true
[Borland Delphi v4:0 - v5:0]
signature = 50 6A 00 E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 C7 42 08 00
00 00 00 C7 42 0C 00 00 00 00 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3
ep_only = true
[Borland Delphi v4:0
signature = 55 8B EC
?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ??
ep_only = true

- v5:0]
83 C4 ??
?? ?? ??
?? ?? ??
?? ?? ??
?? ?? ??
?? ?? ??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

[Borland Delphi v5:0 KOL/MCK]

-36-

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
20

??
??
??
??
??

??
??
??
??
??

??
??
??
??
??

??
??
??
??
??

??
??
??
??
??

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true
[Borland Delphi v5:0
signature = 55 8B EC
?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? 00 00
00 00 00 ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ??
ep_only = true

KOL/MCK]
?? ?? ??
?? ?? ??
00 ?? ??
?? ?? ??
?? ?? ??
?? ?? ??
?? ?? ??

??
??
??
??
??
??
??

??
??
??
??
??
??
00

??
??
??
??
??
??
00

??
??
??
??
??
??
00

??
FF
??
??
??
00
??

??
??
??
??
00
??
??

??
??
00
??
00
??
??

??
??
??
??
00
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
00

??
??
??
??
??
00
00

??
??
??
??
??
00
00

??
??
??
??
??
00

??
00
??
00
??
??

??
??
??
00
??
??

??
??
??
00
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

[Borland Delphi v5:0 KOL]

signature = 55 8B EC 83 C4 F0 B8 ?? ?? 40 00 E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF 8B
C0 00 00 00 00 00 00 00 00 00 00 00
ep_only = true
[Borland Delphi v6:0 - v7:0]
signature = BA ?? ?? ?? ?? 83 7D 0C 01 75 ?? 50 52 C6 05 ?? ?? ?? ?? ?? 8B 4D 08 89 0D ?? ??
?? ?? 89 4A 04
ep_only = true
[Borland Delphi v6:0 - v7:0]
signature = 53 8B D8 33 C0 A3 0? ?? ?? ?0 6A 00 E8 0? ?? ?0 FF A3 0? ?? ?? ?0 A1 0? ?? ?? ?0
A3 0? ?? ?? ?0 33 C0 A3 0? ?? ?? ?0 33 C0 A3 0? ?? ?? ?0 E8
ep_only = false
[Borland Delphi v6:0
signature = 55 8B EC
?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ??
ep_only = true

- v7:0]
83 C4 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

[Borland Delphi v6:0 - v7:0]

signature = 53 8B D8 33 C0 A3 00 ?? ?? ?? 06 A0 0E 80 ?? ?? 0F FA 30 ?? ?? ?? 0A 10 ?? ?? ??
0A 30 ?? ?? ?? 03 3C 0A 30 ?? ?? ?? 03 3C 0A 30 ?? ?? ?? E8
ep_only = true
[Borland Delphi v6:0
signature = 55 8B EC
FF 8B 0D ?? ?? ?? ??
?? E8 ?? ?? FF FF E8
ep_only = true

- v7:0]
83 C4 F0 B8 ?? ?? ?? ?? E8 ?? ?? FB FF A1 ?? ?? ?? ?? 8B ?? E8 ?? ?? FF
A1 ?? ?? ?? ?? 8B 00 8B 15 ?? ?? ?? ?? E8 ?? ?? FF FF A1 ?? ?? ?? ?? 8B
?? ?? FB FF 8D 40

[Borland Delphi v6:0

signature = 55 8B EC
?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ??
ep_only = true

- v7:0]
83 C4 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

[Borland Delphi v6:0 - v7:0]

signature = 55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8
ep_only = false
[Borland Delphi v6:0 - v7:0]
signature = 55 8B EC 83 C4 F0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = false
[Borland Delphi v6:0 - v7:0] // Hint = $0
-37-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 53 8B D8 33 C0 A3 0< ?? ?? <0 6A 00 E8 0< ?? <0 FF A3 0< ?? ?? <0 A1 0< ?? ?? <0

A3 0< ?? ?? <0 33 C0 A3 0< ?? ?? <0 33 C0 A3 0< ?? ?? <0 E8
ep_only = false
[Borland Delphi v6:0 KOL]
signature = 55 8B EC 83 C4 F0 B8 ?? ?? 40 00 E8 ?? ?? FF FF A1 ?? 72 40 00 33 D2 E8 ?? ?? FF
FF A1 ?? 72 40 00 8B 00 83 C0 14 E8 ?? ?? FF FF E8 ?? ?? FF FF
ep_only = true
[Borland Delphi v6:0]
signature = 55 8B EC 83 C4 F0 B8 ?? ?? 45 00 E8 ?? ?? ?? FF A1 ?? ?? 45 00 8B 00 E8 ?? ?? FF
FF 8B 0D
ep_only = true
[Borland Delphi v6:0]
signature = 53 8B D8 33 C0 A3 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? FF A3 ?? ?? ?? ?? A1 ?? ?? ?? ??
A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? E8
ep_only = true
[Borland Delphi vx:x (Component)]
signature = C3 E9 ?? ?? ?? FF 8D 40
ep_only = true
[Borland Delphi]
signature = 55 8B EC 83 C4 F4
ep_only = true
[Borland Pascal v7:0 for Windows]
signature = 9A FF FF 00 00 9A FF FF 00 00 55 89 E5 31 C0 9A FF FF 00 00
ep_only = true
[Borland Pascal v7:0 Protected Mode]
signature = B8 ?? ?? BB ?? ?? 8E D0 8B E3 8C D8 8E C0 0E 1F A1 ?? ?? 25 ?? ?? A3 ?? ?? E8 ??
?? 83 3E ?? ?? ?? 75
ep_only = true
[Borland Pascal v7:0]
signature = B8 ?? ?? 8E D8 8C ?? ?? ?? 8C D3 8C C0 2B D8 8B C4 05 ?? ?? C1 ?? ?? 03 D8 B4 ??
CD 21 0E
ep_only = true
[by Central Point Software]
signature = 50 51 52 56 57 8B EB 1E 2E
ep_only = true
[C-Crypt v1:02]
signature = E9 J1 J1 E8 ?? ?? 5D 83 ?? ?? 55 D9 D0 9C 58 25 ?? ?? 50 9D 50 57 BF ?? ?? B0 ??
AA 5F 58 66 51
ep_only = true
[C:I Crypt V0:1 -> FearlesS]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00
00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72
ep_only = true
[C:I Crypt V0:2 -> FearlesS]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ??
?? ?? 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74
ep_only = true

-38-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[CA Visual Objects 2:0 - 2:5]

signature = 89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ??
?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ??
?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB
ep_only = true
[CA Visual Objects 2:0 - 2:5]
signature = 89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ??
?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ??
?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB ?? ?? ?? ?? C7 03
44 00 00 00
ep_only = true
[CALS Raster graphics format]
signature = 73 72 63 64 6F 63 69 64 3A 20
ep_only = false
[CAN2EXE v0:01]
signature = 26 8E 06 ?? ?? B9 ?? ?? 33 C0 8B F8 F2 AE E3 ?? 26 38 05 75 ?? EB ?? E9
ep_only = true
[Can2Exe v0:01]
signature = 0E 1F 0E 07 E8 ?? ?? E8 ?? ?? 3A C6 73
ep_only = true
[CauseWay DOS Extender v2:64; v3:25 1992-95]
signature = EB J3 8B E8 8C C6 0E 1F 8C C0 05 ?? ?? 01 ?? ?? ?? B8 ?? ?? CD 21 3C ?? 73
ep_only = true
[CauseWay DOS Extender v3:25]
signature = FA 16 1F 26 ?? ?? ?? 83 ?? ?? 8E D0 FB 06 16 07 BE ?? ?? 8B FE B9 ?? ?? F3 A4 07
ep_only = true
[CC v2:61 Beta]
signature = BA ?? ?? B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB
ep_only = true
[CC286x v2:1]
signature = E9 J1 J1 EB ?? 9A ?? ?? ?? ?? 81 ?? ?? ?? EB ?? 66 ?? ?? ?? ?? ?? EA ?? ?? ?? ??
FF E6
ep_only = true
[CD-Cops II]
signature = 53 60 BD ?? ?? ?? ?? 8D 45 ?? 8D 5D ?? E8 ?? ?? ?? ?? 8D
ep_only = true
[CDS SS 1:0 beta1
signature = 60 E8
03 00 00 89 85 B8
00 00 00 0F B6 40
00 00 0B C0 0F 84
4E 40 00 E8 D7 03
40 00 50
ep_only = true

->
00
4E
02
CE
00

CyberDoom]
00 00 00 5D
40 00 66 8C
0A C0 0F 85
02 00 00 E8
00 0B C0 0F

81
D8
E8
1E
84

ED
A8
02
03
A9

CA
04
00
00
02

47
74
00
00
00

40
0C
8D
89
00

00
C7
85
85
E8

FF
85
F6
90
F9

74
8C
4C
4E
02

24
4E
40
40
00

20
40
00
00
00

E8
00
50
8D
89

D3
01
FF
85
85

03
00
B5
03
94

00
00
B8
4D
4E

00
00
4E
40
40

0B
EB
40
00
00

C0
12
00
50
8D

0F
64
E8
FF
85

84
A1
FC
B5
12

13
30
03
B8
4D

[CERBERUS v2:0]
signature = 9C 2B ED 8C ?? ?? 8C ?? ?? FA E4 ?? 88 ?? ?? 16 07 BF ?? ?? 8E DD 9B F5 B9 ?? ??
FC F3 A5
ep_only = true
[CExe v1:0a]
signature = 55 8B EC 81 EC 0C 02 ?? ?? 56 BE 04 01 ?? ?? 8D 85 F8 FE FF FF 56 50 6A ?? FF 15
-39-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

54 10 40 ?? 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16
ep_only = true
[CGM Graphics format]
signature = 00 2A 08 48 69 4A 61 61 6B 20 32
ep_only = false
[CHECKPRG (c) 1992]
signature = 33 C0 BE ?? ?? 8B D8 B9 ?? ?? BF ?? ?? BA ?? ?? 47 4A 74
ep_only = true
[ChinaProtect -> dummy > Sign
signature = C3 E8 ?? ?? ?? ??
?? ?? FF 30 C3 B9 ?? ?? ?? ??
56 8B ?? ?? ?? 6A 40 68 00 10
44 ?? ?? 56 8D ?? ?? 68 00 40
?? ?? 5E C3
ep_only = false

by
B9
E8
00
00

fly]
?? ??
?? ??
00 8D
00 FF

??
??
??
36

??
??
??
56

E8
FF
50
E8

??
30
6A
??

??
C3
00
??

??
B9
E8
??

??
??
??
??

FF
??
??
68

30
??
??
00

C3
??
??
80

B9
E8
89
00

??
??
30
00

??
??
83
6A

??
??
C0
00

??
??
04
56

E8
FF
5E
E8

??
30
C3
??

??
C3
8B
??

[ChSfx (small) v1:1]

signature = BA ?? ?? E8 ?? ?? 8B EC 83 EC ?? 8C C8 BB ?? ?? B1 ?? D3 EB 03 C3 8E D8 05 ?? ??
89
ep_only = true
[CICompress 1:0]
signature = 6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97
BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00
00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35
ep_only = false
[CICompress v1:0]
signature = 6A 04
BE 00 20 40 00 E8
00 C0 68 94 10 40
FF 35 FC 10 40 00
00 40 00 00 FF 35
33 DB 33 C9 E8 7F
71 00 00 00 3C 00
00 00 3C 00 74 3B
02 E8 31 00 00 00
ep_only = true

68
71
00
FF
9C
00
74
8B
8B

00
00
FF
35
14
00
EB
E8
E8

10
00
15
F8
40
00
56
C1
C1

00
00
2C
10
00
73
8B
C5
C5

00
3B
10
40
FF
0A
F7
08
08

FF
05
40
00
35
B1
2B
B1

35
9C
00
FF
FC
08
F0
08

9C
14
A3
15
10
E8
A4
E8

14
40
F8
34
40
82
5E
44

40
00
10
10
00
00
EB
00

00
75
40
40
FF
00
D4
00

6A
61
00
00
15
00
33
00

00
6A
6A
FF
3C
AA
ED
0B

FF
00
00
35
10
EB
E8
C5

15
6A
68
F8
40
EF
51
50

38
20
F4
10
00
E8
00
33

10
6A
10
40
6A
6E
00
ED

40
02
40
00
00
00
00
E8

00
6A
00
FF
FF
00
72
2E

A3
00
FF
15
15
00
10
00

FC
6A
35
30
28
73
B1
00

10
03
9C
10
10
14
02
00

40
68
14
40
40
B1
E8
72

00
00
40
00
00
04
54
0C

97
00
00
68
60
E8
00
B1

[Ciphator v4:6]
signature = 93 93 E8 J1 J1 58 6A 00 0E 68 ?? ?? CF EB
ep_only = true
[CipherWall Self-Extrator/Decryptor
signature = 90 61 BE 00 10 42 00 8D
EB 0E 90 90 90 90 8A 06 46 88 07 47
DB 75 07 8B 1E 83 EE FC 11 DB 11 C0
ep_only = false

(Console) 1:5]
BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF
01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01
01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4

[CipherWall
signature =
EB 0E 90 90
DB 75 07 8B
03 72 0D C1
75 07 8B 1E
75 09 8B 1E
8A 02 42 88
CF E9 4C FF
5F 04 66 C1

(Console) v1:5]
BE 00 00 FE FF C7
01 DB 75 07 8B 1E
01 DB 73 EF 75 09
74 74 89 C5 01 DB
20 41 01 DB 75 07
C1 02 81 FD 00 F3
FF FF 90 8B 02 83
00 00 8A 07 47 2C

Self-Extrator/Decryptor
90 61 BE 00 10 42 00 8D
90 90 8A 06 46 88 07 47
1E 83 EE FC 11 DB 11 C0
E0 08 8A 06 46 83 F0 FF
83 EE FC 11 DB 11 C9 75
83 EE FC 11 DB 73 E4 83
07 47 49 75 F7 E9 63 FF
FF FF 5E 89 F7 B9 12 10
E8 08 C1 C0 10 86 C4

-40-

87
83
8B
75
8B
FF
C2
E8

C0
EE
1E
07
1E
FF
04
3C

20
FC
83
8B
83
83
89
01

02
11
EE
1E
EE
D1
07
77

00
DB
FC
83
FC
01
83
F7

0B
72
11
EE
11
8D
C7
80

6E
ED
DB
FC
DB
14
04
3F

5B
B8
73
11
11
2F
83
06

9B
01
E4
DB
C9
83
E9
75

57
00
31
11
01
FD
04
F2

83
00
C9
C9
DB
FC
77
8B

CD
00
83
01
73
76
F1
07

FF
01
E8
DB
EF
0F
01
8A

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[CipherWall Self-Extrator/Decryptor
signature = 90 61 BE 00 10 42 00 8D
EB 0E 90 90 90 90 8A 06 46 88 07 47
DB 75 07 8B 1E 83 EE FC 11 DB 11 C0
ep_only = false

(GUI)
BE 00
01 DB
01 DB

1:5]
00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF
75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01
73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4

[CipherWall Self-Extrator/Decryptor
signature = 90 61 BE 00 10 42 00 8D
EB 0E 90 90 90 90 8A 06 46 88 07 47
DB 75 07 8B 1E 83 EE FC 11 DB 11 C0
03 72 0D C1 E0 08 8A 06 46 83 F0 FF
75 07 8B 1E 83 EE FC 11 DB 11 C9 75
75 09 8B 1E 83 EE FC 11 DB 73 E4 83
8A 02 42 88 07 47 49 75 F7 E9 63 FF
CF E9 4C FF FF FF 5E 89 F7 B9 52 10
5F 04 66 C1 E8 08 C1 C0 10 86 C4
ep_only = true

(GUI)
BE 00
01 DB
01 DB
74 74
20 41
C1 02
FF FF
00 00

v1:5]
00 FE
75 07
73 EF
89 C5
01 DB
81 FD
90 8B
8A 07

FF
8B
75
01
75
00
02
47

C7
1E
09
DB
07
F3
83
2C

87
83
8B
75
8B
FF
C2
E8

C0
EE
1E
07
1E
FF
04
3C

20
FC
83
8B
83
83
89
01

02
11
EE
1E
EE
D1
07
77

00
DB
FC
83
FC
01
83
F7

F9
72
11
EE
11
8D
C7
80

89
ED
DB
FC
DB
14
04
3F

C7
B8
73
11
11
2F
83
0E

6A
01
E4
DB
C9
83
E9
75

57
00
31
11
01
FD
04
F2

83
00
C9
C9
DB
FC
77
8B

CD
00
83
01
73
76
F1
07

FF
01
E8
DB
EF
0F
01
8A

by
8B
C9
74

fly]
C7 81 C7 ?? ?? ?? ?? 3B 47 2C 75
75 F7 83 7F 40 00 74 15 8B 77 40
24 24 8B DE 03 F0 B9 01 00 00 00

[Code Virtualizer
signature = 60 9C
02 EB 2E 89 47 2C
03 F0 EB 09 8B 1E
33 C0 F0 0F B1 4F
ep_only = false

V1:3:1:0
FC E8 00
B9 A7 00
03 D8 01
30 75 F7

->
00
00
03
AC

Oreans Technologies > Sign

00 00 5F 81 EF ?? ?? ?? ??
00 EB 05 01 44 8F ?? 49 0B
83 C6 04 83 3E 00 75 F2 8B

[Code Virtualizer
signature = 60 9C
02 EB 2E 89 47 2C
03 F0 EB 09 8B 1E
ep_only = true

V1:3:1:0
FC E8 00
B9 A7 00
03 D8 01

->
00
00
03

Oreans Technologies]
00 00 5F 81 EF ?? ?? ?? ?? 8B C7 81 C7 ?? ?? ?? ?? 3B 47 2C 75
00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40
83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9

[Code-Lock vx:x]
signature = 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00
ep_only = true
[CodeCrypt v0:14b]
signature = E9 C5 02 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F
ep_only = true
[CodeCrypt v0:15b]
signature = E9 31 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F
ep_only = true
[CodeCrypt v0:164]
signature = E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F EB 03 FF 1D 34
ep_only = true
[CodeCrypt v0:16b - v0:163b]
signature = E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F
ep_only = true
[codeCrypter 0:31]
signature = 50 58 53 5B 90 BB ?? ?? 40 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC
CC CC CC CC CC
ep_only = false
[codeCrypter 0:31]
signature = 50 58 53 5B 90 BB ?? ?? 40 00 FF E3 90 CC CC CC 55 8B EC 5D C3
ep_only = true

-41-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[CodeSafe v2:0]
signature = ? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 EC 10
53 56 57 E8 C4 01 00
ep_only = true
[COM-Crypt II / 386 by ROSE]
signature = E9 J1 J1 BF ?? ?? 57 B9 ?? ?? C7 ?? ?? ?? C6 ?? ?? ?? 81 ?? ?? ?? 47 47 E2 ?? 33
FF C3
ep_only = true
[COM2EXE]
signature = E9 J1 J1 8C CA 81 C2 ?? ?? 3B 16 ?? ?? 76 ?? BA ?? ?? B4 09 CD 21 CD 20
ep_only = true
[Com4mail v1:0]
signature = 42 45 47 49 4E 3D 3D 3D 74 66 75 64 23 6F 66 5F 43 6F 6D 34 4D 61 69 6C 5F 66 69
6C 65 23 0D 0A
ep_only = true
[ComCrypt]
signature = E9 J1 J1 B9 ?? ?? BE ?? ?? 89 F7 0E 1F 0E 07 BB ?? ?? FC AD 31 D8 AB E2 ?? C6
ep_only = true
[ComCryptor BTS v9:12]
signature = E9 J1 J1 B7 ?? E8 ?? ?? 83 ?? ?? EB ?? 5D 55 C3 BF ?? ?? 03 FD 8B F7 B9
ep_only = true
[COMLOCK v0:10 (c) 1994]
signature = E9 J1 J1 EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? BB ?? ?? BE ?? ?? 81 ??
?? ?? 03 F3 BF ?? ?? B9 ?? ?? F3 A4 2E ?? ?? ?? ?? BE ?? ?? 8B CB 2E ?? ?? 46 FE C0 E2
ep_only = true
[COMPACK v4:5 (2)]
signature = BE ?? ?? E8 ?? ?? 5D 83 ?? ?? 55 50 53 51 52 0E 07 0E 1F 8B CE
ep_only = true
[COMPACK v5:1]
signature = BD ?? ?? 50 06 8C CB 03 DD 8C D2 4B 8E DB BE ?? ?? BF ?? ?? 8E C2 B9 ?? ?? F3 A5
4A 4D 75 ?? 8B F7 8E DA 0E 07 06 16
ep_only = true
[Comprot v1:0b]
signature = E9 J1 J1 E8 ?? ?? 5E 8B EE 81 ?? ?? ?? 8D ?? ?? ?? B9 ?? ?? F6 14 46 E2 ?? 4B
ep_only = true
[ComProtector v1:0]
signature = E9 J1 J1 B9 ?? ?? BB ?? ?? BF ?? ?? 2E ?? ?? 34 ?? FE C8 C0 ?? ?? 2E ?? ?? 2E ??
?? 2E ?? ?? 47 43 E2
ep_only = true
[COP v1:0 (c) 1988]
signature = BF ?? ?? BE ?? ?? B9 ?? ?? AC 32 ?? ?? ?? AA E2 ?? 8B ?? ?? ?? EB ?? 90
ep_only = true
[Copy Protector v2:0]
signature = 2E A2 ?? ?? 53 51 52 1E 06 B4 ?? 1E 0E 1F BA ?? ?? CD 21 1F
ep_only = true
[Copy Protector v2:0]
signature = E9 J1 J1 50 53 51 52 1E 06 57 E8 ?? ?? 5F 83 EF ?? B4 ?? 1E 0E 1F
ep_only = true

-42-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[CopyControl v3:03]
signature = CC 90 90 EB 0B 01 50 51 52 53 54 61 33 61 2D 35 CA D1 07 52 D1 A1 3C
ep_only = true
[CopyMinder ->
signature = 83
25 ?? ?? ?? ??
?? ?? ?? ?? FF
?? ?? ?? FF 25
?? ?? FF 25
ep_only = true

Microcosm:Ltd > Sign

25 ?? ?? ?? ?? EF 6A
FF 25 ?? ?? ?? ?? FF
25 ?? ?? ?? ?? FF 25
?? ?? ?? ?? FF 25 ??

by
00
25
??
??

fly]
E8 ??
?? ??
?? ??
?? ??

[CopyMinder ->
signature = 83
25 ?? ?? ?? ??
?? ?? ?? ?? FF
ep_only = true

Microcosm:Ltd]
25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF
FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25
25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25

??
??
??
FF

??
??
FF
25

??
FF
25
??

E8
25
??
??

??
??
??
??

??
??
??
??

??
??
??
FF

??
??
FF
25

CC
FF
25
??

FF
25
??
??

25
??
??
??

??
??
??
??

??
??
??
FF

??
??
FF
25

??
FF
25
??

FF
25
??
??

[CorelDraw 8 CDR Graphics format]

signature = 52 49 46 46 ?? ?? ?? ?? 43 44 52 38
ep_only = false
[CorelDraw CMX Graphics format]
signature = 52 49 46 46 ?? ?? ?? ?? 43 4D 58 31
ep_only = false
[CPAV]
signature = E8 ?? ?? 4D 5A B1 01 93 01 00 00 02
ep_only = true
[Cracked by AutoHack (1)]
signature = FA 50 51 57 56 1E 06 2E 80 3E ?? ?? ?? 74 ?? 8E 06 ?? ?? 2B FF FC
ep_only = true
[Cracked by Autohack (2)]
signature = 0E 1F B4 09 BA ?? ?? CD 21 FA 8E 06 ?? ?? BE ?? ?? 8B 0E ?? ?? 83 F9
ep_only = true
[CrackStop v1:01 (c) Stefan Esser 1997]
signature = B4 48 BB FF FF B9 EB 27 8B EC CD 21 FA FC
ep_only = true
[cramble v0:2b3]
signature = E9 J1 J1 60 9C FC ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 ?? 01 2A ?? FF
ep_only = true
[CRC2COM v1:24 (packed)]
signature = EB J3 8B FC 83 EF ?? 83 EC ?? BE ?? ?? B9 ?? ?? 57 F3 A4 5F FF E7
ep_only = true
[CRC2COM v1:24 (unpacked)]
signature = EB J3 C8 ?? ?? ?? E8 ?? ?? 0E 07 C6 ?? ?? ?? E8 ?? ?? E8
ep_only = true
[CreateInstall 2003:3:5]
signature = 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0
FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8
F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40
ep_only = false
[CreateInstall Stub vx:x]
signature = 55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45
-43-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

00
03
00
68
FF

85
56
50
00
15

C0
FF
FF
0F
10

04 August 2015 15:14

08 FF 15 14 61
15 38 61 40 00
00 FF 15 20 61
A3 CC 35 40 00
30 40 00 FF 75
ep_only = true

40
6A
40
57
08

[CreateInstall
signature = 55
08 FF 15 14 61
15 38 61 40 00
ep_only = true

Stub vx:x]
8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45
40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF
6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56

[CreateInstall v2003:3:5]
signature = 81 EC 0C 04 00
FF 15 D4 80 40 00 3D B7 00
F2 FE FF FF 68 02 7F 00 00
E0 80 40 00 8B 0D 00 50 40
02 00 00 8B 2D D0 80 40 00
8B 3D CC 80 40 00 6A 03 53
00 8B 54 24 18 50 51 52 56
24 10 0F 85 30 02 00 00 6A
50 40 00 0F 85 10 02 00 00
ep_only = false

74
15
15
01
61

00
00
89
00
89
6A
FF
FF
56

27
38
2C
00
40

53
00
1D
E8
44
03
15
A1
FF

6A
61
61
56
00

56
75
94
68
24
68
C8
04

00
40
40
FF

57
0F
74
FF
1C
00
80
50

A1
00
00
15

55
56
40
FF
8D
00
40
40

00
E9
6A
CC

68
FF
00
FF
44
00
00
00

20
36
04
60

60
15
53
B9
24
80
85
2B

40
03
57
40

50
B8
89
40
20
51
C0
D0

00
00
68
00

40
80
1D
0D
50
FF
0F
8B

50
00
00
68

00
40
98
03
53
D7
84
4C

FF
68
FF
00

6A
00
74
00
FF
8B
40
24

15
02
01
01

01
6A
40
89
D5
F0
02
18

3C
7F
00
00

6A
02
00
44
8D
53
00
03

61
00
56
00

00
FF
FF
24
4C
8D
00
C8

40
00
FF
BE

FF
15
15
14
24
44
8B
E8

00
33
15
B0

15
A4
E4
E8
1C
24
15
9F

8B
F6
CC
3F

D8
80
80
5A
53
14
00
FE

F0
56
60
40

80
40
40
FF
68
8B
50
FF

6A
BF
40
00

40
00
00
FF
00
0D
40
FF

06
00
00
56

00
33
50
FF
00
00
00
3B

56
30
6A
A3

8B
DB
FF
68
00
50
3B
05

FF
00
04
C4

F0
E8
15
00
80
40
54
10

[Creative Audio file]

signature = 43 72 65 61 74 69 76 65 20 56 6F 69 63 65 20 46 69 6C 65
ep_only = false
[Crinkler V0:1-V0:2 -> Rune L:H:Stubbe and Aske Simon Christensen]
signature = B9 ?? ?? ?? ?? 01 C0 68 ?? ?? ?? ?? 6A 00 58 50 6A 00 5F 48 5D BB 03 00 00 00 BE
?? ?? ?? ?? E9
ep_only = true
[Crinkler V0:3-V0:4 -> Rune L:H:Stubbe and Aske Simon Christensen]
signature = B8 00 00 42 00 31 DB 43 EB 58
ep_only = true
[Crunch 4 -> Bit-Arts]
signature = EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00
ep_only = true
[Crunch 4:0]
signature = EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED
18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F
82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24
ep_only = false
[Crunch 4]
signature = EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8
ep_only = false
[Crunch 5 -> Bit-Arts]
signature = EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00
00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8
20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00
ep_only = false
[Crunch 5 / Fusion 4 -> Bit-Arts]
signature = EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00
00 00
ep_only = true
-44-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Crunch 5 Fusion 4]
signature = EB 15 03 ?? ?? ?? 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 55 E8
ep_only = false
[Crunch v4:0]
signature = EB
18 00 00 00 8B
82 92 05 00 00
85 D9 41 00 00
05 00 00 51 52
D8 73 09 66 35
C0 10 66 8B C1
8B D0 25 0F 0F
55 55 55 55 33
ep_only = true

10
C5
E8
68
53
20
5A
0F
D0

00
55
F1
EC
33
83
59
0F
C1

00
60
03
49
C9
66
C3
33
C0

00
9C
00
7B
49
81
68
D0
02

00
2B
00
79
8B
F3
03
C1
0B

00
85
49
33
D1
B8
02
C0
C2

00
E9
0F
C0
33
ED
00
08

00
06
88
50
C0
FE
00
0B

00
00
86
E8
33
CE
E8
C2

00
00
05
11
DB
75
80
8B

00
89
00
03
AC
EB
04
D0

00
85
00
00
32
33
00
25

00
E1
68
00
C1
C8
00
33

00
06
6C
89
8A
33
0F
33

00
00
D9
85
CD
D3
82
33

00
00
B2
D1
8A
4F
A8
33

00
FF
96
41
EA
75
02
33

55
74
33
00
8A
D5
00
D0

E8
24
C0
00
D6
F7
00
C1

00
2C
50
E8
B6
D2
96
C0

00
E8
E8
67
08
F7
8B
04

00
BB
24
05
66
D1
44
0B

00
01
03
00
D1
5B
24
C2

5D
00
00
00
EB
8B
04
8B

81
00
00
E9
66
C2
0F
D0

ED
0F
89
56
D1
C1
C8
25

[Crunch v5 -> Bit-Arts]

signature = EB 15 03 00
00 00 5D 81 ED 1D 00 00
20 02 00 00 0F 82 94 06
8D 8C 32 C8 00 00 00 83
EC 07 00 00 52 6A 04 68
00 00 00 00 8D 95 F0 07
6C D9 B2 96 33 C0 50 E8
89 85 ?? 46 00 00 E8 04
8A CD 8A EA 8A D6 B6 08
ep_only = true

00
00
00
39
00
00
C1
06
66

00
8B
00
00
10
00
03
00
D1

06
C5
E8
74
00
52
00
00
EB

00
55
F3
50
00
FF
00
E9
66

00
60
04
8B
FF
B5
89
F3
D1

00
9C
00
D9
B5
EC
85
05

00
2B
00
53
E8
07
??
00

00
85
49
68
07
00
46
00

00
FC
0F
BB
00
00
00
51

00
07
88
D4
00
68
00
52

00
00
88
C3
FF
00
68
53

00
00
06
79
D0
10
EC
33

00
89
00
33
58
00
49
C9

00
85
00
C0
5B
00
7B
49

68
E8
8B
50
C7
FF
79
8B

00
07
B5
E8
03
B5
33
D1

00
00
E8
0E
00
E8
C0
33

00
00
07
04
00
07
50
C0

00
FF
00
00
00
00
E8
33

55
74
00
00
00
00
AE
DB

E8
24
8B
50
C7
FF
03
AC

00
2C
56
8D
43
D0
00
32

00
E8
3C
95
04
68
00
C1

[Crunch V5:0 -> Bitarts]

signature = EB 15 03 00 00 00 06
ep_only = true
[Crunch/PE 4:0]
signature = EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED
18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F
82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24
ep_only = false
[Crunch/PE v1:0:x:x]
signature = 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89
85 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 09 C6 85
ep_only = true
[Crunch/PE v2:0:x:x]
signature = 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89
85 ?? ?? ?? ?? 55 BB ?? ?? ?? ?? 03 DD 53 64 67 FF 36 ?? ?? 64 67 89 26
ep_only = true
[Crunch/PE v3:0:x:x]
signature = EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED
18 ?? ?? ?? 8B C5 55 60 9C 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? FF 74
ep_only = true
[Crunch/PE v4:0]
signature = EB 10
18 ?? ?? ?? 8B C5
82 92 05 00 00 E8
85 D9 41 00 00 68
05 00 00 51 52 53
D8 73 09 66 35 20
C0 10 66 8B C1 5A

??
55
F1
EC
33
83
59

??
60
03
49
C9
66
C3

??
9C
00
7B
49
81
68

??
2B
00
79
8B
F3
03

??
85
49
33
D1
B8
02

??
E9
0F
C0
33
ED
00

??
06
88
50
C0
FE
00

??
??
86
E8
33
CE
E8

??
??
05
11
DB
75
80

??
89
00
03
AC
EB
04

??
85
00
00
32
33
00

-45-

??
E1
68
00
C1
C8
00

??
06
6C
89
8A
33
0F

??
??
D9
85
CD
D3
82

??
??
B2
D1
8A
4F
A8

??
FF
96
41
EA
75
02

55
74
33
00
8A
D5
00

E8
24
C0
00
D6
F7
00

??
2C
50
E8
B6
D2
96

??
E8
E8
67
08
F7
8B

??
BB
24
05
66
D1
44

??
01
03
00
D1
5B
24

5D
00
00
00
EB
8B
04

81
00
00
E9
66
C2
0F

ED
0F
89
56
D1
C1
C8

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

8B D0 25 0F 0F 0F 0F 33 D0 C1 C0 08 0B C2 8B D0 25 33 33 33 33 33 D0 C1 C0 04 0B C2 8B D0 25
55 55 55 55 33 D0 C1 C0 02 0B C2
ep_only = false
[Crunch/PE v5:0]
signature = EB 15 03 ?? ?? ?? 06
ep_only = false
[Crunch/PE]
signature = 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85
ep_only = true
[Cruncher v1:0]
signature = 2E ?? ?? ?? ?? 2E ?? ?? ?? B4 30 CD 21 3C 03 73 ?? BB ?? ?? 8E DB 8D ?? ?? ?? B4
09 CD 21 06 33 C0 50 CB
ep_only = true
[CryExe v4:0]
signature = E9 J1 J1 E9 ?? ?? 31 ED EB ?? F5
ep_only = true
[CRYPACK v3:0]
signature = EB J3 06 1E 8C D8 05 ?? ?? 8E D8 33 DB 0E 07 33 FF BE ?? ?? 8A 07 26 ?? ?? 32 C4
88 07 47 3B FE
ep_only = true
[CrypKey -> Kenonic Controls (h)]
signature = 8B 1D ?? ?? 3E 00 83 FB
?? 02 00 00 A1 ?? ?? 3E 00 83 F8 01
8B 4D 0C 8B 13 33 D3 83 C3 04 03 C2
68 ?? ?? 3E 00 56 E8 ?? 16 00 00 A3
00 68 ?? ?? 3E 00 56 E8 ?? ?? 00 00
3E 00 68 ?? ?? 3E 00 56 E8 ?? ?? 00
?? 3E 00 68 ?? ?? 3E 00 56 E8
ep_only = true

00
74
49
??
A3
00

75
06
75
??
??
A3

0A
FF
F4
3E
??
??

E8
25
5B
00
3E
??

3C
14
C9
68
00
3E

00
??
C3
??
68
00

00
3E
56
??
??
68

00
00
68
3E
??
??

E8
C3
??
00
3E
??

??
C8
??
56
00
3E

0A
00
3E
E8
56
00

00
00
00
??
E8
56

00
00
E8
16
??
E8

8B
53
??
00
??
??

44
8B
16
00
00
??

24
5D
00
A3
00
00

08
08
00
??
A3
00

50
33
8B
??
??
A3

E8
C0
F0
3E
??
??

[CrypKey v5 - v6]
signature = E8 ?? ?? ?? ?? 58 83 E8 05 50 5F 57 8B F7 81 EF ?? ?? ?? ?? 83 C6 39 BA ?? ?? ??
?? 8B DF B9 0B ?? ?? ?? 8B 06
ep_only = true
[CrypKey V5:6:X -> Kenonic Controls Ltd:]
signature = E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 00 75 07 6A 00 E8
ep_only = true
[CrypKey V5:6:X DLL -> Kenonic Controls Ltd:]
signature = 8B 1D ?? ?? ?? ?? 83 FB 00 75 0A E8 ?? ?? ?? ?? E8
ep_only = true
[CrypKey V6:1X DLL -> CrypKey (Canada) Inc:]
signature = 83 3D ?? ?? ?? ?? 00 75 34 68 ?? ?? ?? ?? E8
ep_only = true
[CRYPT Version 1:7 (c) Dismember (COM)]
signature = 0E 17 9C 58 F6 C4 01 ?? ?? ?? ?? ?? B4 01 BE ?? ?? BF ?? ?? B9 ?? ?? 68 ?? ?? 68
?? ?? 68 ?? ?? 57 F3 A4 C3 B0 02 E6 21 60
ep_only = true
[CRYPT Version 1:7 (c) Dismember (EXE)]
signature = 0E 17 9C 58 F6 ?? ?? 74 ?? E9
ep_only = true

-46-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[CryptCom v1:1]
signature = BF ?? ?? 57 BE ?? ?? ?? B9 ?? ?? F3 A4 C3 8B ?? ?? ?? 8B ?? ?? ?? BF ?? ?? 57 BE
?? ?? ?? AD 33 C2 AB E2 ?? C3
ep_only = true
[CRYPTCOM]
signature = E9 J1 J1 BE 00 01 56 B9 ?? ?? C7 ?? ?? ?? C6 ?? ?? ?? 81 ?? ?? ?? 46 46 E2 ?? 31
F6 31 C9 C3
ep_only = true
[Crypter 3:1 -> SLESH]
signature = 68 FF 64 24 F0 68 58 58 58 58 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF
68
ep_only = true
[CRYPTEXE v1:04 (c) DOP]
signature = EB J3 8B DC EB ?? EA ?? ?? ?? ?? 01 EA 83 FC ?? 74 ?? EB
ep_only = true
[CrypteXeC v1:01]
signature = FD 25 ?? ?? E8 J1 J1 3E BA ?? ?? EC 0C ?? 26 EE ?? B9 ?? ?? 51 51 ?? 87 C9
ep_only = true
[Cryptic 2:0 -> Tughack]
signature = B8 00 00 40 00 BB ?? ?? ?? 00 B9 00 10 00 00 BA ?? ?? ?? 00 03 D8 03 C8 03 D1 3B
CA 74 06 80 31 ?? 41 EB F6 FF E3
ep_only = true
[Crypto-Lock 2:02
signature = 60 BE
88 07 47 01 DB 75
DB 11 C0 01 DB 73
ep_only = false

(Eng)
15 90
07 8B
EF 75

->
40
1E
09

Ryan Thian]
00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46
83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11
8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0

[Crypto-Lock 2:02
signature = 60 BE
88 07 47 01 DB 75
DB 11 C0 01 DB 73
ep_only = true

(Eng)
?? 90
07 8B
EF 75

->
40
1E
09

Ryan Thian]
00 8D BE ?? ?? FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46
83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11
8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0

[Crypto-Lock v2:02 (Eng) -> Ryan

signature = 60 BE ?? 90 40 00 8D
88 07 47 01 DB 75 07 8B 1E 83 EE
DB 11 C0 01 DB 73 EF 75 09 8B 1E
83 F0 FF 74 74 89 C5 01 DB 75 07
11 C9 75 20 41 01 DB 75 07 8B 1E
73 E4 83 C1 02 81 FD 00 F3 FF FF
E9 63 FF FF FF 90 8B 02 83 C2 04
B9 55 00 00 00 8A 07 47 2C E8 3C
86 C4 29 F8 80 EB E8 01 F0 89 07
ep_only = true

Thian]
BE ?? ??
FC 11 DB
83 EE FC
8B 1E 83
83 EE FC
83 D1 01
89 07 83
01 77 F7

FF
72
11
EE
11
8D
C7
80

FF
ED
DB
FC
DB
14
04
3F

57
B8
73
11
11
2F
83
01

83
01
E4
DB
C9
83
E9
75

CD
00
31
11
01
FD
04
F2

FF
00
C9
C9
DB
FC
77
8B

EB
00
83
01
73
76
F1
07

10
01
E8
DB
EF
0F
01
8A

90
DB
03
75
75
8A
CF
5F

90
75
72
07
09
02
E9
04

90
07
0D
8B
8B
42
4C
66

90
8B
C1
1E
1E
88
FF
C1

90
1E
E0
83
83
07
FF
E8

90
83
08
EE
EE
47
FF
08

8A
EE
8A
FC
FC
49
5E
C1

06
FC
06
11
11
75
89
C0

46
11
46
DB
DB
F7
F7
10

[Crypto-Lock v2:02 (Eng) -> Ryan Thian]

signature = 60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46
88 07 47
ep_only = true
[Crypto-Lock v2:02 (Eng) -> Ryan
signature = 60 BE 15 90 40 00 8D
88 07 47 01 DB 75 07 8B 1E 83 EE
DB 11 C0 01 DB 73 EF 75 09 8B 1E
83 F0 FF 74 74 89 C5 01 DB 75 07

Thian]
BE EB 7F
FC 11 DB
83 EE FC
8B 1E 83

FF
72
11
EE

FF
ED
DB
FC

57
B8
73
11

-47-

83
01
E4
DB

CD
00
31
11

FF
00
C9
C9

EB
00
83
01

10
01
E8
DB

90
DB
03
75

90
75
72
07

90
07
0D
8B

90
8B
C1
1E

90
1E
E0
83

90
83
08
EE

8A
EE
8A
FC

06
FC
06
11

46
11
46
DB

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

11 C9 75 20 41
73 E4 83 C1 02
E9 63 FF FF FF
B9 55 00 00 00
86 C4 29 F8 80
ep_only = true

01
81
90
8A
EB

DB
FD
8B
07
E8

75
00
02
47
01

07
F3
83
2C
F0

04 August 2015 15:14

8B
FF
C2
E8
89

1E
FF
04
3C
07

83
83
89
01

EE
D1
07
77

FC
01
83
F7

11
8D
C7
80

DB
14
04
3F

11
2F
83
01

C9
83
E9
75

01
FD
04
F2

DB
FC
77
8B

73
76
F1
07

EF
0F
01
8A

75
8A
CF
5F

09
02
E9
04

8B
42
4C
66

1E
88
FF
C1

83
07
FF
E8

EE
47
FF
08

FC
49
5E
C1

11
75
89
C0

DB
F7
F7
10

[CRYPToCRACk's PE Protector V0:9:2 -> Lukas Fleischer > Sign by fly]

signature = E8 01 00 00 00 E8 58 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 37 84 DB 75 33 8B F3
03 ?? ?? 81 3E 50 45 00 00 75 26
ep_only = true
[CRYPToCRACk's
signature = 5B
0F B7 46 18 8B
04 0F 85 DD 00
?? 72 ?? ?? ??
00 00 6B 65 72
ep_only = true

PE
81
C8
00
??
6E

Protector v0:9:3 -> Lucas Fleischer

E3 00 FF FF FF 66 81 3B 4D 5A 75 33
69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41
00 81 EB 00 01 00 00 75 BE 90 72 ??
00 00 00 00 00 00 00 00 00 00 00 00
65 6C 33 32 2E 64 6C 6C 00 C1 00 46

(h)]
8B F3
4B 69
?? ??
00 00
61 74

03
C9
??
00
61

73
DE
00
00
6C

3C
C0
00
00
45

81
00
00
00
78

3E
00
00
00
69

50
03
00
??
74

45
C1
00
??

00
75
00
??

00
09
7A
??

75
83
??
00

26
EC
??
00

[CRYPToCRACk's PE Protector V0:9:3 -> Lukas Fleischer > Sign by fly]

signature = 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26
0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1
ep_only = true
[CrypWrap vx:x]
signature = E8 B8 ?? ?? ?? E8 90 02 ?? ?? 83 F8 ?? 75 07 6A ?? E8 ?? ?? ?? ?? FF 15 49 8F 40
?? A9 ?? ?? ?? 80 74 0E
ep_only = true
[CSV v:01]
signature = E9 J1 J1 FC BE ?? ?? 8B FE B9 ?? ?? 51 56 57 B4 ?? 04 ?? AC ?? ?? 2A C4 32 C4 AA
E2 ?? 5F 5E 59
ep_only = true
[Cygwin32]
signature = 55 89 E5 83 EC 04 83 3D
ep_only = true
[DAEMON Protect v0:6:7]
signature = 60 60 9C 8C C9 32 C9 E3 0C 52 0F 01 4C 24 FE 5A 83 C2 0C 8B 1A 9D 61
ep_only = true
[DalKrypt 1:0 - by DalKiT]
signature = 68 ?? ?? ?? ?? 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14
03 43 81 FB ?? ?? ?? 00 72 EB FF E7
ep_only = true
[DBPE v1:53]
signature = 9C 55 57 56 52 51 53 9C FA E8 ?? ?? ?? ?? 5D 81 ED 5B 53 40 ?? B0 ?? E8 ?? ?? ??
?? 5E 83 C6 11 B9 27 ?? ?? ?? 30 06 46 49 75 FA
ep_only = true
[DBPE v2:10]
signature = EB
?? ?? ?? ?? ??
65 72 33 32 2E
6C 6C ?? 53 6C
ep_only = true

20
??
64
65

??
??
6C
65

??
9C
6C
70

??
55
??
??

??
57
4D
47

??
56
65
65

??
52
73
74

??
51
73
54

??
53
61
69

??
9C
67
63

??
E8
65
6B

??
??
42
43

??
??
6F
6F

??
??
78
75

??
??
41
6E

?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
5D 81 ED ?? ?? ?? ?? EB 58 75 73
?? 6B 65 72 6E 65 6C 33 32 2E 64
74

[DBPE v2:10]
signature = EB 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
-48-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? EB 58 75 73
65 72 33 32 2E 64 6C 6C ?? 4D 65 73 73 61 67 65 42 6F 78 41 ?? 6B 65 72 6E 65 6C
ep_only = true
[DBPE v2:10]
signature = 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB
FF 0C 24 71 01 E8 79 E0 7A 01 75 83 C4 04 9D EB 01 75 68 5F 20 40 ?? E8 B0 EF FF FF 72 03 73
01 75 BE
ep_only = true
[DBPE v2:33]
signature = EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 9C 6A 10 73
0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71
ep_only = true
[DBPE v2:33]
signature = EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 9C 6A 10 73
0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0
7A 01 75 83
ep_only = true
[DBPE vx:xx]
signature = EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED
ep_only = true
[DCREXE v2:0]
signature = E8 J4 J4 53 E8 ?? ?? 92 5B 83 ?? ?? FF E3 ?? FA 83 ?? ?? FB 5B 52 BA ?? ?? 5A EB
ep_only = true
[DCrypt Private 0:9b -> drmist]
signature = B9 ?? ?? ?? 00 E8 00 00 00 00 58 68 ?? ?? ?? 00 83 E8 0B 0F 18 00 D0 00 48 E2 FB
C3
ep_only = true
[deep-CRyPTer v0:1c]
signature = ?? E9 J1 J1 E8 ?? ?? 59 8B E9 81 ?? ?? ?? 81 ?? ?? ?? BE ?? ?? 8D ?? ?? ?? 66 ??
?? 66 ?? ?? 8D ?? ?? ?? 8B D7 8B DF
ep_only = true
[DEF 1:0 -> bart/xt]
signature = BE ?? ??
40 4A 75 FA 83 C6 28
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
ep_only = true

40
E2
00
00
00
00
00
00
00

00
E4
00
00
00
00
00
00
00

6A
68
00
00
00
00
00
00
00

??
??
00
00
00
00
00
00
00

59
??
00
00
00
00
00
00
00

80
40
00
00
00
00
00
00
00

7E
00
00
00
00
00
00
00

07
C3
00
00
00
00
00
00

00
00
00
00
00
00
00
00

74
00
00
00
00
00
00
00

11
00
00
00
00
00
00
00

8B
00
00
00
00
00
00
00

46
00
00
00
00
00
00
00

0C
00
00
00
00
00
00
00

05
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

40
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

8B
00
00
00
00
00
00
00

56
00
00
00
00
00
00
00

10
00
00
00
00
00
00
00

30
00
00
00
00
00
00
00

10
00
00
00
00
00
00
00

[DEF 1:0 -> bart/xt]

signature = BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10
40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true
[DEF 1:00 (Eng) -> bart/xt]
signature = BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10
-49-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false
[DEF v1:00 (Eng) -> bart/xt]
signature = BE ?? 01 40 00 6A
40 4A 75 FA 83 C6 28 E2 E4 68
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
ep_only = true

??
??
00
00
00
00
00

59
??
00
00
00
00
00

80
40
00
00
00
00
00

7E
00
00
00
00
00
00

07
C3
00
00
00
00
00

00
00
00
00
00
00
00

74
00
00
00
00
00
00

11
00
00
00
00
00
00

8B
00
00
00
00
00

46
00
00
00
00
00

0C
00
00
00
00
00

05
00
00
00
00
00

00
00
00
00
00
00

00
00
00
00
00
00

40
00
00
00
00
00

00
00
00
00
00
00

8B
00
00
00
00
00

56
00
00
00
00
00

10
00
00
00
00
00

30
00
00
00
00
00

10
00
00
00
00
00

[DEF v1:0]
signature = BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10
40 4A 75 FA 83 C6 28 E2 E4 68 ?? 10 40 00 C3
ep_only = false
[DEF v1:0]
signature = BE ?? 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46
ep_only = true
[dePACK -> deNULL]
signature = EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? 00 00 E8 ?? 00 00 00
ep_only = true
[dePACK V1:0->
signature = EB
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
ep_only = true

deNULL *
01 DD 60
?? ?? ??
?? ?? ??
?? ?? ??
?? ?? ??

Sign:By:fly]
68 00 ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??

[Dev-C++ 4:9:9:2 -> Bloodshed

signature = 55 89 E5 83 EC 08
26 00 00 00 00 55 89 E5 83 EC
B4 26 00 00 00 00 55 8B 0D ??
ep_only = true

68
??
??
??
??

??
??
??
??
??

??
??
??
??
??

00
??
??
??
??

00
??
??
??
??

E8
??
??
??
??

??
??
??
??
??

00
??
??
??
??

00
??
??
??
??

00
??
??
??
??

??
??
??
??
??

??
??
??
??
??

??
??
??
??
??

??
??
??
??
??

??
??
??
??
D2

??
??
??
??

??
??
??
??

??
??
??
??

Software]
C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4
08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D
?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D

[Dev-C++ v4]
signature = 55 89 E5 83 EC 08 83 C4 F4 6A ?? A1 ?? ?? ?? 00 FF D0 E8 ?? FF FF FF
ep_only = false
[Dev-C++ v5]
signature = 55 89 E5 83 EC 14 6A ?? FF 15 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? 00 00 00 00
ep_only = false
[DIET v1:00; v1:00d]
signature = BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC
ep_only = true
[DIET v1:00d]
signature = FC 06 1E 0E 8C C8 01 ?? ?? ?? BA ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? 00 00 00 00
ep_only = true
[DIET v1:02b; v1:10a; v1:20]
signature = BE ?? ?? BF ?? ?? B9 ?? ?? 3B FC 72 ?? B4 4C CD 21 FD F3 A5 FC
ep_only = true
-50-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[DIET v1:44; v1:45f]

signature = F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 BA ?? ?? 03 D0 52
ep_only = true
[Ding Boy's PE-lock Phantasm v0:8]
signature = 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 0D 39 40 00
ep_only = true
[Ding Boy's PE-lock Phantasm v1:0 / v1:1]
signature = 55 57 56 52 51 53 66 81 C3 EB 02 EB FC 66 81 C3 EB 02 EB FC
ep_only = true
[Ding Boy's PE-lock Phantasm v1:5b3]
signature = 9C 55 57 56 52 51 53 9C FA E8 00 00 00 00 5D 81 ED 5B 53 40 00 B0
ep_only = true
[Ding Boy's PE-lock v0:07]
signature = 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 23 35 40 00
ep_only = true
[diPacker 1:x -> diProtector Software]
signature = 0F 00 2D E9 01 00 A0 E3 68 01 00 EB 8C 00 00 EB 2B 00 00 EB 00 00 20 E0 1C 10 8F
E2 8E 20 8F E2 00 30 A0 E3 67 01 00 EB 0F 00 BD E8 00 C0 8F E2 00 F0 9C E5
ep_only = true
[diProtector 1:x -> diProtector Software]
signature = 01 00 A0 E3 14 00 00 EB 00 00 20 E0 44 10 9F E5 03 2A A0 E3 40 30 A0 E3 AE 00 00
EB 30 00 8F E5 00 20 A0 E1 3A 0E 8F E2 00 00 80 E2 1C 10 9F E5 20 30 8F E2 0E 00 00 EB 14 00
9F E5 14 10 9F E5 7F 20 A0 E3 C5 00 00 EB 04 C0 8F E2 00 F0 9C E5
ep_only = true
[DiskDupe (c) MSD Configuration file]
signature = 4D 53 44 20 44 61 74 61 20 56 65 72 73
ep_only = false
[DiskDupe (c) MSD Users file]
signature = 4D 53 44 20 55 73 65 72 73 20 56 65 72 73 69 6F 6E
ep_only = false
[DJoin v0:7 public (RC4 encryption) -> drmist]
signature = C6 05 ?? ?? 40 00 00 C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ??
00 ?? ?? ?? ?? ?? 00
ep_only = true
[DJoin v0:7 public (xor encryption) -> drmist]
signature = C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00
ep_only = true
[DOS/16M DOS Extender (c) Tenberry Software Inc 1987-1995]
signature = BF ?? ?? 8E C7 8E D7 BC ?? ?? 36 ?? ?? ?? ?? FF ?? ?? ?? 36 ?? ?? ?? ?? BE ?? ??
AC 8A D8 B7 00 ?? ?? 8B ?? ?? ?? 4F 8E C7
ep_only = true
[DOS32 v:3:3 DOS-Extender and Loader]
signature = 0E 1F FC 9C 5B 8B C3 80 F4 ?? 50 9D 9C 58 3A E7 75 ?? BA ?? ?? B4 09 CD 21 B4 4C
CD 21
ep_only = true
[DotFix Nice Protect 2:1 -> GPcH Soft]
signature = E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00
73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12
-51-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8
ep_only = true
[DotFix Nice Protect
signature = E9 FF 00
73 F6 33 C9 E8 64 00
C0 73 F7 75 3F AA EB
EB 1C 91 48 C1 E0 08
41 95 8B C5 B3 01 56
FF FF FF 13 C9 E8 E7
50 B8 ?? ?? ?? ?? 03
6A 40 68 00 10 00 00
ep_only = false

V2:1 -> GPcH Soft

00 00 60 8B 74 24
00 00 73 1C 33 C0
D4 E8 4D 00 00 00
AC E8 2C 00 00 00
8B F7 2B F0 F3 A4
FF FF FF 72 F2 C3
C5 FF 10 BB ?? ??
FF 74 24 2C 6A 00

* Sign:By:haggar]
24 8B 7C 24 28 FC
E8 5B 00 00 00 73
2B CB 75 10 E8 42
3D 00 7D 00 00 73
5E EB 8E 02 D2 75
2B 7C 24 28 89 7C
?? ?? 03 DD 83 C3
FF D0 89 44 24 1C

B2
23
00
0A
05
24
0C
61

80
B3
00
80
8A
1C
53
C3

33
02
00
FC
16
61
50

DB
41
EB
05
46
C3
B8

A4
B0
28
73
12
60
??

B3
10
AC
06
D2
B8
??

02
E8
D1
83
C3
??
??

E8
4F
E8
F8
33
??
??

6D
00
74
7F
C9
??
03

00
00
4D
77
41
??
C5

00
00
13
02
E8
03
FF

00
12
C9
41
EE
C5
10

[Dr:Web Virus-Finding Engine -> InSoft EDV-Systeme]

signature = B8 01 00 00 00 C2 0C 00 8D 80 00 00 00 00 8B D2 8B ?? 24 04
ep_only = true
[Dropper Creator V0:1 -> Conflict]
signature = 60 E8 00 00 00 00 5D 8D 05 ?? ?? ?? ?? 29 C5 8D 85 ?? ?? ?? ?? 31 C0 64 03 40 30
78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09
ep_only = false
[DSHIELD]
signature = 06 E8 ?? ?? 5E 83 EE ?? 16 17 9C 58 B9 ?? ?? 25 ?? ?? 2E
ep_only = true
[Dual's Cryptor -> dual]
signature = 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E
ep_only = true
[Dual's eXe 1:0]
signature = 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00
89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D
61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00
ep_only = true
[Dual's eXe 1:0]
signature = 55 8B
89 28 33 FF 8D 85
61 02 00 00 8D B5
3E 00 74 E7 50 56
02 00 6A 00 8D 85
8B 00 00 00 C7 85
03 00 00 50 6A 00
01 7E 02 EB 20 6A
FF 95 65 02 00 00
ep_only = true

EC
7D
7C
50
48
28
8D
40
FF

81
02
02
FF
03
03
85
8D
8D

EC
00
00
95
00
00
62
85
20

00
00
00
0E
00
00
03
73
03

05
8D
46
04
50
04
00
03
00

00
8D
80
00
68
00
00
00
00

00
08
3E
00
01
00
50
00
FF

E8
03
00
89
00
00
FF
50

00
00
74
03
00
8D
B5
8D

00
00
24
58
80
85
24
85

00
2B
56
83
FF
28
03
82

00
C8
FF
C3
95
03
00
03

5D
8B
95
04
69
00
00
00

81
9D
0A
EB
02
00
FF
00

ED
58
04
E3
00
50
95
50

0E
03
00
8D
00
8D
71
6A

00
00
00
85
83
85
02
00

00
00
46
24
BD
20
00
FF

00
E8
80
03
24
03
00
95

8D
1C
3E
00
03
00
83
61

85
02
00
00
00
00
BD
02

08
00
75
50
00
50
20
00

03
00
FA
68
00
8D
03
00

00
8D
46
1F
0F
85
00
6A

00
9D
80
00
84
6C
00
00

[dUP 2:x Patcher -> www:diablo2oo2:cjb:net]

signature = 8B CB 85 C9 74 ?? 80 3A 01 74 08 AC AE 75 0A 42 49 EB EF 47 46 42 49 EB E9
ep_only = false
[dUP2 -> diablo2oo2]
signature = E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ??
?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ??
?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75
ep_only = true
[dUP2 -> diablo2oo2]
signature = E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ??
?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ??
-52-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75 19 BE ?? ??
?? ?? 68 00 02 00 00 56 68
ep_only = true
[DxPack 1:0]
signature = 60 E8 ?? ?? ?? ?? 5D 8B FD 81 ED ?? ?? ?? ?? 2B B9 ?? ?? ?? ?? 81 EF ?? ?? ?? ??
83 BD ?? ?? ?? ?? ?? 0F 84
ep_only = true
[DxPack V0:86 -> Dxd]
signature = 60 E8 00 00 00 00 5D 8B FD 81 ED 06 10 40 00 2B BD 94 12 40 00 81 EF 06 00 00 00
83 BD 14 13 40 00 01 0F 84 2F 01 00 00
ep_only = true
[DzA Patcher 1:3 Loader]
signature = BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01
00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF
00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35
ep_only = false
[DZA Patcher v1:3
signature = EB 08
74 74 40 00 83 EA
00 EB F4 93 89 85
ep_only = true

->
35
10
7C

DZA]
48 34 30 4C 31 4E 00 60 E8 00 00 00 00 5D 8B D5 81 ED 44 73 40 00 2B 95
89 95 70 74 40 00 8B 44 24 20 25 00 00 FF FF 80 38 4D 74 07 2D 00 00 01
74 40 00 8D BD 8C 74 40 00 E8 83 00 00 00 89 85 80 74 40 00

[DZA Patcher v1:3

signature = EB 08
74 74 40 00 83 EA
00 EB F4 93 89 85
40 00 E8 72 00 00
00 00 89 85 88 74
52 52 FF 95 80 74
11 83 C7 06 EB E9
B7 43 3C 03 D8 8B
FE 97 AC 0A C0 75
ep_only = true

->
35
10
7C
00
40
40
E8
5B
07

DZA]
48 34
89 95
74 40
89 85
00 8B
00 8D
00 00
78 03
80 3F

30
70
00
84
85
BD
00
DA
00

4C
74
8D
74
78
C0
00
0B
74

31
40
BD
40
74
74
5D
FF
0B

4E
00
8C
00
40
40
81
74

00
8B
74
8D
00
00
ED
40

60
44
40
BD
03
8B
F5
8B

E8
24
00
F0
85
0F
73
73

00
20
E8
73
70
E3
40
20

00
25
83
40
74
13
00
03

00
00
00
00
40
8A
6A
F2

00
00
00
57
00
5F
00
8B

5D
FF
00
FF
99
05
FF
4B

8B
FF
89
D0
8D
8A
95
18

D5
80
85
8D
8D
01
88
53

81
38
80
BD
6C
3A
74
33

ED
4D
74
99
74
C3
40
DB

44
74
40
74
40
75
00
AD

73
07
00
40
00
FA
61
03

40
2D
8D
00
51
8A
C3
C2

00
00
BD
E8
52
57
8B
56

2B
00
A4
58
52
04
D3
57

95
01
74
00
50
88
0F
87

[DzA Patcher v1:3

signature = BF 00
00 00 85 C0 75 1C
00 00 00 99 68 58
E8 C2 00 00 00 E8
74 B1 60 6A 00 6A
01 53 51 FF 35 48
40 00 E8 4B 00 00
00 E8 4B 00 00 00
FF FF FF 25 70 30
ep_only = false

Loader]
40 40 00
99 52 52
20 40 00
C8 FF FF
04 6A 01
20 40 00
00 6A 03
61 83 C7
40 00 FF

99
57
52
FF
51
E8
E8
06
25

68
52
52
BF
FF
75
4A
FF
78

48
E8
68
40
35
00
00
35

20
CB
63
40
48
00
00
4C

40
00
10
40
20
00
00
20

00
00
40
00
40
61
EB
40

68
00
00
FF
00
A0
A2
00

00
FF
52
35
E8
5C
60
E8

20
35
52
4C
75
20
8D
1E

40
4C
E8
20
00
40
5F
00

00
20
DB
40
00
00
04
00

52
40
00
00
00
8A
6A
00

52
00
00
E8
61
5F
00
6A

52
E8
00
A1
60
05
6A
03

52
D2
6A
00
BB
3A
01
E8

52
00
FF
00
5C
C3
53
1D

52
00
FF
00
20
74
51
00

52
00
35
8B
40
14
FF
00

57
6A
48
0F
00
FF
35
00

E8
00
20
83
6A
35
48
E9

15
E8
40
F9
00
4C
20
72

01
BF
00
00
6A
20
40
FF

[E language]
signature = E8 06 00 00 00 50 E8 ?? 01 00 00 55 8B EC 81 C4 F0 FE FF FF
ep_only = true
[E:S:O: Eclipse Operating System v:2:08 + DOS Extender]
signature = 8C C8 8E D8 BA ?? ?? E8 ?? ?? BB ?? ?? 8C C0 2B D8 B4 4A CD 21 BA ?? ?? 73 ?? E9
ep_only = true
[E2C by DoP]
signature = BE ?? ?? BF ?? ?? B9 ?? ?? FC 57 F3 A5 C3
ep_only = true

-53-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[EEXE Version 1:12]

signature = B4 30 CD 21 3C 03 73 ?? BA 1F 00 0E 1F B4 09 CD 21 B8 FF 4C CD 21
ep_only = true
[Elicense System V4:0:0:0 -> ViaTech Inc]
signature = 00 00 00 00 63 79 62 00 65 6C 69 63 65 6E 34 30 2E 64 6C 6C 00 00 00 00
ep_only = false
[Embed PE v1:13 -> cyclotron]
signature = 83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68
ep_only = true
[EmbedPE 1:13 -> cyclotron]
signature = 83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00
ep_only = true
[EmbedPE 1:13 -> cyclotron]
signature = 83 EC 50 60 68 5D
63 05 3C 71 B8 5E 97 7C 36 7E
D3 46 86 2D 10 68 93 83 5C 46
97 7C BA 1D 96 DD 07 F8 FD D2
61 B9 D8 6F 96 3B D1 07 32 24
7A 2B 94 54 64 8A 83 05 68 D7
51 64 73 A3 F1 4E 92 25 CB 80
BC CA AA 70 E2 AB 39 AE 3B 5A
BC 83 54 82 A3 97 B1 1A B3 83
ep_only = true

B9
32
4D
3A
DD
5E
8D
6F
54

52
7C
43
98
07
2D
99
9B
46

5A
08
9B
83
05
C6
54
15
83

E8
4F
8C
CC
8E
B7
46
BD

2F
06
D6
46
CB
57
B0
25

99
51
7C
99
6F
00
E1
98

00
64
BB
9D
A1
B3
D3
25

00
10
99
DF
07
E8
46
30

DC
A3
69
6F
5C
3C
A5
4C

99
F1
97
89
62
71
2D
AD

F3
4E
71
92
20
B8
10
7D

57
CF
2A
54
E0
3C
68
55

05
25
2F
46
DB
97
B6
07

68
CB
A3
9F
BA
7C
83
A8

B8
80
38
94
9D
36
91
A3

5E
D2
6B
43
83
19
46
AC

2D
99
33
CC
54
32
F2
0A

C6
54
A3
41
46
7C
DF
C1

DA
46
F5
43
E6
08
64
BD

FD
ED
0B
9B
83
2A
FD
54

48
E1
85
8C
51
06
D1
72

[EmbedPE 1:13 -> cyclotron]

signature = 83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48
63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1
D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33
ep_only = true
[EmbedPE V1:00-V1:24
signature = 00 00 00
00 00 00 00 00 00 00
00 00 ?? ?? ?? ?? ??
00 00 00 47 65 74 50
6E 64 6C 65 41 00 00
ep_only = false

->
00
00
??
72
00

cyclotron >
?? ?? ?? ??
00 00 00 00
?? ?? ?? ??
6F 63 41 64
4C 6F 61 64

Sign by fly]
00 00 00 00 00
00 00 00 00 00
?? ?? 00 00 00
64 72 65 73 73
4C 69 62 72 61

[EmbedPE V1:00-V1:24
signature = 00 00 00
00 00 00 00 00 00 00
00 00 ?? ?? ?? ?? ??
ep_only = true

->
00
00
??

cyclotron]
?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00
00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00
?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E

00
??
00
00
72

00
??
4B
00
79

00
??
45
00
41

??
??
52
47
00

??
??
4E
65
00

??
??
45
74
00

??
??
4C
4D
00

??
??
33
6F
00

??
??
32
64
00

??
??
2E
75
00

[EmbedPE v1:24 -> cyclotron]

signature = 83 EC 50 60 68 ?? ?? ?? ?? E8 CB FF 00 00
ep_only = true
[EmbedPE V1:X -> cyclotron]
signature = 83 EC 50 60 68 ?? ?? ?? ?? E8 ?? ?? 00 00
ep_only = true
[Encapsulated Postscript graphics file v2:0 EPSF-1:2]
signature = 25 21 50 53 2D 41 64 6F 62 65 2D 32 2E 30 20 45 50 53 46 2D 31 2E 32
ep_only = false
[Encapsulated Postscript graphics file v3:0 EPSF-3:0]
signature = 25 21 50 53 2D 41 64 6F 62 65 2D 33 2E 30 20 45 50 53 46 2D 33 2E 30
-54-

??
??
64
6C
00

00
??
6C
65
00

00
00
6C
48

00
00
00
61

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = false
[Encriptor v1:00c]
signature = EB J3 B9 ?? ?? BE ?? ?? BF ?? ?? AC D0 C8 AA E2 ?? BE ?? ?? BF ?? ?? AC AA
ep_only = true
[ENcryptCOM v3:06 (???)]
signature = E9 J1 J1 B4 30 CD 21 3C 02 77 01 C3
ep_only = true
[Encrypted by? RSCC/286 v1:01]
signature = FE 52 53 43 43 2F 31 2E 30 31 FE
ep_only = false
[Encrypted by? RSCC/286 v1:02]
signature = FE 52 53 43 43 2F 31 2E 30 32 FE
ep_only = false
[EncryptPE 1:2003:5:18 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 79
ep_only = true
[EncryptPE 2:2004:8:10 - 2:2005:3:14 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 7A
ep_only = true
[EncryptPE V1:2003:3:18-V1:2003:5:18 -> WFS * Sign:By:fly]
signature = 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00
?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00
72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C
46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69
55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C
00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50
00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00
ep_only = true

00
00
??
47
65
65
6F
72

00
00
??
65
41
77
73
6F

00
00
??
74
00
4F
65
63

00
00
??
53
00
66
48
41

00
00
??
79
00
46
61
64

00
00
??
73
43
69
6E
64

00
00
??
74
72
6C
64
72

00
??
??
65
65
65
6C
65

00
??
??
6D
61
00
65
73

00
??
??
44
74
00
00
73

??
??
??
69
65
00
00
00

[EncryptPE V1:2003:3:18-V1:2003:5:18 -> WFS]

signature = 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ??
?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true
[EncryptPE V2:2004:6:16-V2:2006:6:30 -> WFS > Sign by fly]
signature = 60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ??
?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true
[EncryptPE V2:2004:6:16-V2:2006:6:30 -> WFS * Sign:By:fly]
signature = 60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00
?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00
72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C
46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69
55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C
00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50
00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00
ep_only = true

00
00
??
47
65
65
6F
72

00
00
??
65
41
77
73
6F

00
00
??
74
00
4F
65
63

00
00
??
53
00
66
48
41

00
00
??
79
00
46
61
64

00
00
??
73
43
69
6E
64

00
00
??
74
72
6C
64
72

00
??
??
65
65
65
6C
65

00
??
??
6D
61
00
65
73

00
??
??
44
74
00
00
73

??
??
??
69
65
00
00
00

[EncryptPE V2:2004:6:16-V2:2006:6:30 -> WFS]

signature = 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ??
-55-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true
[EncryptPE V2:2006:1:15 -> WFS]
signature = 45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 36 2E 31 2E 31 35
ep_only = false
[EncryptPE V2:2006:7:10 -> WFS]
signature = 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00
ep_only = false
[EncryptPE V2:2006:7:10-V2:2006:10:25 -> WFS
signature = 60 9C 64 FF 35 00 00 00 00 E8 73
?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64
41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41
70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77
65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73
62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F
72 6F 63 65 73 73 00 00 00 00
ep_only = true

* Sign:By:fly]
01 00 00 00 00
00 00 00 00 00
?? ?? ?? ?? ??
6C 6C 00 00 00
00 00 00 43 72
4F 66 46 69 6C
65 48 61 6E 64
63 41 64 64 72

00
00
??
47
65
65
6C
65

00
00
??
65
61
00
65
73

00
00
??
74
74
00
00
73

00
00
??
54
65
00
00
00

00
00
??
65
46
55
00
00

00
00
??
6D
69
6E
4C
00

00
00
??
70
6C
6D
6F
45

00
??
??
50
65
61
61
78

00
??
??
61
4D
70
64
69

00
??
??
74
61
56
4C
74

??
??
??
68
70
69
69
50

[EncryptPE V2:2006:7:10-V2:2007:04:11 -> WFS]

signature = 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ??
?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true
[EncryptPE V2:2007:12:1
signature = 00 00 00 00
74 50 45 20 56 32 2E 32
20 57 46 53 00 00 48 6F
6F 6D 00 00 00 00 00 45
00 00 00 00 00 00 00 00
ep_only = false

->
00
30
6D
4D

WFS *
00 00
30 37
65 50
61 69

Sign:By:fly]
00 00 00 00 00
2E 31 32 2E 31
61 67 65 3A 20
6C 3A 20 77 66

00
2C
77
73

00
20
77
23

00
43
77
65

00
6F
2E
6E

[EncryptPE V2:2007:4:11-V2:2007:12:1 -> WFS * Sign:By:fly]

signature = 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00
?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00
41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72
70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C
65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64
62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72
72 6F 63 65 73 73 00 00 00 00 00 00
ep_only = true

45
70
65
63

50
79
6E
72

45
72
63
79

3A
69
72
70

20
67
79
74

45
68
70
70

6E
74
74
65

63
20
70
2E

72
28
65
63

79
43
2E
6F

70
29
63
6D

00
00
??
47
65
65
6C
65

00
00
??
65
61
00
65
73

00
00
??
74
74
00
00
73

00
00
??
54
65
00
00
00

00
00
??
65
46
55
00
00

00
00
??
6D
69
6E
4C
00

00
00
??
70
6C
6D
6F
45

00
??
??
50
65
61
61
78

00
??
??
61
4D
70
64
69

00
??
??
74
61
56
4C
74

??
??
??
68
70
69
69
50

A0
2B
9C
DF

72
72
DD
3E

A4
36
9C
0E

59
1C
E1
38

A8
A5
9C
0C

B0
33
E5
49

5C
A9
89
10

E8
9C
E9
27

39
AD
51
80

D5
9C
0B
51

39
B1
C4
A1

[Enigma protector
signature = 60 72
E4 39 F1 31 F9 5C
9C B5 9C B9 9C BD
80 BC 7E 35 09 37
8E 3A A3 C8 AE 3B
ep_only = false

1:10 (unregistered)]
80 72 88 72 8C 72 90
3D 58 CA 5F 56 B1 2D
9C C1 9C C5 9C C9 9C
E7 C9 3D C9 45 C9 4D
1C 35

[Enigma protector
signature = 60 72
E4 39 F1 31 F9 5C
9C B5 9C B9 9C BD
ep_only = false

1:10 (unregistered)]
80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39
3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1
9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89

72
20
CD
74

94
7A
9C
92

72
2E
D1
BA

98
30
9C
E4

-56-

72
16
D5
E9

9C
32
9C
24

72
72
D9
6B

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

[Enigma protector
signature = 60 E8
?? ?? ?? ?? ?? ??
FF 35 60 E8 24 00
ep_only = false

04 August 2015 15:14

1:10/1:11 -> Vladimir Sukhov]

00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02
00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31

[Enigma Protector 1:1X-1:3X -> Sukhov Vladimir & Serge N: Markin]

signature = 55 8B EC 83 C4 F0 B8 00 10 40 00 E8 01 00 00 00 9A 83 C4 10 8B E5 5D E9
ep_only = true
[Enigma Protector
signature = 00 00
65 65 00 00 00 47
41 64 64 72 65 73
ep_only = true

1:X -> Sukhov Vladimir & Serge N: Markin]

00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72
65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63
73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61

[Enigma Protector
signature = 60 E8
?? ?? ?? ?? ?? ??
?? ?? 60 E8 24 00
08 EB 02 ?? ?? 89
64 89 20 EB 02 ??
ep_only = true

V1:0X
00 00
?? ??
00 00
C4 61
?? 89

->
00
??
00
EB
00

Sukhov Vladimir *
00 5D 83 ?? ?? 81
?? ?? ?? ?? ?? ??
00 ?? EB 02 ?? ??
2E ?? ?? ?? ?? ??
9A 64 8F 05 00 00

Sign:By:fly]
ED ?? ?? ?? ??
?? ?? ?? ?? ??
8B 44 24 0C 83
?? ?? EB 01 ??
00 00 EB 02 C1

??
E8
80
31
??

??
01
B8
C0
58

??
00
00
EB
61

??
00
00
01
EB

??
00
00
??
01

??
??
03
64

??
83
31
FF

??
C4
C0
30

??
04
C3
EB

??
EB
83
01

??
02
C0
??

[ENIGMA Protector V1:1 -> Sukhov Vladimir]

signature = 60 E8 00 00 00 00 5D 83 ?? ?? 81
ep_only = true
[ENIGMA Protector V1:1 CracKed By< shoooo & fly -> Sukhov Vladimir]
signature = 60 E8 00 00 00 00 5D 83 C5 FA 81
ep_only = true
[ENIGMA Protector V1:1-V1:2 -> Sukhov Vladimir]
signature = 60 E8 00 00 00 00 5D 83 ED 06 81
ep_only = true
[ENIGMA Protector
signature = 60 E8
?? ?? ?? ?? ?? ??
FF 35 60 E8 24 00
ep_only = true

V1:12-> Sukhov
00 00 00 00 5D
?? ?? ?? ?? ??
00 00 00 00 FF

[Enigma Protector
signature = 60 E8
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
00 00 00 00 00 00
E9 04 00 00 00 ??
?? 30 10 40 49 0F
ep_only = true

V1:31
00 00
?? ??
00 00
00 00
?? ??
85 F6

[Enigma Protector
signature = 00 00
65 65 00 00 00 47
41 64 64 72 65 73
72 61 72 79 41 00
65 79 00 00 00 53
41 00 00 00 53 68
ep_only = false

V1:X -> Sukhov

00 56 69 72 74
65 74 4D 6F 64
73 00 00 00 45
00 00 4D 65 73
79 73 46 72 65
65 6C 6C 45 78

Build
00 00
?? ??
00 00
8A 84
?? B8
FF FF

Vladimir]
83 C5 FA 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02
EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31

20070615
5D 81 ED
?? ?? ??
00 00 00
24 28 00
?? ?? ??
FF E9 04

Dll -> Sukhov Vladimir & Serge N: Markin * Sign:By:fly]

06 00 00 00 81 ED ?? ?? ?? ?? E9 49 00 00 00 ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 80 F8 01 0F 84 07 00 00 00 B8 ?? ?? ?? ?? FF E0
?? 03 C5 81 C0 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ??
00 00 00

Vladimir
75 61 6C
75 6C 65
78 69 74
73 61 67
65 53 74
65 63 75

& Serge N: Markin

41 6C 6C 6F 63 00
48 61 6E 64 6C 65
50 72 6F 63 65 73
65 42 6F 78 41 00
72 69 6E 67 00 00
74 65 41 00 00

* Sign:By:fly]
00 00 56 69 72
41 00 00 00 47
73 00 00 00 4C
00 00 52 65 67
00 43 72 65 61

[ENIGMA Protector V1:X -> Sukhov Vladimir]

signature = 45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31
-57-

74
65
6F
43
74

75
74
61
6C
65

61
50
64
6F
46

6C
72
4C
73
6F

46
6F
69
65
6E

72
63
62
4B
74

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = false
[EP 1:0]
signature = 50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00
03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE
8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1
ep_only = false
[EP v1:0]
signature = 50
03 00 3C 40 D2
8B 30 AC 30 D0
?? ?? F3 00 C3
ep_only = true

83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00
33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE
C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1 C0 30 ?? 68
AA

[EP v2:0]
signature = 6A ?? 60 E9 01 01
ep_only = true
[EPW v1:2]
signature = 06 57 1E 56 55 52 51 53 50 2E ?? ?? ?? ?? 8C C0 05 ?? ?? 2E ?? ?? ?? 8E D8 A1 ??
?? 2E
ep_only = true
[EPW v1:30]
signature = 06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 83 C0 10 2E
ep_only = true
[Erdas LAN/GIS Image graphics format]
signature = 48 45 41 44 37 34 00 00 03 00
ep_only = false
[Escargot 0:1 - by ueMeat]
signature = EB 08 28 65 73 63 30 2E 31 29 60 68 2B ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00
00 00 00 B8 5C ?? ?? ?? 8B 00 FF D0 50 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B
C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B
ep_only = true
[Escargot V0:1 -> ++Meat]
signature = EB 04 40 30 2E 31 60 68 61
ep_only = true
[Exact Audio Copy -> (UnknownCompiler)]
signature = E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00
?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true
[Exact Audio Copy
signature = E8 ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? 00 ??
?? ?? ?? 00 ?? ??
?? ?? 00 ?? ?? ??
ep_only = true

->
??
??
??
??
??
??

(UnknownCompiler)]
?? 00 31 ED 55 89 E5
?? ?? 00 ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? 00
00 ?? ?? ?? ?? ?? ??

81
??
??
??
??
??

EC
??
??
??
??
??

??
??
??
??
??
??

00
??
??
??
??
00

00
??
??
??
00

00
??
??
00
??

8D
??
??
??
??

BD
??
??
??
??

??
??
??
??
??

FF
??
??
??
00

FF
??
??
00
??

FF
??
??
??
??

B9
??
??
??
??

??
??
??
??
??

00
??
??
??
00

00
??
??
??
??

00
??
??
??
??

[Exact Audio Copy]

signature = E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00
ep_only = true
[Excalibur 1:03 -> forgot]
signature = E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00
-58-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[Excalibur V1:03 -> forgot > Sign by fly]
signature = E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00
00 00 00 E8 58 61 EB 39
ep_only = true
[eXcalibur v1:03 -> forgot/us
signature = E9 00 00 00 00 60
00 00 00 E8 58 61 EB 39 20 45
74 2F 75 53 2F 44 46 43 47 20
20 0D 0A 60 9C 9C 6A 63 73 0B
E8 FF 0C 24 71 01 E8 79 E0 7A
00 9C 6A 63 73 0B EB 02 69 69
71 01 69 79 E0 7A 01 69 83 C4
06 00 00 00 69 69 73 F7 69 69
9D EB 01 69 E8 B4 02 00 00 E8
ep_only = true

(h)]
E8 14
78 63
20 20
EB 02
01 E8
E8 06
04 9D
83 C4
60 E8

[eXcalibur v1:03 -> forgot/us

signature = E9 00 00 00 00 60
00 00 00 E8 58 61 EB 39 20 45
74 2F 75 53 2F 44 46 43 47 20
ep_only = false

(h)]
E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00
78 63 61 6C 69 62 75 72 20 28 63 29 20 62 79 20 66 6F 72 67 6F
20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

00
61
20
E8
83
00
EB
04

00
6C
20
E8
C4
00
01
EB

00
69
20
E8
04
00
69
02

5D
62
20
06
9D
69
E8
69

81
75
20
00
EB
69
E7
69

ED
72
20
00
01
73
02
FF

00
20
20
00
E8
F7
00
0C

00
28
20
E8
E8
69
00
24

00
63
20
E8
01
69
E8
71

00
29
20
73
00
83
9C
01

6A
20
20
F7
00
C4
6A
69

45
62
20
E8
00
04
63
79

E8
79
20
E8
E9
EB
73
E0

A3
20
20
83
5D
02
0B
7A

00
66
20
C4
81
69
EB
01

00
6F
20
04
ED
69
02
69

00
72
20
EB
AE
FF
69
83

68
67
20
02
28
0C
69
C4

00
6F
20
E8
40
24
E8
04

[Exe Guarder 1:8 -> Exeicon:com (h)]

signature = 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00
74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03
06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89
ep_only = false
[Exe Guarder v1:8
signature = 55 8B
74 07 2D 00 10 00
06 8B 40 78 03 06
18 8B C8 49 85 C9
DF 83 C3 04 81 3B
73 73 75 1C 8B D0
04 40 49 75 A9 8B
8B 06 50 FF 53 08
50 8B 06 50 FF 53
00 50 8B 06 50 FF
ep_only = true

->
EC
00
8B
72
72
03
5D
89
08
53

Exeicon:com
83 C4 D0 53
EB F1 89 45
C8 8B 51 20
5A 41 33 C0
6F 63 41 75
D2 03 55 F0
F4 8D 83 A1
43 10 8D 83
89 43 18 8D
08

(h)]
56 57
FC E8
03 16
8B D8
33 8B
0F B7
00 00
BA 00
83 D7

8D
C8
8B
C1
DF
12
00
00
00

75
FF
59
E3
83
C1
50
00
00

FC
FF
24
02
C3
E2
8B
50
00

8B
FF
03
03
08
02
06
8B
50

44
2D
1E
DA
81
03
50
06
8B

24
B2
89
8B
3B
55
FF
50
06

30
04
5D
3B
64
EC
53
FF
50

25
00
F0
03
64
8B
08
53
FF

00
00
8B
3E
72
12
89
08
53

00
89
59
81
65
03
43
89
08

FF
45
1C
3F
75
16
0C
43
89

FF
F4
03
47
26
8B
8D
14
43

81
8B
1E
65
83
4D
83
8D
1C

38
06
89
74
C7
F4
AE
83
8D

4D
8B
5D
50
0C
89
00
C6
83

5A
40
EC
75
66
51
00
00
E0

90
3C
8B
40
81
08
00
00
00

00
03
41
8B
3F
EB
50
00
00

[EXE joiner -> Amok]

signature = A1 14 A1 40 00 C1 E0 02 A3 18 A1 40
ep_only = true
[Exe Locker 1:0 -> IonIce]
signature = E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00
ep_only = true
[Exe Locker v1:0 -> IonIce]
signature = E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 3E 8F 85 6C 00 00 00 3E 8F 85 68
00 00 00 3E 8F 85 64 00 00 00 3E 8F 85 60 00 00 00 3E 8F 85 5C 00 00 00 3E 8F 85 58 00 00 00
3E 8F 85 54 00 00
ep_only = true
[EXE Manager Version 3:0 1994 (c) Solar Designer]
signature = B4 30 1E 06 CD 21 2E ?? ?? ?? BF ?? ?? B9 ?? ?? 33 C0 2E ?? ?? 47 E2
ep_only = true

-59-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[EXE Packer v7:0 by TurboPower Software]

signature = EB J3 1E 06 8C C3 83 ?? ?? 0E 1F 01 ?? ?? ?? 01 ?? ?? ?? BE ?? ?? B9 ?? ?? FC AD
3B C1 74
ep_only = true
[EXE Packer v7:0 by TurboPower Software]
signature = 1E 06 8C C3 83 ?? ?? 2E ?? ?? ?? ?? B9 ?? ?? 8C C8 8E D8 8B F1 4E 8B FE
ep_only = true
[EXE Shield 0:5 -> Smoke]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D
81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09
E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40
ep_only = false
[Exe Shield 2:7b]
signature = EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01
85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40
ep_only = false
[EXE Shield v0:1b - v0:3b; v0:3 -> SMoKE]
signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05
ep_only = true
[EXE Shield V0:1b-V0:8 -> SMoKE]
signature = E8 04 00 00 00 83 ?? ?? ?? 5D EB 05 45 55 EB 04 ?? EB F9 ?? C3 E8 00 00 00 00 5D
EB 01 ?? 81 ?? ?? ?? ?? ?? EB 02 ?? ?? 8D ?? ?? ?? ?? ?? EB 02 ?? ?? BA 9F 11 00 00 EB 01 ??
8D ?? ?? ?? ?? ?? 8B 09 E8 14 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? 58 40 50 C3
ep_only = true
[EXE Shield V0:5 -> Smoke]
signature = E8 04 00 00 00
81 ED BC 1A 40 00 EB 01 00
E8 14 00 00 00 83 EB 01 00
46 EB 01 00 D0 C8 E8 14 00
5B 43 53 C3 EB 01 00 32 C2
43 53 C3 88 07 EB 01 00 47
ep_only = true

83
8D
8B
00
E8
4A

60
B5
FE
00
0B
75

EB
46
E8
83
00
B4

0C
1B
00
EB
00
90

5D
40
00
01
00

EB
00
00
00
00

05
BA
00
2A
32

45
B3
58
C2
C1

55
0A
83
E8
EB

EB
00
C0
00
01

04
00
07
00
00

B8
EB
50
00
C0

EB
01
C3
00
C0

F9
00
00
5B
02

00
8D
EB
83
EB

C3
8D
04
C3
09

E8
F9
58
07
2A

00
25
40
53
C2

00
40
50
C3
5B

00
00
C3
00
EB

00
8B
8A
EB
01

5D
09
06
04
00

[EXE Shield V0:6 -> SMoKE]

signature = E8 04 00 00 00
81 ED D4 1A 40 00 EB 01 00
E8 14 00 00 00 83 EB 01 00
46 EB 01 00 D0 C8 E8 14 00
5B 43 53 C3 EB 01 00 32 C2
43 53 C3 88 07 EB 01 00 47
ep_only = true

83
8D
8B
00
E8
4A

60
B5
FE
00
0B
75

EB
5E
E8
83
00
B4

0C
1B
00
EB
00
90

5D
40
00
01
00

EB
00
00
00
00

05
BA
00
2A
32

45
A1
58
C2
C1

55
0B
83
E8
EB

EB
00
C0
00
01

04
00
07
00
00

B8
EB
50
00
C0

EB
01
C3
00
C0

F9
00
00
5B
02

00
8D
EB
83
EB

C3
8D
04
C3
09

E8
FF
58
07
2A

00
26
40
53
C2

00
40
50
C3
5B

00
00
C3
00
EB

00
8B
8A
EB
01

5D
09
06
04
00

[EXE Shield V0:6 -> SMoKE]

signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D
81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09
E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40
ep_only = false
[Exe Shield v1:7]
signature = EB 06 68 90 1F 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 3F 90
ep_only = true
[Exe Shield v2:7]
-60-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = EB 06 68 F4 86 06 00 C3 9C 60 E8 02 00 00
ep_only = true
[Exe Shield v2:7b]
signature = EB 06 68
FC 81 EB 3F 90 40 00
85 DA 90 40 00 01 85
90 40 00 53 8B C3 8B
A5 8B FB C3 BD 00 00
C8 5E 5F 8B C1 C1 F9
00 00 40 00 00 D0 5A
40 07 56 03 76 EE 0F
10 12 1B FF B5 51 29
ep_only = true

40
87
DE
FB
00
02
00
18
EE

85
DD
90
2D
00
F3
00
83
10

06
8B
40
AC
8B
A5
10
C6
22

00
85
00
90
F7
03
5B
14
95

C3
E6
01
40
83
C8
00
12

9C
90
85
00
C6
83
87
35

60
40
E2
89
54
E1
DB
97

E8
00
90
85
81
03
87
80

02
01
40
AD
C7
F3
DB
8D

00
85
00
90
FF
A4
87
BD

00
33
BB
40
10
EB
DB
63

00
90
7B
00
00
26
87
39

33
40
11
8D
00
D0
DB
0D

C0
00
00
B5
56
12
87
B9

8B
66
00
AC
57
5B
DB
06

C4
C7
03
90
57
00
87
86

83
85
9D
40
56
AC
DB
02

C0
30
EA
00
FF
12
87
07

04
90
90
B9
95
5B
DB
F3

93
40
40
40
DA
00
8B
A5

8B
00
00
04
90
48
0E
6A

E3
90
03
00
40
12
B5
04

8B
90
9D
00
00
5B
E6
68

5B
01
E6
F3
8B
00
90
06

[Exe Shield v2:9]

signature = 60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC
?? ?? ?? F8
ep_only = true
[Exe Shield vx:x]
signature = 65 78 65 73 68 6C 2E 64 6C 6C C0 5D 00
ep_only = true
[EXE Stealth 2:5]
signature = 60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F
6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88
1E 40 00 8B F7 AC
ep_only = false
[EXE Stealth 2:73]
signature = EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00
EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00
5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02
ep_only = false
[EXE Stealth 2:74]
signature = EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00
60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7
56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9
ep_only = false
[Exe Stealth 2:75a -> WebtoolMaster]
signature = EB 58 53 68 61 72 65 77 61
6C 74 68 2C 20 63 6F 6E 74 61 63 74 20
74 65 72 2E 63 6F 6D 20 2D 20 77 77 77
00 90 60 90 E8 00 00 00 00 5D 81 ED F7
83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78
96 0C 00 00 90 8D BD 74 28 40 00 8B F7
ep_only = true

72
73
2E
27
43
AC

65
75
77
40
27

2D
70
65
00
65

56
70
62
B9
EB

65
6F
74
15
00

72
72
6F
00
81

73
74
6F
00
C1

69
40
6C
00
10

6F
77
6D
83
25

6E
65
61
C1
94

20
62
73
04
00

45
74
74
83
81

78
6F
65
C1
E9

65
6F
72
01
63

53
6C
2E
EB
85

74
6D
63
05
00

65
61
6F
EB
00

61
73
6D
FE
B9

[Exe Stealth 2:75a -> WebtoolMaster]

signature = EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61
6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73
74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72
ep_only = true
[EXE Stealth v1:1]
signature = 60 E8 00 00 00 00 5D 81 ED FB 1D 40 00 B9 7B 09 00 00 8B F7 AC
ep_only = true
[EXE Stealth v2:71]
-61-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED B0 27 40
ep_only = true
[EXE Stealth v2:72]
signature = EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20
ep_only = true
[EXE Stealth v2:74 -> WebToolMaster]
signature = EB 00 EB 17 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
60 90 E8 00 00 00 00 5D
ep_only = true
[EXE Stealth v2:7]
signature = EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED D3 26 40
ep_only = true
[EXE Stealth V2:7X -> WebtoolMaster
signature = EB 65 ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? 04 ?? ?? 01 EB 05 ?? ?? ??
ep_only = true

* Sign:By:fly * 20080109]
?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? 60 E8 00 00 00 00 5D
?? ?? EB 00 EB 00 ?? ?? ??

??
??
??
81
??

??
??
??
??
??

??
??
??
??
??

??
??
??
??
??

??
??
??
??
??

??
??
??
??
??

??
??
??
B9
EB

??
??
??
??
00

??
??
??
??

??
??
??
??

[EXE2COM (Encrupted)]
signature = E9 J1 J1 B9 ?? ?? BE ?? ?? 8B FE 51 56 B4 ?? AC 32 C4 C0 ?? ?? 02 E1 AA E2 ?? BF
?? ?? 5E 59 F3 A4 BE ?? ?? 56 C3
ep_only = true
[EXE2COM (Encrypted without selfcheck)]
signature = B3 ?? B9 ?? ?? BE ?? ?? BF ?? ?? EB ?? 54 69 ?? ?? ?? ?? 03 ?? ?? 32 C3 AA 43 49
E3 ?? EB ?? BE ?? ?? 8B C6
ep_only = true
[EXE2COM (Extra Encruption)]
signature = E9 J1 J1 E8 ?? ?? 5D B2 ?? 8B CD 83 ED ?? BF ?? ?? BE ?? ?? 2B CF AC 32 C2 42 AA
E2 ?? B9 ?? ?? BE ?? ?? 03 F5
ep_only = true
[EXE2COM (Limited)]
signature = BE ?? ?? 8B 04 3D ?? ?? 74 ?? BA ?? ?? B4 09 CD 21 CD 20
ep_only = true
[EXE2COM (Method 1)]
signature = 8C DB BE ?? ?? 8B C6 B1 ?? D3 E8 03 C3 03 ?? ?? A3 ?? ?? 8C C8 05 ?? ?? A3
ep_only = true
[EXE2COM (Method 2)]
signature = E9 J1 J1 E8 ?? ?? 5B 50 8C C0 05 ?? ?? 8B ?? ?? ?? 03 C8 89 ?? ?? 8B ?? ?? ?? 03
C8 89
ep_only = true
[EXE2COM (Method 3)]
signature = E9 J1 J1 8C DA 83 ?? ?? 8E DA 4A E8 ?? ?? 81 C3 ?? ?? A1 ?? ?? 2E ?? ?? A1 ?? ??
03 C2
ep_only = true
[EXE2COM (Method 4)]
signature = E9 J1 J1 E8 ?? ?? 5D 8B CD 83 ?? ?? BF ?? ?? BE ?? ?? 2B CF F3 A4 B9 ?? ?? BE
ep_only = true
[EXE2COM (Packed)]
-62-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = BD ?? ?? 89 ?? ?? ?? 81 ?? ?? ?? ?? ?? 8C ?? ?? ?? 8C C8 05 ?? ?? 8E C0 BE ?? ??
8B FE 0E 57 54 59 F3 A4 06 68 ?? ?? CB
ep_only = true
[EXE2COM (regular)]
signature = E9 8C CA 81 C3 ?? ?? 3B 16 ?? ?? 76 ?? BA ?? ?? B4 09 CD 21 CD 20 0D
ep_only = true
[EXE2COM (With CRC check)]
signature = B3 ?? B9 ?? ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 43 49 32 E4 03 D0 E3
ep_only = true
[EXE32Pack v1:36]
signature = 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ??
?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED CC 8D 40
ep_only = true
[EXE32Pack v1:37]
signature = 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ??
?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED 4C 8E 40
ep_only = true
[EXE32Pack v1:38]
signature = 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ??
?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED DC 8D 40
ep_only = true
[EXE32Pack v1:39]
signature = 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ??
?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED EC 8D 40
ep_only = true
[EXE32Pack v1:3x]
signature = 3B ?? 74 02 81 83 55 3B ?? 74 02 81 ?? 53 3B ?? 74 01 ?? ?? ?? ?? ?? 02 81 ?? ??
E8 ?? ?? ?? ?? 3B 74 01 ?? 5D 8B D5 81 ED
ep_only = true
[ExeBundle v3:0 (small loader)]
signature = 00 00 00 00 60 BE 00 F0 40 00 8D BE 00 20 FF FF 57 83 CD FF EB 10 90 90 90 90 90
90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E
83 EE FC 11
ep_only = true
[ExeBundle v3:0 (standard loader)]
signature = 00 00 00 00 60 BE 00 B0 42 00 8D BE 00 60 FD FF C7 87 B0 E4 02 00 31 3C 4B DF 57
83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00
00 00 01 DB
ep_only = true
[ExeCode v1:0]
signature = E9 J1 J1 FA 8C C3 02 DF 50 33 C0 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8E D0 BC ?? ?? BE
?? ?? B9 ?? ?? 33 FF 2E ?? ?? ?? ?? ?? ?? 32 DB B0 ?? E6 64 AC
ep_only = true
[EXECrypt 1:0 -> ReBirth]
signature = 90 90 60 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB
05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85
00 00 B9 96 0C 00 00 90 8D BD 4E 28 40 00 8B F7 AC
ep_only = true
[EXECryptor 2:0/2:1 (protected IAT) -> www:strongbit:com * Sign:By:haggar]
signature = A4 ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00
-63-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

00 FF FF FF FF B8
00 00 6B 65 72 6E
6E 64 6C 65 41 00
63 41 64 64 72 65
?? ?? ?? ?? ?? ??
00 00 75 73 65 72
ep_only = false

??
65
00
73
??
33

??
6C
00
73
??
32

??
33
00
00
??
2E

04 August 2015 15:14

D4
32
4C
00
??
64

??
2E
6F
00
??
6C

??
64
61
00
??
6C

??
6C
64
00
??
00

00
6C
4C
00
??
00

00
00
69
45
??
00

00
00
62
78
??
00

00
00
72
69
00
4D

00
00
61
74
60
65

00
00
72
50
??
73

00
00
79
72
??
73

[EXECryptor 2:0/2:1 (protected IAT)

signature = A4 ?? ?? ?? 00 00 00 00
00 FF FF FF FF B8 ?? ?? ?? D4 ?? ??
00 00 6B 65 72 6E 65 6C 33 32 2E 64
ep_only = true

->
FF
??
6C

www:strongbit:com]
FF FF FF 3C ?? ?? ?? 94 ?? ?? ?? D8 ?? ?? ?? 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75

[EXECryptor 2:0/2:1 -> www:strongbit:com * Sign:By:haggar]

signature = 55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00
09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09
?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B
00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09
00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF ?? 53 FF
84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF
ep_only = false

00
47
41
6F
??
61

00
C0
06
DB
75

00
65
00
63
70
67

??
0F
09
0F
F8

00
74
00
65
??
65

??
85
C0
84
FF

00
4D
00
73
??
42

89
0F
8B
??
15

00
6F
00
73
??
6F

45
00
55
00
9C

00
64
47
00
84
78

FC
00
FC
00
??

00
75
65
00
??
41

89
00
0F
00
??

00
6C
74
00
??

C2
53
85
F7
??

00
65
50
??
??

8B
FF
03
C3
09

00
48
72
??
00

46
15
00
00
C0

00
61
6F
??
00

0C
98
00
00
0F

[EXECryptor 2:0/2:1 -> www:strongbit:com]

signature = 55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C
09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98
?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F
ep_only = true
[EXECryptor 2:1:17 -> Strongbit / SoftComplete Development (h)]
signature = BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01
D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00
00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01
ep_only = false
[EXECryptor 2:1:17 -> Strongbit/SoftComplete
signature = BE ?? ?? ?? ?? B8 00 00 ?? ?? 89
D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F
00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B
8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ??
5C 13 02 81 E3 FF FF FF 7F 53 FF 75 F8 FF 15
F4 04 E9 A6 FF FF FF
ep_only = false

Development
45 FC 89 C2
00 00 00 53
55 FC 0F 85
00 00 00 F7
9C ?? ?? ??

(h)]
8B 46
FF 15
03 00
C3 00
09 C0

0C
98
00
00
0F

09
??
00
00
84

C0
??
8B
80
??

0F
??
46
0F
00

84
09
10
85
00

??
C0
01
04
00

00
0F
D0
00
89

00
84
03
00
07

00
??
45
00
83

01
00
F4
8D
45

[EXECryptor 2:2:4 -> Strongbit/SoftComplete Development (h1)]

signature = E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00
00 00 FF FF FF FF 5E C3
ep_only = true
[EXECryptor 2:2:4 -> Strongbit/SoftComplete Development (h2)]
signature = E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 ?? 00
00 00
ep_only = true
[EXECryptor 2:2:4
signature = 6B 65
48 61 6E 64 6C 65
72 6F 63 41 64 64
ep_only = false

->
72
41
72

Strongbit/SoftComplete Development]
6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65
00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50
65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73

[EXECryptor 2:2:6 (minimum protection) -> www:strongbit:com]

signature = 50 68 ?? ?? ?? ?? 58 81 E0 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 0C 24 59 E8 ?? ?? ?? 00
-64-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

89 45 F8 E9 ?? ?? ?? ?? 0F 83 ?? ?? ?? 00 E9 ?? ?? ?? ?? 87 14 24 5A 57 68 ?? ?? ?? ?? E9 ??
?? ?? ?? 58 81 C0 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 81 C8 ?? ?? ?? ?? 81 E0
ep_only = false
[EXECryptor 2:2:6
signature = 50 8B
?? ?? ?? 0F 81 ??
?? ?? ?? F7 D1 0B
ep_only = false

DLL (minimum protection) -> www:strongbit:com]

C6 87 04 24 68 ?? ?? ?? ?? 5E E9 ?? ?? ?? ?? 85 C8 E9 ?? ?? ?? ?? 81 C3 ??
?? ?? 00 81 FA ?? ?? ?? ?? 33 D0 E9 ?? ?? ?? 00 0F 8D ?? ?? ?? 00 81 D5 ??
15 ?? ?? ?? ?? C1 C2 ?? 81 C2 ?? ?? ?? ?? 9D E9 ?? ?? ?? ?? C1

[EXECryptor 2:2:x -> SoftComplete Developement]

signature = E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00
00 00 FF FF FF FF
ep_only = false
[EXECryptor 2:2/2:3 (compressed code) -> www:strongbit:com (h)]
signature = E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ??
04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ??
C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80
?? 8B 04 18 FF D0 59 58 5B 83 EB 05 C6 03 B8 43 89 03 83 C3 04 C6
A0 00 00 00 FC AD 83 F8 FF 74 38 53 89 CB 01 C3 01 0B 83 C3 04 AC
EB ED 81 C3 FE 00 00 00 09 C0 7A 09 66 AD 25 FF FF 00 00 EB DA AD
FF 00 75 CC ?? ?? ?? ?? ?? C3
ep_only = false

??
??
00
03
3C
4E

??
??
00
C3
FE
25

B8
??
6A
09
73
FF

??
01
00
C9
07
FF

??
DA
50
74
25
FF

??
52
B8
46
FF
00

??
53
C8
89
00
3D

50
50
??
C3
00
FF

6A
89
??
E8
00
FF

[EXECryptor 2:2/2:3 (compressed code) -> www:strongbit:com]

signature = E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A
04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89
C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50
ep_only = true
[EXECryptor 2:2/2:3 (protected IAT)
signature = CC ?? ?? ?? 00 00 00 00
00 FF FF FF FF E8 ?? ?? ?? 04 ?? ??
00 00 6B 65 72 6E 65 6C 33 32 2E 64
6E 64 6C 65 41 00 00 00 00 4C 6F 61
63 41 64 64 72 65 73 73 00 00 00 00
69 72 74 75 61 6C 41 6C 6C 6F 63 00
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? 84 ?? ?? ?? 94 ?? ?? ?? A4
00 00 4D 65 73 73 61 67 65 42 6F 78
ep_only = false

->
FF
??
6C
64
00
00
??
??

www:strongbit:com
FF FF FF 3C ?? ??
00 00 00 00 00 00
6C 00 00 00 00 00
4C 69 62 72 61 72
00 45 78 69 74 50
00 00 56 69 72 74
?? ?? ?? ?? ?? ??
?? ?? 00 00 00 00

[EXECryptor 2:2/2:3 (protected IAT)

signature = CC ?? ?? ?? 00 00 00 00
00 FF FF FF FF E8 ?? ?? ?? 04 ?? ??
00 00 6B 65 72 6E 65 6C 33 32 2E 64
ep_only = true

->
FF
??
6C

www:strongbit:com]
FF FF FF 3C ?? ?? ?? B4 ?? ?? ?? 08 ?? ?? ?? 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75

[EXECryptor 2:3:9
signature = 51 68
F8 02 E9 E3 36 00
?? 00 00 23 C1 81
ep_only = false

(compressed
?? ?? ?? ??
00 F6 45 F8
E9 ?? ?? ??

[EXECryptor 2:3:9
signature = 68 ??
?? ?? FF 84 C0 0F
00 E9 ?? ?? ?? FF
ep_only = false

(minimum
?? ?? ??
84 6A F9
2B D0 68

(h)]
?? B4
00 00
00 47
79 41
72 6F
75 61
?? ??
75 73

??
00
65
00
63
6C
??
65

??
00
74
00
65
46
4C
72

??
00
4D
00
73
72
??
33

08
00
6F
00
73
65
??
32

??
00
64
47
00
65
??
2E

??
00
75
65
00
00
60
64

??
00
6C
74
00
00
??
6C

00
00
65
50
00
00
??
6C

00
00
48
72
00
??
??
00

00
00
61
6F
56
??
70
00

resources) -> www:strongbit:com]

59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45
20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ??
?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00

protection)
E9 ?? ?? ??
FF FF E9 ??
A0 36 80 D4

->
FF
??
59

www:strongbit:com]
50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ??
?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00
81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0

[EXECryptor 2:3:9 DLL (compressed resources) -> www:strongbit:com]

-65-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF
FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83
7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9
ep_only = false
[EXECryptor 2:3:9
signature = 51 68
68 ?? ?? ?? ?? 59
?? ?? ?? ?? E8 ??
ep_only = false

DLL (minimum protection) -> www:strongbit:com]

?? ?? ?? ?? 87 2C 24 8B CD 5D 81 E1 ?? ?? ?? ?? E9 ?? ?? ?? 00 89 45 F8 51
81 F1 ?? ?? ?? ?? 0B 0D ?? ?? ?? ?? 81 E9 ?? ?? ?? ?? E9 ?? ?? ?? 00 81 C2
?? ?? 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C

[EXECryptor 2:x -> SoftComplete Developement]

signature = A4 ?? ?? 00 00 00 00 00 FF FF FF FF 3C ?? ?? 00 94 ?? ?? 00 D8 ?? ?? 00 00 00 00
00 FF FF FF FF
ep_only = false
[EXECryptor 2:xx (compressed resources) -> www:strongbit:com *
signature = 56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F
13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3
0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1
06 85 DB 74 0E EB A9 56 89 D6 89 D9 F3 A4 31 DB 5E EB 9D 89 F0
ep_only = false

Sign:By:haggar]
C1 EA 05 74 2D 4A 74 15 8D 5C
05 8D 5C 03 04 46 89 FA 0F B7
E8 05 73 07 43 89 F2 01 DE EB
5B 5F 5E C3

[EXECryptor 2:xx (compressed resources) -> www:strongbit:com]

signature = 56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C
13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7
0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89
ep_only = true
[EXECryptor 2:xx (max: compressed resources)
signature = 55 8B EC 83 C4 EC FC 53 57 56 89
23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31
8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8
5B B9 04 00 00 00 E8 FD 00 00 00 48 74 DE 0F
00 00 E8 D7 00 00 00 88 07 47 4D 75 F5 E8 BF
00 00 83 C0 07 89 45 F0 C6 45 EF 00 83 F8 08
07 00 00 00 E8 A2 00 00 00 50
ep_only = false

->
45
DB
FC
89
00
74

www:strongbit:com
FC 89 55 F8 89 C6
BA 00 00 00 80 43
00 00 00 0F 82 97
C7 00 00 00 E8 D7
00 00 72 E9 5D EB
89 E8 A9 00 00 00

* Sign:By:haggar]
89 D7 66 81 3E 4A
31 C0 E8 11 01 00
00 00 00 E8 F1 00
00 00 00 73 1B 55
A2 B9 01 00 00 00
88 45 EF E9 7C FF

[EXECryptor 2:xx (max: compressed resources)

signature = 55 8B EC 83 C4 EC FC 53 57 56 89
23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31
8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8
ep_only = true

->
45
DB
FC

www:strongbit:com]
FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85
BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E
00 00 00 0F 82 97 00 00 00 E8 F1

43
00
00
BD
E8
FF

0F
73
00
00
C8
FF

85
0E
73
01
00
B9

[EXECryptor v1:3:0:45]
signature = E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89
41 14 89 41 18 80 A1
ep_only = true
[EXECryptor v1:3:0:45]
signature = E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89
41 14 89 41 18 80 A1
ep_only = true
[EXECryptor v1:4:0:1]
signature = E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0
89 41 14 89 41 18 80
ep_only = true
[EXECryptor v1:5:1:x]
signature = E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0
-66-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

89 41 14 89 41 18 80 A1 C1 ?? ?? ?? FE C3 31 C0 64 FF 30 64 89 20 CC C3
ep_only = true
[EXECryptor v1:5:3]
signature = E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0
89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 CC C3
ep_only = false
[EXECryptor V2:1X -> SoftComplete:com]
signature = E9 ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? ?? ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1
ep_only = true
[EXECryptor V2:1X -> softcomplete:com]
signature = 83 C6 14 8B 55 FC E9 ?? FF FF FF
ep_only = false
[EXECryptor V2:2X -> softcomplete:com]
signature = FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 00
ep_only = false
[EXECryptor V2:2X-V2:4X -> StrongBit Technology * Sign:By:fly]
signature = E8 ?? ?? ?? ?? 05 ?? ?? ?? ?? FF E0 E8 ?? ?? ?? ?? 05 ?? ?? ?? ?? FF E0 E8 04 00
00 00 FF FF FF FF 5E C3
ep_only = true
[EXECryptor vx:x:x:x]
signature = E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0
89 41
ep_only = true
[EXEGUARD v1:3]
signature = BA ?? ?? BF ?? ?? EB J3 E8 ?? ?? 7C ?? 79 ?? FA EA ?? ?? ?? ?? 76 ?? D8 FD
ep_only = true
[ExeJoiner 1:0
signature = 68
00 68 04 11 40
68 04 11 40 00
ep_only = true

->
00
00
E8

Yoda f2f]
10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00
6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80
EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50

[ExeJoiner 1:0
signature = 68
00 68 04 11 40
68 04 11 40 00
00 83 F8 FF 0F
E8 E3 02 00 00
EB 04 6A 00 6A
00 FF 35 08 12
6A 00 68 3C 12
00 53 FF 35 08
ep_only = true

->
00
00
E8
84
6A
00
40
40
12

Yoda f2f]
10 40 00 68
6A 00 E8 1A
EC 02 00 00
6D 02 00 00
00 68 3C 12
53 FF 35 08
00 E8 98 02
00 6A 04 68
40 00 E8 5F

04
03
83
A3
40
12
00
34
02

01
00
F8
0C
00
40
00
12
00

00
00
FF
12
6A
00
83
40
00

00
6A
0F
40
04
E8
EB
00

E8
00
84
00
68
B7
04
FF

39
68
83
8B
1E
02
6A
35

03
80
02
D8
12
00
00
08

00
00
00
83
40
00
6A
12

00
00
00
EB
00
6A
00
40

05
00
A3
04
FF
00
53
00

00
6A
08
6A
35
68
FF
E8

10
03
12
00
08
3C
35
6C

40
6A
40
6A
12
12
08
02

00
00
00
00
40
40
12
00

C6
6A
6A
53
00
00
40
00

00
01
00
FF
E8
6A
00
83

5C
68
50
35
C4
04
E8
EB

68
00
E8
08
02
68
8B
04

04
00
E2
12
00
1A
02
6A

01
00
02
40
00
12
00
00

00
80
00
00
83
40
00
6A

[ExeJoiner V1:0 -> Yoda f2f]

signature = 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00
00
ep_only = true
[EXEJoiner v1:0]
signature = 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 C6 00 5C 68 ?? ?? ?? ??
68 ?? ?? ?? ?? 6A 00 E8
ep_only = true

-67-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[EXELOCK 666 1:5]

signature = BA ?? ?? BF ?? ?? EB ?? EA ?? ?? ?? ?? 79 ?? 7F ?? 7E ?? 1C ?? 48 78 ?? E3 ?? 45
14 ?? 5A E9
ep_only = true
[ExeLock v1:00]
signature = 06 8C C8 8E C0 BE ?? ?? 26 ?? ?? 34 ?? 26 ?? ?? 46 81 ?? ?? ?? 75 ?? 40 B3 ?? B3
?? F3
ep_only = true
[EXEPACK (LINK) v3:60; v3:64; v3:65 or 5:01:21]
signature = 8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 ?? ?? ?? 8E C0 8B ?? ?? ?? 8B ?? 4F 8B F7 FD F3
A4 50 B8 ?? ?? 50 CB
ep_only = true
[EXEPACK v4:05; v4:06]
signature = 8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 06 ?? ?? 8E C0 8B 0E ?? ?? 8B F9 4F 8B F7 FD F3
A4
ep_only = true
[EXEPACK v5:31:009 (LINK v3:69)]
signature = 8B E8 8C C0
ep_only = true
[EXERefactor V0:1 -> random]
signature = 55 8B EC 81 EC 90 0B 00 00 53 56 57 E9 58 8C 01 00 55 53 43 41 54 49 4F 4E
ep_only = true
[ExeSafeguard 1:0
signature = C0 5D
FF EB 01 DF 9D FF
4E 58 DF 59 79 EE
ep_only = false

->
EB
E1
EB

simonzh (h)]
4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF
E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69
01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE

[ExeSafeguard v1:0 -> simonzh

signature = C0 5D EB 4E EB 47
FF EB 01 DF 9D FF E1 E8 51 E8
4E 58 DF 59 79 EE EB 01 DF 78
BA A3 22 3F 9A C0 60 EB 4D EB
FF FF 9D FF E1 EB 51 E8 EE FF
4E 58 DF 59 7A EE EB 01 DF 7B
22 3F 9A C0 8B FE EB 4C EB 47
FF 9D FF E1 EB 51 E8 EE FF FF
DF 59 78 EF
ep_only = false
[ExeShield 3:6
signature = B8
6F 6D 70 61 63
B1 29 8F 11 73
ep_only = true

->
??
74
8F

(h)]
DF 69
EB FF
E9 DF
47 DF
FF FF
E9 DF
DF 69
FF E8

4E
FF
59
69
E8
59
4E
BA

58
FF
9C
4E
BA
9C
58
A3

DF
DF
81
58
A3
81
DF
22

59
22
C1
DF
22
C1
59
3F

74
3F
E5
59
3F
E5
74
9A

F3
9A
FF
79
9A
FF
F2
C0

EB
C0
FF
F3
C0
FF
EB
B9

01
81
FF
EB
8D
FF
01
2B

DF
ED
9D
01
B5
9D
DF
CB

75
19
FF
DF
EE
FF
75
00

EE
18
E1
78
19
E1
ED
00

9A
40
EB
EE
40
EB
0F
EB

59
00
51
DF
00
51
59
4B

9C
EB
E8
59
EB
E8
9C
EB

81
48
EE
9C
47
EE
81
47

C1
EB
FF
81
EB
FF
C1
DF

E2
47
FF
C1
47
FF
E5
69

FF
DF
FF
E5
DF
FF
FF
4E

FF
69
DF
FF
69
DF
FF
58

www:exeshield:com]
?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43
32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F
00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F

[ExeShield Cryptor 1:3RC -> Tom Commander]

signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 8C 21 40 00 B9 51 2D 40 00 81 E9 E6
21 40 00 8B D5 81 C2 E6 21 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC
ep_only = true
[ExeShield Protector V3:6 -> www:exeshield:com]
signature = B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43
6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC
ep_only = true

-68-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[ExeShield v3:7 -> ExeShield Team (h)]

signature = B8 ?? ?? ?? 00 50 64 FF 35
6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8
B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D
EC E4 82 97 AE 0F 18 D2 47 1B 65 EA 46
D5 43 CE 9A D6 18 BF 22 DA 1F 72 76 B0
ep_only = true

00
D6
00
A5
98

00
CC
6C
FD
5B

00
E9
3C
3E
C2

00
FB
BF
9D
64

64
C8
C0
75
BC

89
4F
80
2A
AE

25
1B
F7
62
D8

00
22
AD
80

00
7C
35
60

00
B4
23
F9

00
C8
EB
B0

33
0D
84
0D

C0
BD
82
E1

89
71
6F
AC

08
A9
8C
12

50
C8
B9
0E

45
1F
0A
9D

43
5F
FC
24

[ExeSmasher vx:x]
signature = 9C FE 03 ?? 60 BE ?? ?? 41 ?? 8D BE ?? 10 FF FF 57 83 CD FF EB 10
ep_only = true
[ExeStealth -> WebToolMaster]
signature = EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61
6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73
74 65 72 2E 63 6F
ep_only = false
[EXEStealth 2:75 -> WebtoolMaster]
signature = 90 60 90 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00
ep_only = true
[EXEStealth 2:76 Unregistered -> WebtoolMaster]
signature = EB ?? 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 53 68 61 72 65 77 61 72 65 20
ep_only = false
[ExeTools COM2EXE]
signature = E8 ?? ?? 5D 83 ED ?? 8C DA 2E 89 96 ?? ?? 83 C2 ?? 8E DA 8E C2 2E 01 96 ?? ?? 60
ep_only = true
[ExeTools v2:1 Encruptor by DISMEMBER]
signature = E8 ?? ?? 5D 83 ?? ?? 1E 8C DA 83 ?? ?? 8E DA 8E C2 BB ?? ?? BA ?? ?? 85 D2 74
ep_only = true
[EXE -> Liuli]
signature = E8 53 03 00 00 8B F0 56 56 E8 98 03 00 00 8B C8
ep_only = false
[eXPressor 1:0
signature = E9
02 00 00 E9 EF
CC CC CC CC CC
CC CC CC CC CC
00 00 00 2A 70
00 00 00 00 00
00 00 00 00 00
72 6F 72 3A 00
6F 20 6D 69 73
ep_only = true

beta -> CGSoftLabs]

35 14 00 00 E9 31 13
0B 00 00 E9 1B 0D 00
CC CC CC CC CC CC CC
CC CC CC CC CC CC CC
77 20 3D 20 30 78 25
00 00 00 42 61 64 20
00 00 00 00 00 00 00
00 54 68 65 20 25 68
73 69 6E 67 20 65 78

[eXPressor 1:0
signature = E9
02 00 00 E9 EF
CC CC CC CC CC
ep_only = true

beta -> CGSoftLabs]

35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9
0B 00 00 E9 1B 0D 00 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC
CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC

00
00
CC
CC
30
70
00
73
70

00
CC
CC
CC
34
6F
2A
20

E9
CC
CC
00
78
69
70
66

98
CC
CC
00
20
6E
64
69

12
CC
CC
00
20
74
77
6C

00
CC
CC
00
2A
65
20
65

00
CC
CC
00
70
72
3D
20

E9
CC
CC
00
64
3A
20
69

EF
CC
CC
00
77
00
30
73

0C
CC
CC
00
20
00
78
20

00
CC
CC
00
3D
00
25
0A

00
CC
CC
00
20
00
30
6C

E9
CC
CC
00
30
00
38
69

42
CC
CC
00
78
00
78
6E

13
CC
CC
00
25
00
00
6B

00
CC
CC
00
30
00
00
65

00
CC
CC
00
38
00
00
64

E9
CC
CC
00
78
00
45
20

E9
CC
CC
00
00
00
72
74

[eXPressor 1:1 -> CGSoftLabs]

signature = E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? 12 00 00 E9 ?? 0C 00 00 E9 ?? ?? 00 00 E9 ??
?? 00 00 E9 ?? ?? 00 00
ep_only = true
[eXPressor 1:2 -> CGSoftLabs (h)]
-69-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8
?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05
80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04
ep_only = false
[eXPressor 1:2 -> CGSoftLabs]
signature = 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E
ep_only = true
[eXPressor 1:2:0 Beta PE Packer]
signature = 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 EB ?? 45 78 50 72 2D 76 2E 31 2E 32 2E 2E
ep_only = true
[eXPressor 1:2:0b]
signature = 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8
?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05
80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04
ep_only = false
[eXPressor 1:3 -> CGSoftLabs]
signature = 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E
ep_only = true
[eXPressor 1:4:5:1 -> CGSoftLabs
signature = 55 8B EC 83 EC 58 53
00 A1 00 ?? ?? ?? 05 00 ?? ?? ??
0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00
ep_only = false

(h)]
56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E
A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D
74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14

[eXPressor 1:4:5:1 -> CGSoftLabs]

signature = 55 8B EC 83 EC 58 53 56
00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3
0C ?? ?? 00 83 3D 10 ?? ?? 00 00 74
97 04 00 00 C7 05 10 ?? ?? 00 01 00
?? ?? 00 83 7D 0C 01 74 04 83 65 08
?? 00 89 45 EC 68 04 01 00 00 FF 75
AC 8B 45 AC 0F BE 00 83 F8 5C 74 09
2B 45 EC 89 45 B0 6A 04 68 00 10 00
B0 8B 75 EC 8B 7D FC 8B C1 C1 E9 02
ep_only = true

57
08
16
00
00
EC
8B
00

83
??
A1
00
6A
FF
45
68

65
??
08
??
04
75
AC
04

DC
00
??
??
68
08
48
01

00
A1
??
68
00
FF
89
00

F3
08
00
54
10
15
45
00

EB
??
8B
??
00
DC
AC
6A

0C
??
0D
??
00
??
EB
00

65
00
0C
00
68
??
EC
FF

58
B9
??
68
04
00
8B
15

50
81
??
18
01
8B
45
C4

72
??
00
??
00
4D
AC
??

2D
??
03
??
00
EC
40
??

76
00
48
00
6A
8D
89
00

2E
2B
14
6A
00
44
45
89

31
48
89
00
FF
01
AC
45

2E
18
4D
FF
15
FF
8B
FC

34
89
CC
15
C4
89
45
8B

2E
0D
E9
E4
??
45
AC
4D

[eXPressor 1:4:5:1 -> CGSoftLabs]

signature = 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E
00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D
0C ?? ?? 00 83 3D 10 ?? ?? 00 00 74 16 A1 08 ?? ?? 00 8B 0D 0C ?? ?? 00 03 48 14
ep_only = true
[eXpressor v1:0 -> CGSoftLabs]
signature = E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13
ep_only = false
[eXPressor V1:0 -> CGSoftLabs]
signature = E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9
02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00
ep_only = true
[eXpressor v1:1 -> CGSoftLabs]
signature = E9 15 13 00 00 E9 F0 12 00 00 E9 58 12 00 00 E9 AF 0C 00 00 E9 AE 02 00 00 E9 B4
0B 00 00 E9 E0 0C 00 00
ep_only = true
[eXPressor v1:2 -> CGSoftLabs (h)]
-70-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

signature = 55
?? ?? ?? ?? 2B
80 ?? ?? ?? 89
85 F0 FE FF FF
ep_only = true

8B
05
85
50

EC
84
54
6A

81
??
FE
00

EC
??
FF
FF

04 August 2015 15:14

D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8
?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05
FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 01 00 00 8D
15

[eXPressor v1:2 -> CGSoftLabs]

signature = 45 78 50 72 2D 76 2E 31 2E 32 2E
ep_only = false
[eXpressor v1:2 -> CGSoftLabs]
signature = 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76
ep_only = true
[eXPressor v1:2:0b]
signature = 55 8B EC
?? ?? ?? 00 2B 05 84
80 ?? ?? 00 89 85 54
85 F0 FE FF FF 50 6A
FF FF 0F BE 00 83 F8
ep_only = false

81
??
FE
00
5C

EC
??
FF
FF

D4
00
FF
15

[eXPressor v1:3 -> CGSoftLabs

signature = 55 8B EC 83 EC ??
?? 2B 05 ?? ?? ?? ?? A3 ?? ??
?? 89 ?? ?? E9 ?? ?? 00 00 C7
ep_only = true

01
A3
E9
??

00
??
??
??

00
??
07
??

53
??
00
00

56
00
00
8D

57
83
C7
84

EB
3D
05
05

0C
??
??
EF

45
??
??
FE

78
??
??
FF

50
00
00
FF

72
00
01
89

2D
74
00
85

76
16
00
38

2E
A1
00
FE

31
??
68
FF

2E
??
04
FF

32
??
01
8B

2E
00
00
85

2E
03
00
38

B8
05
8D
FE

(h)]
53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E B8 ?? ?? ??
?? ?? 83 3D ?? ?? ?? ?? 00 74 13 A1 ?? ?? ?? ?? 03 05 ?? ?? ??
05

[eXPressor v1:3 -> CGSoftLabs]

signature = 45 78 50 72 2D 76 2E 31 2E 33 2E
ep_only = false
[eXPressor V1:3 -> CGSoftLabs]
signature = 55 8B EC 83 EC ?? 53 56 57 EB 0C 45
ep_only = true
[eXPressor v1:4 -> CGSoftLabs (h)]
signature = 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 34 2E 2E B8
ep_only = true
[eXPressor v1:4 -> CGSoftLabs]
signature = 65 58 50 72 2D 76 2E 31 2E 34 2E
ep_only = false
[eXpressor v1:4:5 -> CGSoftLabs]
signature = 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C
ep_only = true
[eXPressor v1:4:5:1 -> CGSoftLabs (h)]
signature = 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E
00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D
0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14 89 4D CC
ep_only = true
[eXPressor V1:4:5:1 -> CGSoftLabs *
signature = 55 8B EC 83 EC ?? 53 56
?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3
?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 74
?? ?? ?? ?? C7 05
ep_only = true

Sign:By:fly]
57 83 65 ?? 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? A1 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B 48 18 89 ??
16 A1 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 03 48 14 89 4D ?? E9

[eXPressor V1:4:5:1 -> CGSoftLabs]

-71-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E
00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D
0C ?? ?? 00 83 3D
ep_only = true
[eXPressor V1:4:5:1 -> CGSoftLabs]
signature = 55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C
ep_only = true
[eXPressor v1:5:0:1 (Options -> Light; Full support) CGSoftLabs]
signature = 55 8B EC 81 EC ?? 02 00 00 53 56 57 83 A5 ?? FD FF FF 00 F3 EB 0C 65 58 50 72 2D
76 2E 31 2E 35
ep_only = true
[eXPressor v1:5:0:1 (Options -> Protection) CGSoftLabs]
signature = 5E 00 00 80 00 00 00 68 91 5D D4 27 35 C5 5A 4C A5 40 48 C4 08 4E C0
ep_only = true
[eXpressor Version 1:5:01]
signature = 55 8B EC 81 EC 50 02 00 00 53 56 57 83 A5 D0 FD FF FF 00 F3 EB 0C 65 58 50 72 2D
76 2E 31 2E 35 2E 00
ep_only = true
[eXPressor:PacK V1:5:0:X -> CGSoftLabs
signature = 55 8B EC 81 EC ?? ?? ?? ??
76 2E 31 2E 35 2E 00 83 7D 0C ?? 75 23
00 00 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ??
ep_only = true
[eXPressor:Protection 1:5:0:X
signature = EB 01 68 EB 01 ??
EB 01 E9 E9 56 01 00 00 EB 02
02 DA 9F 68 ?? ?? ?? ?? 68 ??
ep_only = false

->
??
E8
??

> Sign by fly]

53 56 57 83 A5 ?? ?? ?? ?? ?? F3 EB 0C 65 58 50 72 2D
8B 45 08 A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 20 03
?? ?? EB 04

CGSoftLabs]
?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08
E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB
?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02

[eXPressor:Protection V1:5:0:X -> CGSoftLabs

signature = EB 01 68 EB 01 ?? ?? ?? ?? 83 EC
EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ??
02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ??
?? ?? ?? E8 0E 05 00 00 59 EB 01 DD 83 65 F4
EB 02 DA 1A 8B 45 F4 0F ?? ?? ?? ?? ?? ?? 33
ep_only = false

> Sign by fly]

0C 53 56 57 EB
?? ?? ?? 01 00
?? ?? ?? FF D0
00 EB 07 8B 45
45 F4 8B 4D F4

01
00
59
F4
88

??
00
59
40
??

83
EB
EB
89
??

3D
01
01
45
??

??
C2
C8
F4
??

??
E8
EB
83
??

??
E2
02
7D
EB

??
05
66
F4
01

00
00
F0
61
EB

74
00
68
73
EB

08
EB
??
1F

[EZIP v1:0]
signature = E9 19 32 00 00 E9 7C 2A 00 00 E9 19 24 00 00 E9 FF 23 00 00 E9 1E 2E 00 00 E9 88
2E 00 00 E9 2C
ep_only = true
[E -> ]
signature = 55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 0F 31 8B D8 0F 31 8B D0 2B D3 C1
EA 10 B8 ?? ?? ?? ?? 0F 6E C0 B8 ?? ?? ?? ?? 0F 6E C8 0F F5 C1 0F 7E C0 0F 77 03 C2 ?? ?? ??
?? ?? FF E0
ep_only = true
[FACRYPT v1:0]
signature = B9 ?? ?? B3 ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 49 43 32 E4 03 D0 E3
ep_only = true
[FakeNinja v2:8 (Anti-Debug) -> Spirit]
signature = 64 A1 18 00 00 00 EB 02 C3 11 8B 40 30 EB 01 0F 0F B6 40 02 83 F8 01 74 FE EB 01
E8 90 C0 FF FF EB 03 BD F4 B5 64 A1 30 00 00 00 0F B6 40 02 74 01 BA 74 E0 50 00 64 A1 30 00
00 00 83 C0 68 8B 00 EB 00 83 F8 70 74 CF EB 02 EB FE 90 90 90 0F 31 33 C9 03 C8 0F 31 2B C1
-72-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

3D FF 0F 00 00 73 EA E8 08 00 00 00 C1 3D FF 0F 00 00 74 AA EB 07 E8 8B 40 30 EB 08 EA 64 A1
18 00 00 00 EB F2 90 90 90 BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40 11 00 00
6A 00 6A 00 FF 35 70 11 40 00 FF 35 84 11 40 00 E8 25 11 00 00 FF
ep_only = false
[FakeNinja v2:8 -> Spirit]
signature = BA ?? ?? ?? ?? FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40
ep_only = false
[FakeNinja V2:8 Private
signature = 40 00 00 C0
?? 00 00 00 00 00 00 00
?? ?? ?? 00 00 00 ?? ??
ep_only = false

->
??
00
??

Spirit *
?? ?? ??
00 00 00
?? 00 00

Sign:By:fly]
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ??
00 00 00 00 00 00 00 00 00 00 17 E5 FF 60

[FASM 1:5x]
signature = 6A 00 FF 15 ?? ?? 40 00 A3 ?? ?? 40 00
ep_only = false
[FASM v1:3x]
signature = 6A ?? FF 15 ?? ?? ?? ?? A3
ep_only = true
[FCRYPT v:1:00 1990]
signature = E9 J1 J1 50 53 51 BE ?? ?? BF ?? ?? 8B EF B9 ?? ?? FC AC 32 C1 AA E2 ?? 59 5B 58
FF
ep_only = true
[fds0ft c0m pr0tect v0:4b]
signature = 8C CA 2E ?? ?? ?? ?? B4 30 8B ?? ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C ?? ?? ?? 89
?? ?? ?? 89 ?? ?? ?? EB
ep_only = true
[fEaRzCrypter v1:0 -> fEaRz]
signature = 55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 ?? 53 56 57 B8 ?? ?? ?? ?? E8 ?? ?? ??
?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
D8 85 DB 75 ?? 6A 00
ep_only = true
[Feokt]
signature = 89 25 A8 11 40 00 BF ?? ?? ?? 00 31 C0 B9 ?? ?? ?? 00 29 F9 FC F3 AA ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8
ep_only = true
[Feokt]
signature = 89
?? ?? ?? ?? ??
?? ?? ?? ?? ??
BE ?? ?? 40 00
ep_only = true

25 A8 11 40 00 BF ?? ?? ?? 00 31 C0 B9 ?? ?? ?? 00 29 F9 FC F3 AA ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00
BF

[File Analyzer Compiled Datafile Version %v3:%v4]

signature = 46 69 6C 65 20 41 6E 61 6C 79 7A 65 72 20 43 6F 6D 70 69 6C 65 64 20 44 61 74 61
66 69 6C 65 20 56 65 72 73 69 6F 6E ?? V3 ?? V4
ep_only = false
[File Analyzer Compiled Datafile Version]
signature = 46 69 6C 65 20 41 6E 61 6C 79 7A 65 72 20 43 6F 6D 70 69 6C 65 64 20 44 61 74 61
66 69 6C 65 20 56 65 72 73 69 6F 6E
ep_only = false

-73-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[File Analyzer Extended Datafile Version %v3:%v4]

signature = 23 03 45 58 54 44 V3 V4 3A 03
ep_only = false
[File Analyzer Extended Datafile Version]
signature = 23 03 45 58 54 44 ?? ?? 3A 03
ep_only = false
[File Analyzer Registration file v1:0]
signature = 24 46 41 52 45 47 24 4D 2D ?? ?? ?? ?? 31
ep_only = false
[File Analyzer Registration file v1:1]
signature = 24 46 41 52 45 47 24 45 4E 43 3D ?? 26 26 52 45 47 3D ?? 26 26 45 58 50 3D
ep_only = false
[FileShield]
signature = 50 1E EB ?? 90 00 00 8B D8
ep_only = true
[Fish PE Shield 1:01 -> HellFish]
signature = 55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89
ep_only = false
[Fish PE Shield 1:01
signature = 55 8B EC
AD FF FF FF 89 45 DC
8B 10 89 55 F4 83 C0
04 8B 00 89 45 E8 8B
00 00 00 00 83 7B 04
ep_only = false

->
83
E8
04
45
00

HellFish]
C4 D0 53 56
C1 FE FF FF
8B 10 89 55
E4 8B 58 04
74 14

[Fish PE Shield 1:01

signature = 60 E8 12
00 00 40 01 00 ?? ??
00 00 00 10 00 00 28
00 00 0C 00 00 00 B0
?? 4E 00 00 00 08 00
ep_only = true

->
FE
??
88
00
00

HellFish]
FF FF C3 90
?? 00 00 00
00 00 40 ??
00 38 0A 00
00 00 01 00

57
8B
F8
03

8B
10
83
5D

45
03
C0
E4

10
55
04
8B

83
DC
8B
FB

C0
89
10
8B

0C
55
89
45

8B
E4
55
E4

00
83
F0
8B

89
C0
83
30

45
04
C0
4E

DC
8B
04
85

83
10
8B
F6

7D
89
10
72

DC
55
89
2B

00
FC
55
46

75
83
EC
C7

08
C0
83
45

E8
04
C0
E0

09
00
4B
00
C8

00
00
00
40
06

00
00
00
??
00

00
00
00
4E
00

2C
00
02
00
40

00
00
00
00

00
00
00
00

00
00
00
00

??
00
A0
00

??
00
00
00

??
00
00
00

??
00
18
C0

C4
00
01
00

03
99
00
00

00
00
00
40

00
00
40
39

BC
00
??
00

A0
00
4C
00

00
8A
00
40

[Fish PE Shield 1:01 -> HellFish]

signature = 60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00
ep_only = true
[Fish PE Shield 1:12/1:16 -> HellFish]
signature = 60 E8 EA FD FF FF FF D0 C3
00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00
00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ??
40 ?? ?? ?? 00 00 ?? 00 00 00 ?? ?? 00
ep_only = true

8D
??
00
??

40
??
40
??

00
??
??
00

??
00
??
00

00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00
?? 00 00 00 00 ?? ?? 00 ?? ?? 00 00 ?? 00
?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00
40

[Fish PE Shield 1:12/1:16 -> HellFish]

signature = 55 8B EC 83 C4 D0 53 56 57
BD FE FF FF 89 45 DC E8 E1 FD FF FF 8B
EC 8B C3 E8 2E FF FF FF 89 45 F4 BA 04
8B C3 E8 10 FF FF FF 89 45 F0 BA AC 33
C3 E8 F2 FE FF FF 89 45 E8 BA AA FC 0D
5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72
ep_only = false

8B
00
49
06
7C
2B

45
03
32
03
8B

10
45
D3
8B
C3

83
DC
8B
C3
E8

C0
89
C3
E8
E3

0C
45
E8
01
FE

8B
E4
1F
FF
FF

00
E8
FF
FF
FF

89
DC
FF
FF
89

45
FE
FF
89
45

DC
FF
89
45
FC

[Fish PE Shield 1:12/1:16 -> HellFish]

signature = 55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC
-74-

83
FF
45
EC
8B

7D
8B
F8
BA
45

DC
D8
BA
1B
E4

00
BA
54
C6
8B

75
8E
CA
46
58

08
4E
AF
79
04

E8
0E
91
8B
03

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = false
[Fish PE Shield 1:12/1:16 -> HellFish]
signature = 60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00
ep_only = true
[Fish PE Shield 1:16
signature = 60 E8 EA
00 ?? ?? ?? 00 00 ??
00 00 00 ?? ?? 00 00
40 ?? ?? ?? 00 00 ??
ep_only = true

->
FD
??
10
00

HellFish]
FF FF FF D0
00 ?? ?? ??
00 00 ?? ??
00 00 ?? ??

[FishPE V1:0X -> hellfish > Sign

signature = 60 E8 ?? ?? ?? ?? C3
00 00 40 01 00 ?? ?? ?? ?? 00 00
00 00 00 10 00 00 ?? ?? 00 00 ??
00 00 0C 00 00 00 B0 00 00 38 0A
?? ?? ?? 00 00 08 00 00 00 00 01
ep_only = true

by
90
00
??
00
00

C3
00
??
00

8D
00
00
??

40
00
40
??

00
00
??
00

??
00
??
00

00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00
00 00 00 00 00 00 00 00 00 00 00 00 ?? 00
?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00
40

fly]
09 00
00 00
?? ??
00 ??
C8 06

00
00
00
??
00

00
00
00
??
00

2C
00
02
??

00
00
00
00

00
00
00
00

00
00
00
00

??
00
A0
00

??
00
00
00

??
00
00
00

??
00
18
C0

C4
00
01
00

03
99
00
00

00
00
00
40

00
00
??
39

BC
00
??
00

A0
00
??
00

00
8A
??
??

[FishPE V1:0X -> hellfish]

signature = 60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00
00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A
00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00
ep_only = true
[FishPE V1:1X -> hellfish * Sign:By:fly]
signature = 50 45 00 00 4C 01 0A 00 19 5E
19 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ??
00 00 00 02 00 00 04 00 00 00 00 00 00 00
00 00 00 02 00 00 00 00 00 10 00 00 40 00
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ??
00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00
00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
00 00 00 00 00 00 00 00 00 20 00 00 E0 ??
00 00 00 00 00 00 00 00 00 00 00 00 00 00
?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
00 00 00 00 00 00 00 00 C0 ?? ?? ?? ?? ??
00 00 00 00 00 00 00 00 00 00 00 00 00 00
?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00
00 40 00 00 C0 ?? ?? ?? ?? ?? ?? ?? ?? ??
00 00 00 00 00 00 00 00 00 00 40 00 00 C2
00 00 00 00 00 00 00 00 00 00 00 00 00 00
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 04
E0
ep_only = false

42
??
04
00
??
??
18
00
??
??
00
00
??
??
40
00
00
??
??
00
00

2A
??
00
00
??
??
00
00
??
??
00
00
??
??
00
00
00
??
??
00
00

00
??
00
00
??
??
00
00
??
??
00
00
00
??
00
00
00
??
??
00
00

00
??
00
10
??
00
00
00
??
??
00
00
00
??
C0
00
00
??
??
00
00

00
??
00
00
??
00
00
00
??
??
20
00
00
??
??
00
00
??
??
00
00

00
??
00
00
??
00
00
00
??
??
00
00
00
??
??
00
00
??
??
40
00

00
??
00
10
??
00
00
00
00
??
00
00
00
??
??
00
00
??
??
00
00

00
??
00
00
??
00
00
00
00
??
E0
00
00
??
??
00
00
00
??
00
00

00
??
??
00
??
00
00
00
00
??
??
00
00
??
??
00
00
00
??
C0
00

00
??
??
00
??
00
00
00
00
??
??
00
00
??
??
00
00
00
??
??
00

E0
??
??
00
00
00
00
00
00
??
??
00
00
??
??
00
00
00
??
??
00

00
??
??
00
00
00
00
00
00
??
??
00
00
00
??
00
00
00
??
??
00

8E
??
00
00
00
00
??
00
00
??
??
00
00
00
??
C0
00
00
??
??
00

81
??
04
10
00
00
??
00
00
??
??
40
00
00
??
??
00
00
??
??
00

0B
??
00
00
00
00
??
00
00
??
??
00
00
00
??
??
00
00
??
??
E0

01
00
00
00
00
00
??
00
00
00
??
00
00
00
??
??
00
00
??
??
00

02
10
00
00
00
00
??
00
00
00
??
C0
00
00
??
??
00
00
00
??
00

[FixupPak 1:20]
signature = 55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5
8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6
AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8
ep_only = false
[FixupPak v1:20]
signature = 55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5
8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6
AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8 AC 0F B6 C0
-75-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

03 D8 29 13 E2
00 00 00 00 00
00 00 00 00 00
00 00 00 00 00
00 00 00 00 00
00 00 00 00 00
ep_only = true

FA
00
00
00
00
00

EB
00
00
00
00
00

BC
00
00
00
00
00

8D
00
00
00
00
00

04 August 2015 15:14

85
00
00
00
00
00

??
00
00
00
00
00

??
00
00
00
00

00
00
00
00
00

00
00
00
00
00

5D
00
00
00
00

FF
00
00
00
00

E0
00
00
00
00

00
00
00
00
00

00
00
00
00
00

00
00
00
00
00

00
00
00
00
00

08
00
00
00
00

00
00
00
00
00

00
00
00
00
00

00
00
00
00
00

00
00
00
00
00

00
00
00
00
00

00
00
00
00
00

00
00
00
00
00

00
00
00
00
00

00
00
00
00
00

[FOXPRO DOS; Watcom C 386 Run-Time System]

signature = EB J3 8C D8 8E C0 B8 ?? ?? 8E D8 C7 ?? ?? ?? ?? ?? B8 ?? ?? 2D ?? ?? 3B C4 76 ??
C7 ?? ?? ?? ?? ?? 8F ?? ?? ?? 8F ?? ?? ?? 58
ep_only = true
[Free Pascal 0:99:10]
signature = E8 00 6E 00 00 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 29
ep_only = false
[Free Pascal 1:06]
signature = C6 05 ?? ?? 40 00 ?? E8 ?? ?? 00 00
ep_only = false
[Free Pascal v0:99:10]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 00 6E 00 00 55 89 E5
8B 7D 0C 8B 75 08 89 F8 8B 5D 10 29
ep_only = true
[Free Pascal v1:0:10 (win32 console)]
signature = C6 05 ?? ?? ?? 00 01 E8 ?? ?? 00 00 C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00
00 00 00 FF 25 ?? ?? ?? 00 55 89 E5 ?? EC
ep_only = false
[Free Pascal v1:0:10 (win32 GUI)]
signature = C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5
ep_only = false
[FreeBasic 0:14]
signature = 55 89
C0 5D C3 89 F6 55
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
ep_only = true

E5
89
55
??

83
E5
89
55

EC
83
E5
89

08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FF FF FF 89 EC 31
EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 ?? ?? ??
E5

[FreeBasic 0:14]
signature = 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FF FF FF 89 EC 31
C0 5D C3 89 F6 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D
ep_only = true
[FreeBASIC 0:16b]
signature = 55 89
C0 5D C3 89 F6 55
31 C0 5D C3 89 F6
8D BC 27 00 00 00
90 90 90 90 90 90
ep_only = true

E5
89
55
00
90

83
E5
89
55
90

EC
83
E5
89

08
EC
83
E5

C7
08
EC
83

04
C7
08
EC

24
04
8B
08

01
24
45
8B

00
02
08
45

00
00
89
08

00
00
04
89

FF
00
24
04

15
FF
FF
24

??
15
15
FF

??
??
??
15

??
??
??
??

00
??
??
??

E8
00
00
??

88
E8
89
00

FF
68
EC
89

FF
FF
5D
EC

FF
FF
C3
5D

89
FF
8D
C3

EC
89
76
90

31
EC
00
90

[FreeBASIC 0:16b]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31
C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC
31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D
ep_only = false

-76-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[FreeBASIC v0:11]
signature = E8 ?? ?? 00 00 E8 01 00 00 00 C3 55 89 E5
ep_only = true
[FreeJoiner 1:5:1
signature = 90 87
00 90 87 FF 90 33
02 00 00 6A 00 68
A3 19 30 40 00 90
ep_only = true

->
FF
C9
80
87

[FreeJoiner 1:5:3
signature = 86 D6
C2 93 60 08 FE 33
00 01 00 00 68 D1
6A 03 6A 00 6A 00
ep_only = false

GlOFF]
90 90 B9
C7 05 09
00 00 00
FF 90 8B

2B
30
6A
15

00
40
03
09

00
00
6A
30

00
00
00
40

BA
00
6A
00

07
00
00
81

10
00
68
C2

40
68
00
04

00
00
00
01

83
01
00
00

C2
00
80
00

03
00
68
F7

90
68
21
DA

87
21
30
6A

FF
30
40
02

90
40
00
6A

90
00
E8
00

B9 04 00 00
6A 00 E8 B7
8F 02 00 00
52

(Stub
90 86
C9 B9
17 40
68 00

engine 1:7:1) -> GlOFF]

F2 B9 93 60 08 FE 90 86
30 74 4D FF 86 D6 90 86
00 6A 00 E8 CE 02 00 00
00 00 80 68 D1 17 40 00

D6
F2
90
E8

90
33
33
9E

86
C9
C9
02

F2
C7
86
00

B9
05
D6
00

9D
B4
90
A3

13
17
86
CD

45
40
F2
17

01
00
6A
40

86
00
00
00

D6
00
68
86

90 86 F2 81
00 00 90 68
80 00 00 00
D6

[FreeJoiner 1:5:3
signature = E8 02
88 10 40 00 FF 25
10 40 00 FF 25 A0
ep_only = true

(Stub
FD FF
8C 10
10 40

engine 1:7:1) -> GlOFF]

FF 6A 00 E8 0D 00 00 00 CC FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25
40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C
00 FF 25 A8 10 40 00

[FreeJoiner Small
signature = E8 ??
80 10 40 00 FF 25
10 40 00 FF 25 98
40 00
ep_only = true

(build 014-020) -> GlOFF]

?? FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25
84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94
10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10

[FreeJoiner Small
signature = E8 0E
80 10 40 00 FF 25
10 40 00 FF 25 98
40 00
ep_only = true

(build 014/015) -> GlOFF]

FE FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25
84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94
10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10

[FreeJoiner Small
signature = 55 8B
6A 00 68 80 00 00
40 00 40 0F 84 8B
86 FF 6A 00 8D 45
FC 50 6A 01 8D 45
ep_only = false

(build 014/015) -> GlOFF]

EC 83 C4 F0 86 FF 68 00 01
00 6A 03 6A 00 6A 00 68 00
01 00 00 90 90 90 90 90 6A
FC 50 6A 04 8D 45 F8 50 FF
F3 50

00
00
02
35

00
00
6A
E0

68
80
00
13

F8
68
6A
40

13
F8
FB
00

40
13
FF
E8

00
40
35
B2

6A
00
E0
01

00
E8
13
00

E8
C9
40
00

F3
01
00
8A

01
00
E8
C0

00
00
D1
6A

00
A3
01
00

8A
E0
00
8D

C0
13
00
45

[FreeJoiner Small
signature = 55 8B
00 00 8A E4 6A 00
00 A3 00 20 40 00
00 86 FF 86 DB 86
E4 6A 00 8D 45 FC
ep_only = false

(build 017)
EC 83 C4 F0
68 80 00 00
40 0F 84 97
FF 6A 00 8D
50 6A 01 8D

->
86
00
01
45
45

GlOFF]
FF 86 DB
6A 03 6A
00 00 8A
FC 50 6A
F3 50

FF
6A
6A
8D

68
00
02
45

00
68
6A
F8

01
00
00
50

00
00
6A
FF

00
00
FB
35

68
80
FF
00

18
68
35
20

20
18
00
40

40
20
20
00

00
40
40
E8

6A
00
00
BD

00
E8
E8
01

E8
D5
E0
00

FF
01
01
00

01
00
00
8A

[FreeJoiner Small
signature = E8 FE
80 10 40 00 FF 25
10 40 00 FF 25 98
40 00
ep_only = true

(build 017)
FD FF FF 6A
84 10 40 00
10 40 00 FF

->
00
FF
25

GlOFF]
E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25
25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94
9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10

86
00
E4
04

[FreePascal 1:0:4 Win32 -> (Berczi Gabor; Pierre Muller & Peter Vreman)]
-77-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 55 89 E5 C6 05 ?? ?? ?? ?? 00 E8 ?? ?? ?? ?? 55 31 ED 89 E0 A3 ?? ?? ?? ?? 66 8C
D5 89 2D ?? ?? ?? ?? DB E3 D9 2D ?? ?? ?? ?? 31 ED E8 ?? ?? ?? ?? 5D E8 ?? ?? ?? ?? C9 C3
ep_only = false
[FreePascal 1:0:4 Win32 DLL -> (Berczi Gabor; Pierre Muller & Peter Vreman)]
signature = C6 05 ?? ?? ?? ?? 00 55 89 E5 53 56 57 8B 7D 08 89 3D ?? ?? ?? ?? 8B 7D 0C 89 3D
?? ?? ?? ?? 8B 7D 10 89 3D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F 5E 5B 5D C2 0C 00
ep_only = false
[FreePascal 2:0:0
signature = 55 89
?? ?? ?? ?? 55 31
?? ?? ?? ?? 5D E8
ep_only = false

Win32
E5 C6
ED 89
?? ??

->
05
E0
??

(Berczi Gabor; Pierre Muller & Peter Vreman)]

?? ?? ?? ?? 00 E8 ?? ?? ?? ?? 6A 00 64 FF 35 00 00 00 00 89 E0 A3
A3 ?? ?? ?? ?? 66 8C D5 89 2D ?? ?? ?? ?? E8 ?? ?? ?? ?? 31 ED E8
?? C9 C3

[FreePascal 2:0:0
signature = C6 05
00 00 00 FF 25 D8
92 00 00 00 E8 ED
00 00 89 D8 E8 3E
00 00 00 00 00 00
00 89 E0 A3 ?? 70
00 31 ED E8 72 FF
08 E8 15 04 00 00
FF 45 FC 8B 45 FC
ep_only = true

Win32
00 80
A1 40
00 00
02 00
00 00
40 00
FF FF
A1 ??
83 3C

->
40
00
00
00
55
55
5D
70
C5

(Brczi Gbor;
00 01 E8 74 00
90 90 90 90 90
89 C3 B9 ?? 70
E8 B9 01 00 00
89 E5 C6 05 10
31 ED 89 E0 A3
E8 BC 03 00 00
40 00 89 45 F8
?? 70 40 00 00

[FreePascal 2:0:0
signature = C6 05
00 00 00 FF 25 D8
92 00 00 00 E8 ED
ep_only = true

Win32]
?? ?? ?? ?? 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00
A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8
00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00

[FreePascal 2:0:0
signature = C6 05
00 00 00 FF 25 D8
92 00 00 00 E8 ED
ep_only = true

Win32]
00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00
A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8
00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00

Pierre Muller & Peter Vreman)]

00 00 C6 05 00 80 40 00 00 E8 68
90 90 90 90 90 90 90 55 89 E5 83
40 00 89 DA B8 00 00 00 00 E8 0A
E8 54 02 00 00 8B 5D FC C9 C3 8D
80 40 00 00 E8 D1 03 00 00 6A 00
20 80 40 00 66 8C D5 89 2D 30 80
C9 C3 00 00 00 00 00 00 00 00 00
B8 01 00 00 00 89 45 FC 3B 45 F8
74 09 8B 04 C5 ?? 70 40

00
EC
01
76
64
40
00
7F

00
04
00
00
FF
00
55
2A

00
89
00
00
35
E8
89
FF

50
5D
E8
00
00
B9
E5
4D

E8
FC
C5
00
00
03
83
FC

00
E8
01
00
00
00
EC
90

[Freshbind v2:0 -> gFresh]

signature = 64 A1 00 00 00 00 55 89 E5 6A FF 68 1C A0 41 00
ep_only = true
[from NORMAN Anti-Virus Utilites]
signature = E8 ?? ?? 5B 52 45 2F 4E 44 44 53 5D 0D 0A
ep_only = true
[Frusion -> biff]
signature = 83 EC 0C 53 55 56 57 68 04 01 00 00 C7 44 24 14
ep_only = true
[FSG 1:00 (Eng) -> dulek/xt]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16
46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3
02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38
ep_only = false
[FSG 1:10 (Eng) -> bart/xt]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16
46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02
41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00
ep_only = true
-78-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[FSG 1:10 (Eng) -> dulek/xt -> (Borland C++)]

signature = 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02
CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB
02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA
ep_only = true
[FSG 1:10 (Eng) -> dulek/xt -> (Borland Delphi / Borland
signature = 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A
A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06
A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2
ep_only = true

C++)]
E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB
8A 16 E8 02 00 00 00 8D 46 59 EB 01
AA 87 AC B9 0F BE C9 80

[FSG 1:10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual
signature = 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00
68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB
E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C
ep_only = true
[FSG 1:10 (Eng) -> dulek/xt -> (MASM32
signature = 03 F7 23 FE 33 FB EB 02 CD
EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD
DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD
ep_only = true

C++)]
00 00 EA 5A 58 EB 02 CD 20
02 DC 97 81 EF F7 65 17 43
65 83 EF 43 13

/ TASM32)]
20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83
20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01
20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB

[FSG 1:10 (Eng) -> dulek/xt -> (Microsoft

signature = 03 DE EB 01 F8 B8 80 ?? 42 00
0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1
F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80
ep_only = true

Visual C++ 6:0)]

EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68
EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01
C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE

[FSG 1:20 (Eng) -> dulek/xt -> (Borland C++)]

signature = C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20
8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32
D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6
ep_only = false
[FSG 1:20 (Eng) -> dulek/xt -> (Borland Delphi / Borland
signature = 0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68
33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A
EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C
ep_only = false

C++)]
43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15
16 2B C7 1B C7 80 C2 7A 41 80 EA 10
E3 32 D3 0B CB 81 EA AB

[FSG 1:20 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual
signature = 0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00
EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20
19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20
ep_only = false
[FSG 1:20 (Eng) -> dulek/xt -> (MASM32
signature = 33 C2 2C FB 8D 3D 7E 45 B4
5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00
BF C7 2A D3 E8 02 00 00 00 99 4C 58 80
ep_only = false

C++)]
DE 8D 35 F4 00 00 00 F7 D2
83 F7 22 87 D3 33 FE C1 C3
83 EF 7F EB 01

/ TASM32)]
80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20
00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F
EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE

[FSG 1:20 (Eng) -> dulek/xt -> (Microsoft

signature = EB 02 CD 20 EB 01 91 8D 35 80
93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB
EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20
ep_only = false

Visual C++ 6:0

?? ?? 00 33 C2
58 33 DF EB 01
80 EA 2F EB 01

/ 7:0)]
68 83 93 7E 7D 0C A4 5B 23 C3 68 77
3F E8 02 00 00 00 11 88 58 0F B6 16
52 32 D3 80 E9 CD 80 EA

[FSG 1:20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6:0)]
-79-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00
00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1
34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3
ep_only = false
[FSG 1:31 (Eng) -> dulek/xt]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF
D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0
E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB
ep_only = false
[FSG 1:31 -> dulek/xt]
signature = BE ?? ?? ?? 00 BF ?? ?? ?? 00 BB ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80
ep_only = true
[FSG 1:33 (Eng) -> dulek/xt]
signature = BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16
33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75
0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D
ep_only = true
[FSG 1:3]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16
46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02
41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00
ep_only = false
[FSG v1:00 (Eng) -> dulek/xt]
signature = BB D0 01 40 00 BF
46 12 D2 C3 FC B2 80 A4 6A 02
02 41 B0 10 FF 14 24 12 C0 73
28 AC D1 E8 74 41 13 C9 EB 1C
73 06 83 F8 7F 77 02 41 41 95
13 C9 FF 54 24 04 72 F4 C3 5F
04 43 43 E9 51 FF FF FF 5F BB
FE 0F 75 06 47 FF 37 AF EB 09
1C ?? ?? 00 00 00 00 00 00 00
ep_only = true

00
5B
F9
91
8B
5B
28
FE
00

10
FF
75
48
C5
0F
??
0F

40
14
3F
C1
B3
B7
??
0F

00
24
AA
E0
01
3B
00
84

BE
73
EB
08
56
4F
47
??

??
F7
DC
AC
8B
74
8B
??

??
33
E8
E8
F7
08
37
??

??
C9
43
22
2B
4F
AF
FF

00
FF
00
00
F0
74
57
57

53
14
00
00
F3
13
FF
55

E8
24
00
00
A4
C1
13
FF

0A
73
2B
3D
5E
E7
95
53

00
18
CB
00
EB
0C
33
04

00
33
75
7D
96
EB
C0
09

00
C0
10
00
33
07
AE
06

02
FF
E8
00
C9
8B
75
AD

D2
14
38
73
41
7B
FD
75

75
24
00
0A
FF
02
FE
DB

05
73
00
80
54
57
0F
8B

8A
21
00
FC
24
83
74
EC

16
B3
EB
05
04
C3
EF
C3

[FSG v1:0]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16
46 12 D2 C3 FC B2 80 A4 6A 02 5B
ep_only = true
[FSG v1:10 (Eng) -> bart/xt -> (Watcom C/C++ EXE)]
signature = EB 02 CD 20 03 ?? 8D ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02
ep_only = true
[FSG v1:10 (Eng) -> bart/xt -> WinRAR-SFX]
signature = EB 01 02 EB 02 CD 20 B8 80 ?? 42 00 EB 01 55 BE F4 00 00 00 13 DF 13 D8 0F B6 38
D1 F3 F7
ep_only = true
[FSG v1:10 (Eng) -> bart/xt -> WinRAR-SFX]
signature = 80 E9 A1 C1 C1 13 68 E4 16 75 46 C1 C1 05 5E EB 01 9D 68 64 86 37 46 EB 02 8C E0
5F F7 D0
ep_only = true
[FSG v1:10 (Eng) -> bart/xt]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16
46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02
41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28
-80-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

AC D1 E8 74 41
06 83 F8 7F 77
C9 FF 54 24 04
43 43 E9 52 FF
07 75 06 47 FF
?? ?? 00 00 00
ep_only = true

13
02
72
FF
37
00

C9
41
F4
FF
AF
00

EB
41
C3
5F
EB
00

1C
95
5F
BB
09
00

04 August 2015 15:14

91
8B
5B
27
FE
00

48
C5
0F
??
07
00

C1
B3
B7
??
0F

E0
01
3B
00
84

08
56
4F
47
1A

AC
8B
74
8B
??

E8
F7
08
37
??

22
2B
4F
AF
FF

00
F0
74
57
57

00
F3
13
FF
55

00
A4
C1
13
FF

3D
5E
E7
95
53

00
EB
0C
33
04

7D
96
EB
C0
09

00
33
07
AE
06

00
C9
8B
75
AD

73
41
7B
FD
75

0A
FF
02
FE
DB

80
54
57
07
8B

FC
24
83
74
EC

05
04
C3
EF
C3

73
13
04
FE
1B

[FSG v1:10 (Eng) -> dulek/xt -> (Borland C++ 1999)]

signature = EB 02 CD 20 2B C8 68 80 ?? ?? 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B
0F B6 C9
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Borland C++)]
signature = 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02
CD 20 BB
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Borland C++)]
signature = 23 CA EB 02 5A 0D E8 02 00 00 00 6A
CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01
02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81
0F BE 0E 88 16 EB 01 5F EB 01 6B 46 EB 01 6D 0F
B0 EB 01 99 C1 C1 05 91 9D B2 E3 22 E2 A1 E2 F2
57 E7 6C F8 28 F4 B4 A5 94 62 15 BD 86 95 E4 E1
06 55 03 95 E4 23 92 F2 E1 F6 06 F4 A2 55 DB 57
E2 E2 E2 CD 0A 8E B3 CA 56 23 F5 AB CD FE 73 2A
EC 62 DE E7 55 E8 65 DA 61 59 E4
ep_only = true

35
5F
EA
BE
22
F6
21
A3

58
EB
AB
C0
E2
06
8C
C2

C1
02
AB
4B
A0
55
CD
EA

C9
CD
19
EB
??
DA
BE
8E

10
20
08
02
??
15
CA
CA

BE
8A
04
CD
??
AB
25
04

80
16
D5
20
E2
E1
E2
E2

??
EB
03
0F
35
F6
E2
E2

??
02
C2
BE
CA
06
E2
E2

00
11
80
C9
EC
55
0D
1F

0F
31
EA
2B
E2
FA
AD
E2

B6
80
33
C9
E2
15
57
5F

C9
E9
0F
3B
E2
A2
F2
E2

EB
31
B6
D9
E4
E1
CA
E2

02
EB
C9
75
B4
F6
1A
55

[FSG v1:10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]
signature = 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB
A0 03 F7
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Borland Delphi
signature = 2B C2 E8 02 00 00 00 95 4A 59 8D 3D
A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03
A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB
00 00 00 64 59 02 D3 EB 02 D6 5C 88 16 EB 02 CD
DB 75 B1 EB 02 50 AA 91 44 5C 90 D2 95 57 9B AE
43 D6 5E ED 20 EF B2 A6 98 69 1F CA 96 A8 FA FA
4F A1 52 E7 39 7B ED 50 42 5A 6D 5E 0F C5 4E CD
88 8B 8E 7C BC 43 6B 85 14 E4 B9 72 97 CB 43 FD
EF 68 E7 F3 64 FA 7A F2 7C 77 05
ep_only = true

/ Borland C++)]
52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB
CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01
58 81 C2 AA 87 AC B9 0F BE C9 80 EA 0F E8 01
20 46 E8 02 00 00 00 6B B5 59 4B 0F B7 C6 0B
E1 A4 65 ?? ?? ?? B3 09 A1 C6 BF C2 C5 CA 9D
12 25 77 F 3D D6 0F 27 3A 8C 34 52 E2 24 3C
9A 08 4C 40 4F AD 6D 70 73 A1 44 F1 8F 6A BD
79 9B C6 6D AC E9 CA CD D0 10 D6 56 DC DF 55

[FSG v1:10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)]
signature = EB 01 2E EB 02 A5 55 BB 80 ?? ?? 00 87 FE 8D 05 AA CE E0 63 EB 01 75 BA 5E CE E0
63 EB 02
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Borland Delphi
signature = 2B C2 E8 02 00 00 00 95 4A 59 8D 3D
A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03
A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB
00 00 00 64 59 02 D3 EB 02 D6 5C 88 16 EB 02 CD
DB 75 B1 EB 02 50 AA 91 44 5C 90 D2 95 57 9B AE
43 D6 5E ED 20 EF B2 A6 98 69 1F CA 96 A8 FA FA
4F A1 52 E7 39 7B ED 50 42 5A 6D 5E 0F C5 4E CD
88 8B 8E 7C BC 43 6B 85 14 E4 B9 72 97 CB 43 FD
EF 68 E7 F3 64 FA 7A F2 7C 77 05

/ Borland C++)]
52 F1 2A E8 C1 C8
CB 8A 06 8A 16 E8
58 81 C2 AA 87 AC
20 46 E8 02 00 00
E1 A4 65 ?? ?? ??
12 25 77 FF 3D D6
9A 08 4C 40 4F AD
79 9B C6 6D AC E9

-81-

1C
02
B9
00
B3
0F
6D
CA

BE
00
0F
6B
09
27
70
CD

2E
00
BE
B5
A1
3A
73
D0

??
00
C9
59
C6
8C
A1
10

??
8D
80
4B
BF
34
44
D6

18
46
EA
0F
C2
52
F1
56

EB
59
0F
B7
C5
E2
8F
DC

02
EB
E8
C6
CA
24
6A
DF

AB
01
01
0B
9D
3C
BD
55

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++ / ASM)]
signature = EB 02 CD 20 EB 02 CD 20 EB 02 CD 20 C1 E6 18 BB 80 ?? ?? 00 EB 02 82 B8 EB 01 10
8D 05 F4
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)]
signature = C1 C8 10 EB 01 0F BF 03 74 66 77 C1 E9 1D 68 83 ?? ?? 77 EB 02 CD 20 5E EB 02 CD
20 2B F7
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Borland Delphi
signature = 1B DB E8 02 00 00 00 1A 0D 5B 68 80
68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C
E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1
F7 DA 03 FE EB 02 CD 20 87 FA 88 10 EB 02 CD 20
AF EB 02 DE 09 EB 01 EF 34 4A 7C BC 7D 3D 7F 90
05 96 1C A9 DA A7 68 5A 4A 19 CD 76 40 50 A0 9E
D3 23 D2 65 B5 F5 65 C6 B6 CC DD CC 7B 2F B6 33
CE CF D0 BC FA 7F A5 BD 4A 18 EB A2 C5 F7 6D 25
F7 6E EB F5 64 F8 76 EC 74 6D F9
ep_only = true

/ Microsoft
?? ?? 00 E8
8B 38 EB 01
83 EF 17 EB
40 E8 02 00
C1 82 41 ??
B4 C5 15 9B
FE 6A AC 9E
9F BF E8 8D

Visual C++)]
01 00 00 00 EA
35 EB 02 DC 97
02 0C 65 83 EF
00 00 F1 F8 5B
?? ?? 87 DB 71
D7 6E A5 BB CC
AB 07 C5 C6 C7
CA 05 E4 E5 E6

5A
81
43
4E
94
1C
F3
24

58
EF
13
2B
8B
C2
94
E8

EB
F7
D6
D2
8C
DE
3F
66

02
65
83
85
8D
6C
DB
EA

CD
17
C7
F6
90
AC
B4
EB

20
43
32
75
61
C2
05
5F

[FSG v1:10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)x]
signature = 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20
68 F4 00
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Borland Delphi 2:0)]
signature = EB 01 56 E8 02 00 00 00 B2 D9 59 68 80 ?? 41 00 E8 02 00 00 00 65 32 59 5E EB 02
CD 20 BB
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Borland Delphi
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
75
ep_only = true

4:0 ?? ??
?? ??
?? ??
46 ??

5:0)]
?? ??
?? ??
?? ??
?? ??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

EB
??
??
??

02
??
??
??

??
??
??
??

??
??
??
??

[FSG v1:10 (Eng) -> dulek/xt -> (MASM32 / TASM32 / Microsoft Visual Basic)]
signature = F7 D8 0F BE C2 BE 80 ?? ?? 00 0F BE C9 BF 08 3B 65 07 EB 02 D8 29 BB EC C5 9A F8
EB 01 94
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (MASM32 / TASM32)]
signature = 03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83
EE 05 2B
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (MASM32 /
signature = 03 F7 23 FE 33 FB EB 02 CD 20
EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20
DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20
F6 09 88 0B F7 DE 0F B6 F2 43 EB 02 CD 20
01 00 00 00 81 5F F7 D7 D9 EE 1F 5E 1E DD
93 23 A8 34 64 30 F0 E1 D0 9E 51 F9 C2 D1
42 91 3F D1 20 5F CE 2E 1D 32 42 30 DE 91
1E 1E 1E 09 46 CA EF 06 92 5F 31 E7 09 3A
28 9E 1A 23 91 24 A1 16 9D 95 20

TASM32)]
BB 80 ??
8A 0B E8
80 E9 4B
C1 E7 0A
1E 2E 5E
20 1D 32
17 93 5D
AF 66 DF

-82-

40
02
C1
48
1E
42
C8
FE

00
00
CF
EB
DC
91
09
26

EB
00
08
01
??
16
FA
CA

01
00
EB
89
??
51
06
06

86
A9
01
C1
5E
E7
61
40

EB
54
71
E7
1E
1D
1E
1E

01
5E
80
14
71
32
1E
1E

90
C1
E9
2B
06
42
1E
1E

B8
EE
1C
FF
28
91
49
5B

F4
07
EB
3B
1E
36
E9
1E

00
F7
02
C7
1E
51
93
9B

00
D7
F0
75
1E
DE
2E
1E

00
EB
49
A8
20
1D
06
1E

83
01
C1
E8
F0
32
56
91

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (MASM32)]
signature = EB 01 DB E8 02 00 00 00 86 43 5E 8D 1D D0 75 CF 83 C1 EE 1D 68 50 ?? 8F 83 EB 02
3D 0F 5A
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual Basic / MASM32)]
signature = EB 02 09 94 0F B7 FF 68 80 ?? ?? 00 81 F6 8E 00 00 00 5B EB 02 11 C2 8D 05 F4 00
00 00 47
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual Basic 5:0 / 6:0)]
signature = C1 CB 10 EB 01 0F B9 03 74 F6 EE 0F B6 D3 8D 05 83 ?? ?? EF 80 F3 F6 2B C1 EB 01
DE 68 77
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual C / Basic :NET)]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
ep_only = true

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
77
??
B3

??
??
??
??
??
??
??

??
??
??
??
??
??
??

[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 4:x / LCC Win32 1:x)]
signature = 2C 71 1B CA EB 01 2A EB 01 65 8D 35 80 ?? ?? 00 80 C9 84 80 C9 68 BB F4 00 00 00
EB 01 EB
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 5:0 / 6:0)]
signature = 33 D2 0F BE D2 EB 01 C7 EB 01 D8 8D 05 80 ?? ?? ?? EB 02 CD 20 EB 01 F8 BE F4 00
00 00 EB
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6:0 / 7:0 / ASM)]
signature = E8 01 00 00 00 5A 5E E8 02 00 00 00 BA DD 5E 03 F2 EB 01 64 BB 80 ?? ?? 00 8B FA
EB 01 A8
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6:0 / 7:0)]
signature = 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? ?? EB 02 CD 20 03 D3 8D
35 F4 00
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6:0 / 7:0)]
signature = 87 FE E8 02 00 00 00 98 CC 5F BB 80 ?? ?? 00 EB 02 CD 20 68 F4 00 00 00 E8 01 00
00 00 E3
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6:0 / 7:0)]
signature = EB 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6:0 / 7:0)]
signature = F7 D8 40 49 EB 02 E0 0A 8D 35 80 ?? ?? ?? 0F B6 C2 EB 01 9C 8D 1D F4 00 00 00 EB
01 3C 80
ep_only = true

-83-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6:0 / 7:0)]
signature = 87 FE ?? 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
00
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6:0 / 7:0)]
signature = F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? A7 BA 80 EA 9D 58 C1 C2 09 2B C1
8B D7 68
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual C++
signature = 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01
35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B
5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14
EB 02 CD 20 87 FA 88 10 80 F3 CA EB 02 CD 20 40 03 D7
75 AC F7 DA 80 C3 AF 91 1C 31 62 A1 61 20 61 71 A1 61
D6 66 EB 77 A7 73 33 24 13 E1 94 3C 05 14 63 60 75 85
85 D4 82 14 63 A2 11 71 60 75 85 73 21 D4 5A D6 A0 0B
61 61 61 4C 89 0D 32 49 D5 A2 74 2A 4C 7D F2 A9 22 41
6B E1 5D 66 D4 67 E4 59 E0 D8 63
ep_only = true

6:0 /
9D B8
38 EB
EB 02
0B D0
1F ??
D4 59
4C 3D
69 0D

7:0)]
80 ??
02 AC
CD 20
4E 1B
?? ??
94 2A
49 A4
49 83

[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual C++

signature = 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01
35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B
5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14
ep_only = true

6:0 /
9D B8
38 EB
EB 02

7:0)]
80 ?? ?? 00 EB 02 CD 20 03 D3 8D
02 AC BA 03 DB E8 01 00 00 00 A5
CD 20 33 D3 83 EF 27

??
BA
33
D2
61
60
61
61

00
03
D3
EB
B4
75
61
61

EB
DB
83
02
49
85
61
61

02
E8
EF
CD
6B
D4
8C
9E

CD
01
27
20
61
79
2C
61

20
00
EB
2B
61
94
D6
DE

03
00
02
D2
61
21
71
61

D3
00
82
3B
63
60
49
61

8D
A5
53
F2
33
75
99
D4

[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6:0 / ASM)]
signature = F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B ?? ?? FB C1 C1 03 33 F7 EB 02
CD 20 68
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6:0)]
signature = D1 E9 03 C0 68 80 ?? ?? 00 EB 02 CD 20 5E 40 BB F4 00 00 00 33 CA 2B C7 0F B6 16
EB 01 3E
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6:0)]
signature = F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? ?? BA 80 EA 9D 58 C1 C2 09 2B C1
8B D7 68
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual C++
signature = EB 01 ?? EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
ep_only = true

6:0)]
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80

[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6:0)]
signature = EB 02 CD 20 ?? CF ?? ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6:0)]
signature = EB 01 4D 83 F6 4C 68 80 ?? ?? 00 EB 02 CD 20 5B EB 01 23 68 48 1C 2B 3A E8 02 00
00 00 38
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6:0)]
signature = 91 EB 02 CD 20 BF 50 BC 04 6F 91 BE D0 ?? ?? 6F EB 02 CD 20 2B F7 EB 02 F0 46 8D
1D F4 00
ep_only = true
-84-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6:0)]
signature = C1 CE 10 C1 F6 0F 68 00 ?? ?? 00 2B FA 5B 23 F9 8D 15 80 ?? ?? 00 E8 01 00 00 00
B6 5E 0B
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual C++
signature = 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20
0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20
F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7
57 EB 02 CD 20 5A 88 10 EB 02 CD 20 40 E8 02 00 00 00
3B F3 75 B1 C1 F3 0D 92 B8 DC 0C 4E 0D B7 F7 0A 39 F4
6B FE 82 0D 28 F3 B6 A6 A0 71 1F BA 92 9C EE DA FE 0D
FB 4D EA 77 C9 03 75 E0 D2 D6 E5 E2 8B 41 B6 41 FA 70
A8 A7 AA A0 DC 5F 73 9D 14 F0 B5 6A 87 B7 3B E5 6D 77
93 08 83 9B F8 9E 0A 8E 10 F7 85
ep_only = true

6:0)]
68 17
43 0F
8A 8F
C5 62
B5 ??
47 DB
B0 A0
B2 45

A0
BE
67
5A
??
09
AB
8C

B3
38
8B
4E
36
AE
F9
B9

AB
13
80
E8
FF
DF
B5
96

EB
D6
C3
01
45
E3
C0
95

01
80
C7
00
D9
F6
BF
A0

E8
C3
2B
00
FA
50
ED
DC

59
47
FE
00
FB
E4
78
A2

0F
2B
EB
43
FE
12
25
1E

B6
FE
02
5A
FD
9E
CB
9C

DB
EB
CD
2B
FE
C8
96
9B

68
01
20
DB
CD
EC
E5
11

[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6:0)]
signature = EB 02 AB 35 EB 02 B5 C6 8D 05 80 ?? ?? 00 C1 C2 11 BE F4 00 00 00 F7 DB F7 DB 0F
BE 38 E8
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6:0)]
signature = 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68
0B A1 B3
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6:0)]
signature = E8 01 00 00 00 0E 59 E8 01 00 00 00 58 58 BE 80 ?? ?? 00 EB 02 61 E9 68 F4 00 00
00 C1 C8
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt -> (Microsoft Visual C++
signature = EB 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? EB
ep_only = true

7:0)]
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??

[FSG v1:10 (Eng) -> dulek/xt -> (MS Visual C++ / Borland C++ / Watcom C++)]
signature = EB 02 CD 20
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt]
signature = EB 02 ?? ?? EB 02
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt]
signature = E8 01 00 00 00 ?? ?? E8 ?? 00 00 00
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt]
signature = EB 01 ?? EB 02 ?? ?? ?? 80 ?? ?? 00
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt]
signature = BB D0 01 40 ?? BF ?? 10 40 ?? BE
ep_only = true
[FSG v1:10 (Eng) -> dulek/xt]
signature = ?? ?? EB ?? ?? ?? ?? ?? ?? 00
-85-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[FSG v1:10 (Eng) -> dulek/xt]
signature = EB 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? F6
ep_only = true
[FSG v1:1]
signature = BB D0 01 40 ?? BF ?? 10 40 ?? BE ?? ?? ?? ?? FC B2 80 8A 06 46 88 07 47 02 D2 75
05 8A 16
ep_only = true
[FSG v1:20 (Eng) -> dulek/xt -> (Borland C++)]
signature = C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00
8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB
D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02
2A D3 E8 01 00 00 00 ED 58 88 16 13 C3 46 EB 02
00 00 00 D7 6B 58 EB 00 9E 96 6A 28 67 AB 69 54
9F 10 8C 37 C6 41 80 4C 5E 8B DB 60 4C 3A 28 08
95 C5 94 03 33 6F FF 92 20 98 87 9C E5 B9 20 B5
5A 59 54 26 66 E9 3F 27 DE 8E 7D 34 53 61 F7 AF
61 7A FD EF 7E E8 70 F8 6E 7B EF
ep_only = true

00
EB
81
CD
??
58
C1
83

00
02
C2
20
31
13
7F
60

00
CD
F6
2B
0D
2D
72
5F

0F
20
56
C9
63
B8
71
52

B6
80
7B
3B
44
86
65
92

06
EA
F6
D9
35
AE
3E
5C

EB
73
EB
75
38
C8
A9
D0

02
1B
02
A1
37
58
85
56

CD
CF
56
E8
18
16
20
55

20
32
7B
02
87
A6
AF
C9

[FSG v1:20 (Eng) -> dulek/xt -> (Borland Delphi

signature = 0F BE C1 EB 01 0E 8D 35 C3 BE B6 22
33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02
EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6
77 2A D3 EB 01 87 2A D3 E8 01 00 00 00 92 59 88
DB 75 AE C1 E0 04 EB 00 DA B2 82 5C 9B C7 89 98
27 D4 50 CF 9A D5 1C EC F2 27 77 18 40 4E A4 A8
15 45 18 8F BB 07 93 BE C0 BC A3 B0 9D 51 D4 F1
96 99 98 72 B2 31 57 7B FA AE 9D 28 4F 99 EF A3
55 76 FD F7 8A FC 78 0C 82 87 0F
ep_only = true

/ Borland C++)]
F7 D1 68 43 ?? ??
08 AD 8A 16 2B C7
AB EE 2C E3 32 D3
16 EB 02 52 08 46
4F 8A F7 ?? ?? ??
B4 CB 9F 1D D9 EC
08 22 62 96 6D 09
25 49 60 03 42 8B

22
1B
0B
EB
B1
1F
73
54

EB
C7
CB
02
4D
AD
7E
53

02
80
81
CD
DF
BC
71
5E

B5
C2
EA
20
B8
82
A5
92

15
7A
AB
4B
AD
AA
3A
50

5F
41
EE
80
AC
C0
E5
D4

C1
80
90
F1
AB
4C
7D
52

F1
EA
14
C2
D4
0A
94
4D

15
10
2C
85
07
A2
A3
C1

[FSG v1:20 (Eng) -> dulek/xt -> (Borland Delphi

signature = 0F B6 D0 E8 01 00 00 00 0C 5A B8 80
EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88
19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF
01 7F 81 EF DF 30 90 1E EB 02 CD 20 87 FA 88 10
A2 EB 02 CD 20 EB 01 C3 78 73 42 F7 35 6C 2D 3F
02 72 E9 1F 2D 67 B1 C0 91 FD 10 58 A3 90 71 6C
11 C0 0E 00 33 76 85 33 3C 33 21 31 F5 50 CE 56
F3 ED EF C8 0B 89 A6 CD 77 42 F0 A6 C8 19 66 3D
DF B3 39 32 C0 2D B0 3F B4 B4 43
ep_only = true

/ Microsoft
?? ?? 00 EB
F4 4C EB 02
6F 18 EB 02
80 EA 03 40
ED 33 97 ??
83 11 E0 5D
6C 89 C8 F7
B2 CD E7 89

Visual C++)]
02 00 DE 8D 35
CD 20 83 F7 22
CD 20 83 EF 7F
EB 01 20 4E EB
?? ?? 5D F0 45
20 AE 5C 71 83
CD 70 D5 E3 DD
CB 13 D7 D5 E3

F4
87
EB
01
29
D0
08
1E

00
D3
01
3D
55
7B
E8
DF

00
33
F7
83
57
10
4E
5A

00
FE
2B
FE
55
97
25
E3

F7
C1
FE
00
71
54
FF
D5

D2
C3
EB
75
63
17
0D
50

45
E9
E8
C0
??
DC
42
E5

8C
8A
9D
00
53
97
70
23

7F
16
CE
00
82
3D
CF
EF

EB
0F
58
00
83
D9
B8
61

02
B6
80
00
80
63
12
E5

CD
C9
EA
3B
47
1F
2B
E2

20
0F
33
D9
B4
55
78
54

[FSG v1:20 (Eng) -> dulek/xt -> (MASM32 /

signature = 33 C2 2C FB 8D 3D 7E 45 B4 80
5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00
BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA
C1 E1 12 32 D3 48 80 C2 26 EB 02 CD 20 88
75 B7 EB 01 14 EB 01 0A CF C5 93 53 90 DA
D2 41 FB 64 31 6A AF 7D 89 BC 0A 91 D7 83
42 F0 45 32 60 9A 28 51 61 4B 38 4B 12 E4
09 06 07 17 55 D6 EA 10 8D 3F 28 E5 02 0E
EA A9 2A 22 AF 17 A1 23 97 9A 1C
ep_only = true

1B
02
D3
CD
03
30
68
09

TASM32)]
E8 02 00
00 80 F1
53 C1 C9
16 F7 D8
96 67 54
37 39 43
49 C4 99
A2 58 B8

C6
CD
EB
20
3E
BF
DE
29

00
2C
16
46
8D
50
09
D6

8D
20
02
4B
7F
93
16
5C

00
5B
2A
EB
CC
A2
47
0F

1D
2A
DB
EB
??
05
4A
F7

8A
C1
D3
01
??
32
F9
A8

F4
D3
5B
02
??
D1
15
36

58
05
02
4B
51
81
8C
10

68
0F
00
40
8E
32
48
EB

02
B6
00
8D
18
3A
51
E8

??
C9
00
0D
74
4B
4E
F1

[FSG v1:20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6:0 / 7:0)]
signature = EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77
93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16
-86-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

EB 02 CD 20 EB
C2 96 44 EB 04
83 FB 00 75 B2
9B 49 C6 32 02
AC D9 2D 15 4E
10 10 0C 1F 68
16 D0 54 4B D7
ep_only = true

02
EB
F7
3E
8F
DC
42

86
02
D9
7E
1C
FF
C3

2F
CD
96
7B
40
24
54

2A
20
8F
5E
4F
8C
CB

04 August 2015 15:14

D3
88
80
8C
28
4D
C9

EB
16
4D
C5
98
29
4E

02
E8
0C
6B
3E
F5

CD
02
4C
50
10
1D

20
00
91
3F
C1
2C

80
00
50
0E
45
BF

EA
00
1C
0F
DB
74

2F
44
0C
38
8F
CF

EB
A2
50
C8
06
F0

[FSG v1:20 (Eng) -> dulek/xt -> (Microsoft Visual C++

signature = C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE
00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01
34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80
EB 01 08 88 16 80 F1 98 80 C9 28 46 91 EB 02 C0 55 4B
00 9D 59 0B C6 EB 01 6C E9 D2 C3 82 C2 03 C2 B2 82 C2
3D CF 4C D8 84 D0 0C FD F0 42 77 0D 66 F1 AC C1 DE CE
EE 3F 23 77 C4 01 72 12 C1 0E 1E 14 82 37 AB 39 01 88
C2 C2 C2 A9 EA 6E 91 AA 2E 03 CF 7B 9F CE 51 FA 6D A2
B8 42 C6 8D 31 88 45 BA 3D 2B BC
ep_only = true

01
59
8A
95
3F
24

52
46
??
18
EC
C0

32
E8
??
D1
48
08

D3
01
??
65
61
2E

80
00
50
11
4C
0C

E9
00
E9
2C
50
0C

CD
00
34
B8
50
10

80
AD
16
87
81
51

EA
59
50
28
DF
0C

73
4B
4C
C3
C3
91

8B
80
4C
4C
20
10

CF
C1
0E
0B
34
10

81
13
7E
3C
84
81

6:0)]
80 ??
C2 C1
F2 1A
EB 01
00 ??
97 BA
C9 DE
AA 56

42
E0
0F
55
??
D7
CA
8A

00
0A
BE
34
7C
EB
07
E4

49
EB
C9
44
C2
C3
C2
C2

EB
01
F7
0B
6F
AE
C2
C2

01
A1
D1
DB
DA
DE
C2
C2

99
81
2A
75
BC
91
17
07

8D
EA
D3
AD
C2
AA
79
C2

1D
A8
EB
E8
C2
D5
49
47

F4
8C
02
01
C2
02
B2
C2

00
18
42
00
CC
0D
DA
C2

00
A1
C0
00
1C
1E
0A
17

[FSG v1:2]
signature = 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00
00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 ?? 00 00 00 00 00
ep_only = true
[FSG v1:30 (Eng) -> dulek/xt]
signature = BB D0 01 40 00 BF
46 12 D2 C3 B2 80 A4 6A 02 5B
41 B0 10 FF 14 24 12 C0 73 F9
AC D1 E8 74 41 13 C9 EB 1C 91
06 83 F8 7F 77 02 41 41 95 8B
C9 FF 54 24 04 72 F4 C3 5F 5B
43 43 E9 52 FF FF FF 5F BB ??
0F 75 06 47 FF 37 AF EB 09 FE
?? ?? 00 00 00 00 00 00 00 00
ep_only = true

00
FF
75
48
C5
0F
??
0F
00

10
14
3F
C1
B3
B7
??
0F

40
24
AA
E0
01
3B
00
84

00
73
EB
08
56
4F
47
??

BE
F7
DC
AC
8B
74
8B
??

??
33
E8
E8
F7
08
37
??

??
C9
43
22
2B
4F
AF
FF

??
FF
00
00
F0
74
57
57

00
14
00
00
F3
13
FF
55

53
24
00
00
A4
C1
13
FF

E8
73
2B
3D
5E
E7
95
53

0A
18
CB
00
EB
0C
33
04

00
33
75
7D
96
EB
C0
09

00
C0
10
00
33
07
AE
06

00
FF
E8
00
C9
8B
75
AD

02
14
38
73
41
7B
FD
75

D2
24
00
0A
FF
02
FE
DB

75
73
00
80
54
57
0F
8B

05
21
00
FC
24
83
74
EC

8A
B3
EB
05
04
C3
EF
C3

16
02
28
73
13
04
FE
??

[FSG v1:31 (Eng) -> dulek/xt]

signature = BB D0 01 40 00 BF
D3 73 F9 33 C9 FF D3 73 16 33
E8 46 00 00 00 02 F6 83 D9 01
E0 08 AC E8 22 00 00 00 3D 00
00 56 8B F7 2B F0 F3 A4 5E EB
D2 C3 5B 5B 0F B7 3B 4F 74 08
FF 5F BB ?? ?? ?? 00 47 8B 37
AF EB 09 FE 0F 0F 84 ?? ?? ??
00 00 00 00 00 00 00 88 01 00
ep_only = true

00
C0
75
7D
97
4F
AF
FF
00

10
FF
10
00
33
74
57
57

40
D3
E8
00
C9
13
FF
55

00
73
38
73
41
C1
13
FF

BE
23
00
0A
FF
E7
95
53

??
B6
00
80
D3
0C
33
04

??
80
00
FC
13
EB
C0
89

??
41
EB
05
C9
07
AE
06

00
B0
28
73
FF
8B
75
AD

53
10
AC
06
D3
7B
FD
85

BB
FF
D1
83
72
02
FE
C0

??
D3
E8
F8
F8
57
0F
75

??
12
74
7F
C3
83
74
D9

??
C0
48
77
02
C3
EF
8B

00
73
13
02
D2
04
FE
EC

B2
FA
C9
41
75
43
0F
C3

80
75
EB
41
05
43
75
??

A4
42
1C
95
8A
E9
06
??

B6
AA
91
8B
16
58
47
??

80
EB
48
C5
46
FF
FF
00

FF
E0
C1
B6
12
FF
37
00

[FSG v1:31]
signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 BB ?? ?? ?? ?? B2 80 A4 B6 80 FF
D3 73 F9 33 C9
ep_only = true
[FSG v1:33 (Eng) -> dulek/xt]
signature = BE A4 01 40 00 AD
33 C0 FF 13 73 1F B6 80 41 B0
0E FF 53 04 EB 26 AC D1 E8 74
80 FC 05 73 06 83 F8 7F 77 02
48 74 0A 79 02 AD 50 56 8B F2
F0 79 05 46 AD 50 EB 09 FE 0E

93
10
2F
41
97
0F

AD
FF
13
41
EB
84

97
13
C9
95
87
??

AD
12
EB
8B
AD
??

56
C0
1A
C5
93
??

96
73
91
B6
5E
FF

B2
FA
48
00
46
56

-87-

80
75
C1
56
AD
55

A4
3C
E0
8B
97
FF

B6
AA
08
F7
56
53

80
EB
AC
2B
FF
04

FF
E0
FF
F0
13
AB

13
FF
53
F3
95
EB

73
53
04
A4
AC
E0

F9
08
3D
5E
84
33

33
02
00
EB
C0
C9

C9
F6
7D
9D
75
41

FF
83
00
8B
FB
FF

13
D9
00
D6
FE
13

73
01
73
5E
0E
13

16
75
0A
AD
74
C9

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

FF 13 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 54 01 00 00
?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 01 00 00 6F 01 00
00 00 00 00 00 00 00 00 00 00 00
ep_only = true
[FSG v1:33 (Eng) -> dulek/xt]
signature = BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16
33 C0 FF
ep_only = true
[FSG v1:33]
signature = BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73
ep_only = true
[FSG v1:3]
signature = BB D0
46 12 D2 C3 B2 80
41 B0 10 FF 14 24
AC D1 E8 74 41 13
06 83 F8 7F 77 02
C9 FF 54 24 04 72
43 43 E9 52 FF FF
ep_only = false

01
A4
12
C9
41
F4
FF

40
6A
C0
EB
41
C3
5F

00
02
73
1C
95
5F
BB

BF
5B
F9
91
8B
5B
??

00
FF
75
48
C5
0F
??

10
14
3F
C1
B3
B7
??

40
24
AA
E0
01
3B
??

00
73
EB
08
56
4F
47

BE
F7
DC
AC
8B
74
8B

??
33
E8
E8
F7
08
37

??
C9
43
22
2B
4F
AF

??
FF
00
00
F0
74
57

??
14
00
00
F3
13
FF

53
24
00
00
A4
C1
13

E8
73
2B
3D
5E
E7
95

0A
18
CB
00
EB
0C
33

00
33
75
7D
96
EB
C0

00
C0
10
00
33
07
AE

00
FF
E8
00
C9
8B
75

02
14
38
73
41
7B
FD

D2
24
00
0A
FF
02
FE

75
73
00
80
54
57
??

05
21
00
FC
24
83
74

8A
B3
EB
05
04
C3
EF

16
02
28
73
13
04
FE

[FSG v1:3]
signature = BB
46 12 D2 C3 B2
41 B0 10 FF 14
AC D1 E8 74 41
06 83 F8 7F 77
C9 FF 54 24 04
43 43 E9 52 FF
ep_only = true

01
A4
12
C9
41
F4
FF

40
6A
C0
EB
41
C3
5F

00
02
73
1C
95
5F
BB

BF
5B
F9
91
8B
5B
??

00
FF
75
48
C5
0F
??

10
14
3F
C1
B3
B7
??

40
24
AA
E0
01
3B
??

00
73
EB
08
56
4F
47

BE
F7
DC
AC
8B
74
8B

??
33
E8
E8
F7
08
37

??
C9
43
22
2B
4F
AF

??
FF
00
00
F0
74
57

??
14
00
00
F3
13
FF

53
24
00
00
A4
C1
13

E8
73
2B
3D
5E
E7
95

0A
18
CB
00
EB
0C
33

00
33
75
7D
96
EB
C0

00
C0
10
00
33
07
AE

00
FF
E8
00
C9
8B
75

02
14
38
73
41
7B
FD

D2
24
00
0A
FF
02
FE

75
73
00
80
54
57
0F

05
21
00
FC
24
83
74

8A
B3
EB
05
04
C3
EF

16
02
28
73
13
04
FE

D0
80
24
13
02
72
FF

[FSG v2:0 -> bart/xt]

signature = 87 25 ?? ?? ?? 00 61 94 55 A4 B6 80 FF 13
ep_only = true
[FSG v2:0]
signature = 87 25 ?? ?? ?? ?? 61 94 55 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73
1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75
ep_only = false
[Fuck'n'Joy 1:0c -> UsAr]
signature = 60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C
01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84
0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00
ep_only = false
[Fuck'n'Joy v1:0c
signature = 60 E8
01 00 00 89 85 6C
0C 01 00 00 89 85
84 EC 00 00 00 89
0F 84 CC 00 00 00
64 FF 95 74 07 40
07 40 00 E8 4C 02
07 40 00 89 85 78
?? ?? 00 8D 85 F2
ep_only = true

->
00
08
3B
85
89
00
00
07
09

UsAr]
00 00
40 00
08 40
4D 08
85 5C
46 80
00 33
40 00
40 00

00
8D
00
40
08
3E
DB
8D
50

5D
85
8D
00
40
00
53
85
FF

81
2F
85
8D
00
75
53
51

ED
08
3F
85
8D
FA
6A
07

D8
40
08
51
85
C7
02
40

05
00
40
08
67
06
53
00

40
50
00
40
07
74
53
E8

00
FF
50
00
40
6D
68
21

[Fusion 1:0 -> jaNooNi]

-88-

FF
B5
FF
50
00
70
00
02

74
6C
B5
FF
E8
2E
00
00

24
08
6C
B5
7B
83
00
00

20
40
08
6C
02
C6
40
6A

E8
00
40
08
00
04
8D
00

8C
E8
00
40
00
C7
85
8D

02
EF
E8
00
8D
06
C4
85

00
02
CF
E8
B5
65
07
7C

00
00
02
AF
C4
78
40
07

0B
00
00
02
07
65
00
40

C0
0B
00
00
40
00
50
00

0F
C0
0B
00
00
8D
FF
50

84
0F
C0
0B
56
85
95
68

2C
84
0F
C0
6A
36
74
00

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 68 04 30 40 00 68 04 30 40 00 E8 09 03 00 00 68 04 30 40 00 E8 C7 02 00 00
ep_only = true
[G>X Protector 1:2 -> Guru:eXe]
signature = 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00
ep_only = true
[GameGuard - nProtect]
signature = 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60
BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30
B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B
ep_only = true
[GameGuard v2006:5:x:x (*:dll)]
signature = 31 FF 74 06 61 E9 4A 4D 50 30 BA 4C 00 00 00 80 7C 24 08 01 0F 85 ?? 01 00 00 60
BE 00
ep_only = true
[GameGuard v2006:5:x:x (*:exe)]
signature = 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60
BE 00
ep_only = true
[Gamehouse Media Protector Version Unknown]
signature = 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? 00 00 00 00 00 00 00 00
ep_only = true
[Gardian Angel 1:0]
signature = 06 8C C8 8E D8 8E C0 FC BF ?? ?? EB
ep_only = true
[Gentee Installer Custom]
signature = 55 8B EC 81 EC 14 04 00 00 53 56 57 6A 00 FF 15 08 41 40 00 68 00 50 40 00 FF 15
04 41 40 00 85 C0 74 29 6A 00 A1 00 20 40 00 ?? ?? ?? ?? 41 40 00 8B F0 6A 06 56 FF 15 1C 41
40 00 6A 03 56 FF
ep_only = true
[GHF Protector
signature = 60
00 00 00 00 6A
6D 00 00 00 73
00 00 00 10 C0
74 4D 11 C9 EB
7F 77 02 41 41
C9 41 E8 EE FF
?? E2 F5 90 90
C3 50 B8 ?? ??
?? ?? 00 00 00
7E 10 01 D7 03
0F 53 FF 35 ??
?? ?? ?? E9 6E
FF 10 8B 15 ??
ep_only = true

(pack
68 ??
40 FF
F6 31
73 F7
1C 91
95 89
FF FF
BA ??
?? ??
00 BA
3D ??
?? ??
FF FF
?? ??

only)
?? ??
D0 89
C9 E8
75 3F
48 C1
E8 B3
11 C9
?? ??
FF 10
?? ??
?? ??
?? B8
FF 68
?? 52

->
??
05
64
AA
E0
01
E8
??
85
??
??
??
??
FF

GPcH]
B8 ??
?? ??
00 00
EB D4
08 AC
56 89
E7 FF
BE ??
C0 75
?? 8B
85 DB
?? ??
?? ??
D0 61

??
??
00
E8
E8
FE
FF
??
08
06
74
??
??
BA

??
??
73
4D
2C
29
FF
??
53
85
2B
FF
B8
??

??
89
1C
00
00
C6
72
??
B8
C0
F7
10
??
??

FF
C7
31
00
00
F3
F2
01
??
75
C3
89
??
??

10
BE
C0
00
00
A4
C3
D6
??
03
00
07
??
??

68
??
E8
29
3D
5E
61
8B
??
8B
00
83
??
FF

??
??
5B
D9
00
EB
B9
46
??
46
00
05
FF
E2

??
??
00
75
7D
8E
FC
0C
FF
10
80
??
10
90

??
??
00
10
00
00
FF
85
10
01
75
??
68
C3

??
60
00
E8
00
D2
FF
C0
89
D0
04
??
??

50
FC
73
42
73
75
FF
0F
05
03
01
??
??

B8
B2
23
00
0A
05
8B
84
??
05
D3
04
??

??
80
B3
00
80
8A
1C
87
??
??
43
EB
??

??
31
02
00
FC
16
08
00
??
??
43
AE
50

??
DB
41
EB
05
46
89
00
??
??
81
83
B8

??
A4
B0
28
73
10
99
00
C7
??
E3
C6
??

FF
B3
10
AC
06
D2
??
01
05
8B
FF
14
??

10
02
E8
D1
83
C3
??
D0
??
18
FF
BA
??

68
E8
4F
E8
F8
31
??
89
??
8B
FF
??
??

[GHF Protector
signature = 60
00 00 00 00 6A
6D 00 00 00 73
00 00 00 10 C0
74 4D 11 C9 EB
7F 77 02 41 41
C9 41 E8 EE FF

(pack
68 ??
40 FF
F6 31
73 F7
1C 91
95 89
FF FF

only)
?? ??
D0 89
C9 E8
75 3F
48 C1
E8 B3
11 C9

->
??
05
64
AA
E0
01
E8

GPcH]
B8 ??
?? ??
00 00
EB D4
08 AC
56 89
E7 FF

??
??
00
E8
E8
FE
FF

??
??
73
4D
2C
29
FF

??
89
1C
00
00
C6
72

FF
C7
31
00
00
F3
F2

10
BE
C0
00
00
A4
C3

68
??
E8
29
3D
5E
61

??
??
5B
D9
00
EB
B9

??
??
00
75
7D
8E
FC

??
??
00
10
00
00
FF

??
60
00
E8
00
D2
FF

50
FC
73
42
73
75
FF

B8
B2
23
00
0A
05
8B

??
80
B3
00
80
8A
1C

??
31
02
00
FC
16
08

??
DB
41
EB
05
46
89

??
A4
B0
28
73
10
99

FF
B3
10
AC
06
D2
??

10
02
E8
D1
83
C3
??

68
E8
4F
E8
F8
31
??

-89-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

?? E2 F5 90 90
C3 50 B8 ?? ??
?? ?? 00 00 00
7E 10 01 D7 03
ep_only = true

BA
??
00
3D

[GHF Protector
signature = 60
00 00 00 00 6A
6D 00 00 00 73
00 00 00 10 C0
74 4D 11 C9 EB
7F 77 02 41 41
C9 41 E8 EE FF
?? E2 F5 90 90
C3 50 B8 ?? ??
?? ?? 00 00 00
7E 10 01 D7 03
ep_only = true
[GHF Protector
signature = 60
00 00 00 00 6A
6D 00 00 00 73
ep_only = true

??
FF
??
??

04 August 2015 15:14

??
10
??
??

??
85
??
??

BE
C0
??
85

??
75
8B
DB

??
08
06
74

??
53
85
2B

??
B8
C0
F7

01
??
75
C3

D6
??
03
00

8B
??
8B
00

46 0C 85 C0 0F 84 87 00 00 00 01 D0 89
?? FF 10 89 05 ?? ?? ?? ?? C7 05 ?? ??
46 10 01 D0 03 05 ?? ?? ?? ?? 8B 18 8B
0

(pack
68 ??
40 FF
F6 31
73 F7
1C 91
95 89
FF FF
BA ??
?? ??
00 BA
3D ??

only)
?? ??
D0 89
C9 E8
75 3F
48 C1
E8 B3
11 C9
?? ??
FF 10
?? ??
?? ??

->
??
05
64
AA
E0
01
E8
??
85
??
??

GPcH]
B8 ??
?? ??
00 00
EB D4
08 AC
56 89
E7 FF
BE ??
C0 75
?? 8B
85 DB

??
??
00
E8
E8
FE
FF
??
08
06
74

??
??
73
4D
2C
29
FF
??
53
85
2B

??
89
1C
00
00
C6
72
??
B8
C0
F7

FF
C7
31
00
00
F3
F2
01
??
75
C3

10
BE
C0
00
00
A4
C3
D6
??
03
00

68
??
E8
29
3D
5E
61
8B
??
8B
00

??
??
5B
D9
00
EB
B9
46
??
46
00

(pack
68 ??
40 FF
F6 31

only)
?? ??
D0 89
C9 E8

->
??
05
64

GPcH]
B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68
?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8
00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41

[GHF Protector (pack

signature = 60 68 ??
00 00 00 00 6A 40 FF
6D 00 00 00 73 F6 31
00 00 00 10 C0 73 F7
74 4D 11 C9 EB 1C 91
7F 77 02 41 41 95 89
C9 41 E8 EE FF FF FF
?? E2 F5 90 90 BA ??
C3 50 B8 ?? ?? ?? ??
?? ?? 00 00 00 00 BA
7E 10 01 D7 03 3D ??
0E P_ ON LY = T RU E
ep_only = true

only)
?? ??
D0 89
C9 E8
75 3F
48 C1
E8 B3
11 C9
?? ??
FF 10
?? ??
?? ??

->
??
05
64
AA
E0
01
E8
??
85
??
??

GPcH]
B8 ??
?? ??
00 00
EB D4
08 AC
56 89
E7 FF
BE ??
C0 75
?? 8B
85 DB

[GHF Protector
signature = 60
00 A0 00 00 6A
6D 00 00 00 73
ep_only = true

??
??
BA
??

??
??
00
E8
E8
FE
FF
??
08
06
74

??
??
73
4D
2C
29
FF
??
53
85
2B

??
89
1C
00
00
C6
72
??
B8
C0
F7

FF
C7
31
00
00
F3
F2
01
??
75
C3

10
BE
C0
00
00
A4
C3
D6
??
03
00

68
??
E8
29
3D
5E
61
8B
??
8B
00

??
??
5B
D9
00
EB
B9
46
??
46
00

??
??
00
75
7D
8E
FC
0C
FF
10
80

??
??
00
75
7D
8E
FC
0C
FF
10
80

??
??
00
10
00
00
FF
85
10
01
75

??
??
00
10
00
00
FF
85
10
01
75

??
60
00
E8
00
D2
FF
C0
89
D0
04

??
60
00
E8
00
D2
FF
C0
89
D0
04

50
FC
73
42
73
75
FF
0F
05
03
01

50
FC
73
42
73
75
FF
0F
05
03
01

B8
B2
23
00
0A
05
8B
84
??
05
D3

B8
B2
23
00
0A
05
8B
84
??
05
D3

??
80
B3
00
80
8A
1C
87
??
??
43

??
80
B3
00
80
8A
1C
87
??
??
43

??
31
02
00
FC
16
08
00
??
??
43

??
31
02
00
FC
16
08
00
??
??
43

??
DB
41
EB
05
46
89
00
??
??
81

??
DB
41
EB
05
46
89
00
??
??
81

??
A4
B0
28
73
10
99
00
C7
??
E3

??
A4
B0
28
73
10
99
00
C7
??
E3

FF
B3
10
AC
06
D2
??
01
05
8B
FF

FF
B3
10
AC
06
D2
??
01
05
8B
FF

10
02
E8
D1
83
C3
??
D0
??
18
FF

10
02
E8
D1
83
C3
??
D0
??
18
FF

68
E8
4F
E8
F8
31
??
89
??
8B
FF 0

68
E8
4F
E8
F8
31
??
89
??
8B
FF

(pack) / GPcH]
68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68
40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8
F6

[Gleam 1:00]
signature = 83 EC 0C 53 56 57 E8 24 02 00
ep_only = false
[Gleam v1:00]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 EC 0C
53 56 57 E8 24 02 00
ep_only = true
[Go32Stub v:2:00 DOS-Extender]
signature = 0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 80
ep_only = true
[Go32Stub v:2:00T DOS-Extender]
signature = 0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 3C
-90-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[Goat's PE Mutilator
signature = E8 EA 0B
46 13 28 5D 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
ep_only = true

1:6]
00 00
00 00
00 00
00 00
00 00
00 00
00 00
00 00
00 00

[Goat's PE Mutilator
signature = E8 EA 0B
46 13 28 5D 00 00 00
00 00 00 00 00 00 00
ep_only = true

1:6]
00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

??
00
00
00
00
00
00
00
00

??
00
00
00
00
00
00
00
00

??
00
00
00
00
00
00
00
00

8B
00
00
00
0F
00
00
00
00

1C
00
00
00
53
00
00
00

79
00
00
00
0F
00
00
00

F6
00
00
00
DE
00
00
00

63
00
00
00
0F
00
00
00

D8
00
00
00
55
00
00
00

8D
00
00
00
0F
00
00
00

22
00
00
00
60
00
00
00

B0
00
00
00
00
00
00
00

BF
00
00
00
00
00
00
00

F6
00
00
00
00
00
00
00

49
00
00
00
00
00
00
00

08
00
00
00
00
00
00
00

C3
00
00
00
00
00
00
00

02
00
00
00
00
00
00
00

BD
00
00
00
00
00
00
00

3B
00
00
00
00
00
00
00

6C
00
00
00
00
00
00
00

29
00
00
00
00
00
00
00

[Goats Mutilator v1:6 -> Goat/_e0f]

signature = E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29
46 13 28 5D
ep_only = true
[GP-Install v5:0:3:32]
signature = 55 8B EC 33 C9 51 51 51 51 51 51 51 53 56 57 B8 C4 1C 41 00 E8 6B 3E FF FF 33 C0
55 68 76 20 41 00 64 FF 30 64 89 20 BA A0 47 41 00 33 C0 E8 31 0A FF FF 33 D2 A1 A0
ep_only = false
[Guardant Stealth aka Novex Dongle]
signature = 55 8B EC 83 C4 F0 60 E8 51 FF FF FF
ep_only = true
[HACKSTOP v1:00]
signature = FA BD ?? ?? FF E5 6A 49 48 0C ?? E4 ?? 3F 98 3F
ep_only = true
[HACKSTOP v1:10; v1:11]
signature = B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 2F CD 21 B0 ?? B4 4C CD 21 50 B8 ?? ?? 58 EB
ep_only = true
[HACKSTOP v1:10p1]
signature = B4 30 CD 21 86 E0 3D 00 03 73 ?? B4 2F CD 21 B4 2A CD 21 B4 2C CD 21 B0 FF B4 4C
CD 21 50 B8 ?? ?? 58 EB
ep_only = true
[HACKSTOP v1:11c]
signature = B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 ?? CD 21 B0 ?? B4 4C CD 21 53 BB ?? ?? 5B EB
ep_only = true
[HACKSTOP v1:13 / DarkStop v1:0]
signature = FA BD J2 J2 D4 85 4E 32 EB EB
ep_only = true
[HACKSTOP v1:13]
signature = 52 B8 ?? ?? 1E CD 21 86 E0 3D ?? ?? 73 ?? CD 20 0E 1F B4 09 E8 ?? ?? 24 ?? EA
ep_only = true
[HACKSTOP v1:17]
signature = FA BE J2 J2 05 0C 00 07 1D 4A 46 1E 16 FD AC 44 ?? ?? ?? ?? F1 6D 84 D3 3D ?? ??
CF AF FB 34 DB 33 ?? ?? ?? ?? ?? D0 D6 ?? ?? 92 B4 24 9E
-91-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[HACKSTOP v1:18]
signature = 52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? FD 02 ?? ?? CD 20 0E 1F 52
BA ?? ?? 5A EB
ep_only = true
[HACKSTOP v1:19]
signature = 52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? D6 02 ?? ?? CD 20 0E 1F 52
BA ?? ?? 5A EB
ep_only = true
[Hardlock dongle (Alladin)]
signature = 5C 5C 2E 5C 48 41 52 44 4C 4F 43 4B 2E 56 58 44 00 00 00 00 5C 5C 2E 5C 46 45 6E
74 65 44 65 76
ep_only = true
[Hasp 4 envelope dongle (Alladin)]
signature = 10 02 D0 51 0F 00 83
ep_only = true
[Hasp dongle (Alladin)]
signature = 50 53 51 52 57 56 8B 75 1C 8B 3E ?? ?? ?? ?? ?? 8B 5D 08 8A FB ?? ?? 03 5D 10 8B
45 0C 8B 4D 14 8B 55 18 80 FF 32
ep_only = true
[HASP HL Protection 1:X
signature = 55 8B EC 53
?? ?? ?? 83 3D ?? ?? ??
00 00 68 ?? ?? ?? ?? FF
ep_only = false

->
56
??
15

Aladdin]
57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ??
00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00
?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15

[HASP HL Protection V1:X -> Aladdin

signature = 55 8B EC 53 56 57 60 8B
?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15
00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ??
?? ?? ?? 8B 15
ep_only = true

> Sign by fly]

C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ??
8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00
?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ??

[HEALTH v:5:1 by Muslim M:Polyak]

signature = 1E E8 ?? ?? 2E 8C 06 ?? ?? 2E 89 3E ?? ?? 8B D7 B8 ?? ?? CD 21 8B D8 0E 1F E8 ??
?? 06 57 A1 ?? ?? 26
ep_only = true
[Hide PE 1:01 -> BGCorp]
signature = ?? BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8
?? ?? ?? ?? 89 02 83 C2 F8 FF E2 0D 0A 2D 3D 5B 20 48 69 64 65 50 45 20 62 79 20 42 47 43 6F
72 70 20 5D 3D 2D
ep_only = true
[Hide&Protect 1:016 -> SoftWar Company]
signature = 90 90 90 E9 D8 ?? 05 00 95 ?? 53 00 95 4A 50 00
ep_only = true
[Hide&Protect V1:0X-> SoftWar Company]
signature = 90 90 90 E9 D8
ep_only = true
[Histogram graphics file]
signature = 6D 68 77 61 6E 68 00 04 01 02 01 02
ep_only = false

-92-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Hitachi Raster Format graphics format]

signature = 43 41 44 43 2F 4B 52 20 52 53 54
ep_only = false
[hmimys protect 0:1 -> hmimys]
signature = 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8
ep_only = false
[hmimys Protect v1:0]
signature = E8 BA 00 00
?? 00 ?? ?? ?? 00 ?? ??
?? ?? 00 00 00 00 00 00
00 00 00 00 00 00 00 00
6E 65 6C 33 32 2E 64 6C
72 6F 63 41 64 64 72 65
75 61 6C 41 6C 6C 6F 63
E7 07 00 00 AD 8B DE 8B
C0 74 EA 4E AD A9 00 00
ep_only = true

00
??
00
??
6C
73
00
F0
00

??
00
00
??
00
73
5E
83

00
??
00
??
00
00
83
C3

00
??
??
00
00
00
C6
44

00
??
??
??
4C
00
64
AD

00
00
??
??
6F
56
AD
85

??
??
00
??
61
69
50
C0

??
??
??
00
64
72
AD
74

00
??
??
??
4C
74
50
32

00
00
??
??
69
75
83
8B

10
??
00
??
62
61
EE
F8

40
??
00
00
72
6C
6C
56

00
??
00
??
61
46
AD
FF

??
00
00
??
72
72
50
13

??
??
00
??
79
65
AD
8B

??
00
00
00
41
65
50
E8

00
00
00
00
00
00
AD
AC

??
00
00
00
00
00
50
84

??
00
00
00
00
00
AD
C0

??
00
00
00
47
56
50
75

00
00
00
4B
65
69
AD
FB

00
00
00
65
74
72
50
AC

??
??
00
72
50
74
E8
84

[hmimys Protect v1:0]

signature = E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ??
?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ??
?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00
ep_only = true
[hmimys's PE-Pack
signature = E8 00
D8 81 C3 F8 00 00
08 80 BD 89 0E 00
0F 00 00 8B 5B 10
89 85 73 0F 00 00
00 10 00 00 68 D8
73 0F 00 00 8B 8D
0F 00 00 50 53 51
ep_only = true

0:1 -> hmimys]

00 00 00 5D 83
00 80 AD 89 0E
00 00 75 0C 03
89 9D 5F 0F 00
6A 04 68 00 10
7C 00 00 6A 00
6B 0F 00 00 8B
52 56 68 D8 7C

[hmimys's PE-Pack
signature = E8 00
D8 81 C3 F8 00 00
08 80 BD 89 0E 00
ep_only = true

0:1 -> hmimys]

00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03
00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53
00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00

ED
00
8D
00
00
FF
95
00

05
00
91
8B
00
95
5B
00

6A
01
0E
9D
50
E9
0F
57

00
89
00
5F
6A
0E
00
E8

FF
9D
00
0F
00
00
00
01

95
63
2B
00
FF
00
83
01

E1
0F
95
00
95
89
EA
00

0E
00
91
8B
E9
85
0E
00

00
00
0E
85
0E
6F
8B
8B

00
8B
00
57
00
0F
B5
9D

89
4B
00
0F
00
00
57
57

85
0C
89
00
89
00
0F
0F

85
03
8D
00
85
8D
00
00

0E
8D
57
53
6B
85
00
00

00
85
0F
50
0F
67
83
8B

00
0E
00
E8
00
0F
C6
03

8B
00
00
B7
00
00
0E
3C

58
00
89
0B
6A
00
8B
01

3C
8B
95
00
04
8B
BD
75

03
53
5B
00
68
9D
6F

[hmimys-Packer 1:0 -> hmimys]

signature = 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00
ep_only = false
[hmimys-Packer
signature = E8
?? 00 ?? ?? ??
?? ?? 00 00 00
ep_only = true

1:0]
BA 00 00 00 03 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ??
00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ??
00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00

[hmimys-Packer
signature = E8
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? 5E AD
E3 1D 8A 07 47
AD 85 C0 74 2B

V1:2 -> hmimys

95 00 00 00 ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
50 AD 50 97 AD
04 ?? 3C ?? 73
97 56 FF 13 8B

* Sign:By:fly]
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
50 AD 50 AD 50
F7 8B 07 3C ??
E8 AC 84 C0 75

??
??
??
??
??
E8
75
FB

??
??
??
??
??
C0
F3
66

-93-

??
??
??
??
??
01
B0
AD

??
??
??
??
??
00
00
66

??
??
??
??
??
00
0F
85

??
??
??
??
??
AD
C8
C0

??
??
??
??
??
50
05
74

??
??
??
??
??
AD
??
E9

??
??
??
??
??
93
??
AC

??
??
??
??
??
87
??
83

??
??
??
??
??
DE
??
EE

??
??
??
??
??
B9
2B
03

??
??
??
??
??
??
C7
84

??
??
??
??
??
??
AB
C0

??
??
??
??
??
??
E2
74

??
??
??
??
??
??
E3
08

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

56 55 FF 53 04 AB EB E4 AD 50 55 FF 53 04 AB EB E0 C3 8B 0A 3B 4A 04 75 0A C7 42 10 01 00 00
00 0C FF C3
ep_only = true
[HPA]
signature = E8 ?? ?? 5E 8B D6 83 ?? ?? 83 ?? ?? 06 0E 1E 0E 1F 33 FF 8C D3
ep_only = true
[HQR data file]
signature = 48 00 00 00 ?? 02 00 00 ?? ?? 00 00 ?? ?? 00 00
ep_only = false
[hying's PE-Armor -> hying[CCG]
signature = E8 AA 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D
ep_only = true
[Hying's PE-Armor
signature = 00 00
00 56 69 72 74 75
?? ?? ?? ?? ?? ??
?? ?? ?? 74 ?? ??
?? ?? ?? ?? ?? ??
50 72 6F 63 41 64
00 00 4C 6F 61 64
00 00 5D 81 ED D7
ep_only = false

0:75:exe
00 00 00
61 6C 41
?? ?? ??
?? 00 00
?? ?? 00
64 72 65
4C 69 62
00 00 00

->
00
6C
00
00
00
73
72
8D

Hying
00 00
6C 6F
00 00
00 00
00 00
73 00
61 72
B5 EE

[CCG]
?? ??
63 00
00 00
00 00
4B 45
00 00
79 41
00 00

[Hying's PE-Armor
signature = 00 00
00 56 69 72 74 75
?? ?? ?? ?? ?? ??
ep_only = false

0:75:exe
00 00 00
61 6C 41
?? ?? ??

->
00
6C
00

Hying
00 00
6C 6F
00 00

[CCG]]
?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00
63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00

[Hying's PE-Armor
signature = E8 03
03 00 00 00 EB 01
01 ?? E8 AA 00 00
ep_only = false

0:75:exe
00 00 00
?? E8 81
00 E8 03

->
EB
00
00

Hying]
01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8
00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB
00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75

[Hying's PE-Armor
signature = 01 00
56 69 72 74 75 61
?? ?? 00 00 00 00
?? ?? ?? 00 00 00
00 00 00 00 00 00
2E 64 6C 6C 00 00
62 72 61 72 79 41
00 00 00 00 00 00
?? ?? ?? 55 C3
ep_only = false

0:76 -> Hying [CCG]

?? ?? 00 00 00 00 00
6C 46 72 65 65 00 ??
00 00 00 ?? ?? ?? ??
00 00 00 00 9D ?? ??
00 ?? ?? ?? ?? ?? ??
00 00 47 65 74 50 72
00 00 00 47 65 74 4D
00 60 E8 00 00 00 00

00
??
??
??
??
6F
6F
5D

00
00
00
00
52
47
00
00

00
??
??
8D
??
63
64
81

00
00
00
00
4E
65
00
55

00
??
??
??
??
41
75
ED

00
00
00
00
45
74
00
56

00
??
??
??
??
64
6C
F0

00
00
00
00
4C
4D
00
81

00
??
??
??
??
64
65
00

00
00
74
00
33
6F
00
C5

56
??
??
00
??
72
48
00

00
00
??
00
32
64
08
??

69
??
??
00
00
65
61
00

??
00
??
00
2E
75
00
??

72
??
??
00
00
73
6E
8D

??
??
??
00
64
6C
00
00

74
??
??
00
00
73
64
B5

01
??
00
00
6C
65
00
00

75
??
??
00
00
00
6C
07

00
??
00
00
6C
48
00
55

61
??
00
00
4B
00
65
01

00
??
00
00
00
61
00
C3

6C
61
00
00
45
00
41
00

00
??
00
00
00
6E
00

41
??
00
00
52
4C
00
00

00
??
00
00
00
64
00

6C
??
00
00
4E
6F
00
55

00
??
00
??
00
6C
60

6C
??
00
00
45
61
00
56

00
??
00
??
47
65
E8

6F
59
00
00
4C
64
00
81

00
??
00
??
65
41
00

63
??
8D
00
33
4C
00
C5

[hying's PEArmor V0:76 -> hying]

signature = E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A ?? E8 A3 00 00 00
ep_only = true
[IBM PictureMaker graphics file]
signature = 00 ?? C1 ?? 00 ?? ?? ?? ?? 02 00 01
ep_only = false
[Ice v1:00]
signature = EB J3 BE ?? ?? 8B FE 8B ?? ?? ?? 8B ?? ?? ?? B8 ?? ?? 50 FC AD 33 C2 AB 8B D0
ep_only = true
-94-

00
??
84
??
74
00
00

00
??
??
00
32
69
08
??

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[ICrypt 1:0 - by BuGGz]

signature = 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55
68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8
53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B
ep_only = true
[ID Application Protector V1:2 -> ID Security Suite >
signature = 60 E8 00 00 00 00 5D 81 ED F2 0B 47 00 B9
C2 EA 0E 47 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC
64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65
ep_only = true

Sign by fly]
19 22 47 00 81 E9 EA 0E 47 00 89 EA 81
CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E
63 74 6F 72 5C

[ILUCRYPT v4:015 [com]

signature = E9 J1 J1 8B EC FA C7 46 F7 ?? ?? 42 81 FA ?? ?? 75 F9 FF 66 F7
ep_only = true
[ILUCRYPT v4:015 [exe]
signature = 8B EC FA C7 46 F7 ?? ?? 42 81 FA ?? ?? 75 F9 FF 66 F7
ep_only = true
[iLUCRYPT v4:018 [com]
signature = E9 J1 J1 8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 31 05 D1 C8 4F 81
ep_only = true
[iLUCRYPT v4:018 [exe]
signature = 8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 2E ?? ?? D1 C8 4F 81
ep_only = true
[Img Software Set graphics file]
signature = 53 43 4D 49 20 20 20 31 41 54
ep_only = false
[IMP-Packer 1:0 -> Mahdi Hezavehi [IMPOSTER]
signature = 28 ?? ?? ?? 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 4C ??
?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E
65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72
ep_only = false

00
??
64
79

40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00
?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ??
6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72
41

[IMP-Packer 1:0 -> Mahdi Hezavehi [IMPOSTER]]

signature = 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ??
?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63
ep_only = false
[IMPostor Pack 1:0 -> Mahdi Hezavehi]
signature = BE ?? ?? ?? 00 83 C6 01 FF E6 00 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ??
?? 00 ?? 02 ?? ?? 00 10 00 00 00 02 00
ep_only = true
[Inbuild v1:0 [hard]
signature = B9 ?? ?? BB ?? ?? 2E ?? ?? 2E ?? ?? 43 E2
ep_only = true
[INCrypter 0:3
signature = 60
5D 81 ED 4D 16
03 DB C1 CB 10
ep_only = true

(INinY) - by z3e_NiFe]
64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00
40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05
8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B

[Inno Installer v5:1:2]

-95-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 9C 60 E8 00 00 00 00 58 BB DC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 50 00 00 68
D8 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC
ep_only = false
[Inno Setup Module v1:09a]
signature = 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA
92 FF FF E8 F1 B3 FF FF 33 C0
ep_only = true
[Inno Setup Module v1:2:9]
signature = 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 EC 89 45 C0 E8 5B 73 FF FF E8 D6
87 FF FF E8 C5 A9 FF FF E8 E0
ep_only = true
[Inno Setup Module v2:0:18]
signature = 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 73 71 FF FF E8 DA
85 FF FF E8 81 A7 FF FF E8 C8
ep_only = false
[Inno Setup Module v3:0:4-beta/v3:0:6/v3:0:7]
signature = 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 B3 70 FF FF E8 1A
85 FF FF E8 25 A7 FF FF E8 6C
ep_only = false
[Inno Setup Module]
signature = 49 6E 6E 6F
ep_only = true
[Inno Setup Module]
signature = 55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 ?? 89 45 ?? E8 ?? ?? FF FF E8 ??
?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF
ep_only = false
[Inno Setup Module]
signature = 49 6E 6E 6F 53 65 74 75 70 4C 64 72 57 69 6E 64 6F 77 00 00 53 54 41 54 49 43
ep_only = true
[Install Stub 32-bit]
signature = 55 8B EC 81 EC 14 ?? 00 00 53 56 57 6A 00 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15
?? ?? ?? ?? 85 C0 74 29
ep_only = true
[InstallAnywhere 6:1
signature = 60 BE 00
88 07 47 01 DB 75 07
DB 11 C0 01 DB 73 EF
83 F0 FF 74 74 89 C5
11 C9 75 20 41 01 DB
73 E4
ep_only = true

->
A0
8B
75
01
75

Zero G Software Inc]

42 00 8D BE 00 70 FD
1E 83 EE FC 11 DB 72
09 8B 1E 83 EE FC 11
DB 75 07 8B 1E 83 EE
07 8B 1E 83 EE FC 11

[InstallAnywhere 6:1
signature = 60 BE 00
88 07 47 01 DB 75 07
DB 11 C0 01 DB 73 EF
ep_only = true

->
A0
8B
75

Zero G Software Inc]

42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46
1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11
09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0

FF
ED
DB
FC
DB

57
B8
73
11
11

83
01
E4
DB
C9

CD
00
31
11
01

FF
00
C9
C9
DB

EB
00
83
01
73

10
01
E8
DB
EF

90
DB
03
75
75

90
75
72
07
09

90
07
0D
8B
8B

90
8B
C1
1E
1E

90
1E
E0
83
83

90
83
08
EE
EE

8A
EE
8A
FC
FC

06
FC
06
11
11

46
11
46
DB
DB

[InstallAnywhere 6:1 -> Zero G Software Inc]

signature = 60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46
88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07
ep_only = true

-96-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Installer VISE Custom]

signature = 55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1
FF 00 00 00 89 0D
ep_only = true
[InstallShield 2000]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ??
?? ?? 83 C4 ?? 53 56 57
ep_only = true
[InstallShield
signature = 64
00 00 83 EC 60
B1 40 00 A1 70
ep_only = true

3:x Custom]
A1 00 00 00 00 55 8B EC 6A FF 68 00 A0 40 00 68 34 76 40 00 50 64 89 25 00 00
53 56 57 89 65 E8 FF 15 8C E3 40 00 A3 70 B1 40 00 33 C0 A0 71 B1 40 00 A3 7C
B1

[InstallShield
signature = 55
8A 06 57 8B 3D
75 15 56 FF D7
ep_only = true

Custom]
8B EC 83 EC 44 56 FF 15 ?? ?? 41 00 8B F0 85 F6 75 08 6A FF FF 15 ?? ?? 41 00
?? ?? 41 00 3C 22 75 1B 56 FF D7 8B F0 8A 06 3C 22 74 04 84 C0 75 F1 80 3E 22
8B

[Interchange Format File (IFF); type WVQA]

signature = 46 4F 52 4D ?? ?? ?? ?? 57 56 51 41 56 51 48 44
ep_only = false
[InterLok V5:51 -> PACE
signature = EB 03 ?? ??
EC A8 00 00 00 EB 02 ??
EB 04 ?? EB F2 ?? EB 01
EB 01 ?? EB F8 ?? EB 01
EB 08 ?? EB F0 ?? EB 07
?? ?? ?? ?? EB 07
ep_only = true
[InterLok V5:X
signature = 55
50 68 ?? ?? ??
?? ?? 85 C0 75
?? ?? ?? 8B 48
01 74 0A 83 7D
59 75 52 83 7D
C4 0C EB 18 FF
85 5C FF FF FF
?? ?? ?? FF 35
F6 0F 84 96 00
F5 75 2B B8 ??
83 FE FA 74 30
83 C4 0C 8D 45
?? ?? ?? 50 6A
0C 00
ep_only = true

->
8B
??
0B
3C
0C
FC
75
68
??
00
??
83
E0
00

Anti-Piracy
?? 55 EB 03
?? EB 01 ??
?? EB F8 ??
?? 57 EB 03
?? ?? EB FA

* Sign:By:fly]
?? ?? ?? EB 04
53 EB 03 ?? ??
?? ?? EB 0F ??
?? ?? ?? EB 11
?? ?? ?? EB 02

??
??
33
??
??

EB
EB
F6
??
??

06
05
EB
??
BB

??
??
10
EB
??

8B
??
??
03
??

EC
EB
??
??
??

EB
15
??
??
??

F9
??
EB
??
EB

??
EB
F7
??
03

EB
03
??
??
??

02
??
??
??
??

??
??
EB
??
??

??
??
FA
??
0F

81
56
??
??
85

PACE Anti-Piracy * Sign:By:fly]

EC 81 EC A4 00 00 00 53 56 33 F6
FF 15 ?? ?? ?? ?? 85 C0 74 05 8B
66 81 3F 4D 5A 75 04 8B C7 EB 07
03 C8 89 ?? ?? ?? ?? ?? EB 06 8B
01 0F 85 38 01 00 00 8D 45 F8 50
FF FF 75 F8 75 17 8D 85 5C FF FF
FC 8D 85 5C FF FF FF 68 ?? ?? ??
?? ?? ?? ?? 50 56 FF 15 ?? ?? ??
?? ?? ?? 57 FF D7 57 6A 01 8B F0
00 83 FE F6 7F 32 74 29 83 FE 97
?? ?? EB 4F B8 ?? ?? ?? ?? EB 48
FE FC 74 24 83 FE FD 74 18 56 8D
EB 13 B8 ?? ?? ?? ?? EB 0C B8 ??
FF 15 ?? ?? ?? ?? 85 DB 75 08 6A

57
45
56
??
8D
FF
??
??
FF
74
B8
45
??
01

39
E0
FF
??
45
68
50
E9
15
75
??
E0
??
FF

35
EB
15
??
FC
??
FF
BB
??
83
??
68
??
15

??
22
??
??
50
??
15
00
??
FE
??
??
EB
??

??
8B
??
??
E8
??
??
00
??
F3
??
??
05
??

??
7D
??
66
47
??
??
00
??
74
EB
??
B8
??

??
08
??
8B
01
50
??
68
50
18
41
??
??
??

75
6A
A3
59
00
FF
??
??
FF
83
B8
50
??
33

53
02
??
16
00
15
83
??
15
FE
??
FF
??
C0

8D
57
??
C1
8B
??
C4
??
??
F4
??
15
??
5F

45
FF
??
EB
F8
??
10
??
??
74
??
??
6A
5E

DC
15
??
0D
59
??
6A
FF
??
0C
??
??
30
5B

6A
??
A3
83
3B
??
30
35
??
83
EB
??
68
C9

1C
??
??
E3
FE
83
8D
??
85
FE
3A
??
??
C2

[Interplay's MVE file]

signature = 49 6E 74 65 72 70 6C 61 79 20 4D 56 45 20 46 69 6C 65 1A 00 1A
ep_only = false
[iPB Protect 0:1:3 - 0:1:7 -> forgot]
signature = 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00
ep_only = true

-97-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[iPBProtect 0:1:3]
signature = 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00
00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78
ep_only = false
[iPBProtect v0:1:3]
signature = 55 8B EC
00 00 83 EC 68 53 56
00 64 8F 05 00 00 00
D3 5B F3 68 89 5C 24
FF 52 BA 01 00 83 EB
F3 EB 87 1C 24 8B 8B
E8 FD EB FF 30 E8 C9
83 C0 14 EB FF 70 ED
71 EB EB FA FF 83 C0
ep_only = false

6A
57
00
48
FC
04
00
71
18

FF
89
58
5C
4A
24
00
EB
EB

68
65
58
24
FF
83
00
EB
FF

4B
FA
58
58
71
EC
89
FA
70

43
33
5D
FF
0F
FC
E0
FF

55
DB
68
8D
75
EB
EB
83

46
89
9F
5C
19
01
FF
C0

68
5D
6F
24
8B
E8
D0
FC

54
F8
56
58
5C
83
EB
EB

49
6A
B6
5B
24
EC
FF
FF

48
02
50
83
00
FC
71
70

53
EB
E8
C3
00
E9
0F
ED

64
01
5D
4C
81
E7
83
71

A1
F8
00
75
33
00
C0
EB

00
58
00
F4
50
00
01
EB

00
5F
00
5A
53
00
EB
FA

00
5E
EB
8D
8B
58
FF
0F

00
5B
FF
71
1B
EB
70
83

50
64
71
78
0F
FF
F0
C0

64
8B
78
75
FF
F0
71
F8

89
25
C2
09
C6
EB
EE
EB

25
00
50
81
75
FF
EB
FF

00
00
00
F3
1B
C0
FA
70

00
00
EB
EB
81
83
EB
ED

[IProtect 1:0 (Fxlib:dll mode) signature = EB 33 2E 46 55 58 4C

6C 00 00 00 00 00 00 00 00 00 00
00 5D 81 ED 71 10 40 00 FF 74 24
ep_only = true

by
6F
00
20

FuXdas]
61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C
00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00
E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00

[IProtect 1:0 (FxSub:dll mode) signature = EB 33 2E 46 55 58 4C

6C 00 00 00 00 00 00 00 00 00 00
00 5D 81 ED B6 13 40 00 FF 74 24
ep_only = true

by
6F
00
20

FuXdas]
61 64 4C 69 62 72 61 72 79 41 00 46 78 53 75 62 2E 64 6C
00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 60 E8 00 00 00
E8 40 00 00 00 0B C0 74 2F 89 85 A8 13 40 00

[JAM v2:11]
signature = 50 06 16 07 BE ?? ?? 8B FE B9 ?? ?? FD FA F3 2E A5 FB 06 BD ?? ?? 55 CB
ep_only = true
[JAR Archive]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 1A 4A 61 72 1B
ep_only = false
[JDPack 2:x -> JDPack]
signature = 55 8B EC 6A FF 68 68 51 40 00 68 04 25 40 00 64 A1 00 00 00 00
ep_only = true
[JDPack V2:00 -> JDPack
signature = 55 8B EC 6A
00 00 ?? ?? ?? E8 01 00
5D 8B D5 64 FF 35 00 00
ep_only = true

* Sign:By:fly]
FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 ?? ?? ?? ?? ?? ?? 05 00 00 00 00 83 C4 0C 5D 60 E8 00 00 00 00
00 00 EB ??

[JDPack V2:00 -> JDPack]

signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? 05 00 00 00 00 83 C4 0C 5D 60 E8 00 00 00 00
5D 8B D5 64 FF 35 00 00 00 00 EB
ep_only = true
[JDPack]
signature = 60 E8 ?? ?? ?? ?? 5D 8B D5 81 ED ?? ?? ?? ?? 2B 95 ?? ?? ?? ?? 81 EA 06 ?? ?? ??
89 95 ?? ?? ?? ?? 83 BD 45
ep_only = true
[JExeCompressor 1:0 - by Arash Veyskarami]
signature = 8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE
80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64
-98-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8
ep_only = true
[JExeCompressor V1:0 -> UsAr]
signature = 0F C8 0F CF C6 C4 8B 0F AC EA 99 0F AD D8 13 F5 0F BD EF 85 EF 85 DA 69 FE ?? ??
?? ?? 21 F9 BE ?? ?? ?? ?? 23 CF 0F BC FE D2 DC 85 EF B9 ?? ?? ?? ?? C6 C0 F7 8D 35 ?? ?? ??
?? 8D 0D
ep_only = true
[Joiner (sign from pinch 25:03:2007 20<10)]
signature = 81 EC 04 01 00 00 8B F4 68 04 01 00 00 56 6A 00 E8 7C 01 00 00 33 C0 6A 00 68 80
00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 56 E8 50 01 00 00 8B D8 6A 00 6A 00 6A 00 6A 02 6A
00 53 E8 44 01
ep_only = true
[Kbys Packer 0:28 Beta-> shoooo314]
signature = 68 85 AE 01 01 E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4
B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0
10 E8 4F 00 00 00
ep_only = false
[KByS Packer v0:28]
signature = 68 ?? ?? ?? 00 E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4
B3 02 E8 6D 00
ep_only = true
[KByS V0:28 -> shoooo > Sign by fly]
signature = 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4
ep_only = true
[KByS V0:28 DLL -> shoooo > Sign by fly]
signature = B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 03 C2 FF E0 ?? ?? ?? ?? 60 E8 00 00 00 00
ep_only = true
[KGB SFX]
signature = 60 BE 00 A0 46 00 8D BE 00 70 F9 FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46
88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11
DB 11 C0 01 DB 73
ep_only = true
[KGCrypt vx:x]
signature = E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 64 A1 30 ?? ?? ?? 84 C0 74 ?? 64 A1 20 ?? ??
?? 0B C0 74
ep_only = true
[kkrunchy -> Ryd]
signature = BD 08
C1 F3 AB BF ?? ??
73 F3 FF 45 0C 91
00 00 E8 EB 00 00
03 83 C3 40 31 D2
00 00 3D 00 08 00
?? ?? 00 BB ?? ??
74 E8 78 0D 56 55
ep_only = true

??
??
AA
00
42
00
??
FF

??
00
83
8B
E8
83
00
53

00
57
C9
45
BD
D9
55
04

C7
BE
FF
10
00
FF
46
AB

45
??
8D
EB
00
83
AD
85

00
??
5C
42
00
F8
85
C0

??
??
8D
8D
8D
60
C0

??
00
18
9D
0C
83
74

??
31
FF
A0
48
D9
29

00
C9
D6
04
F6
FF
97

FF
41
74
00
C2
89
56

4D
FF
DD
00
10
45
FF

08
4D
E3
E8
74
10
13

C6
0C
17
DB
F3
56
85

45
8D
8D
00
41
89
C0

0C
9C
5D
00
91
FE
74

05
8D
1C
00
8D
29
16

8D
A0
FF
49
9D
C6
95

7D
00
D6
49
A0
F3
AC

14
00
74
78
08
A4
84

31
00
10
40
00
5E
C0

C0
FF
8D
8D
00
EB
75

B4
D6
9D
5D
E8
90
FB

04
10
A0
20
B2
BE
38

89
C9
08
74
00
??
06

[kkrunchy -> Ryd]

signature = BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89
C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9
73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10
ep_only = true

-99-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[kkrunchy v0:17 -> F: Giesen]

signature = FC FF 4D 08 31 D2 8D 7D 30 BE
ep_only = false
[kkrunchy V0:2X -> Ryd > Sign by fly]
signature = BD ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89
C1 F3 AB BF ?? ?? ?? ?? 57 BE ?? ?? ?? ?? 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6
ep_only = true
[Krypton v0:2]
signature = 8B 0C 24 E9 0A 7C 01 ?? AD 42 40 BD BE 9D 7A 04
ep_only = true
[Krypton v0:3]
signature = 8B 0C 24 E9 C0 8D 01 ?? C1 3A 6E CA 5D 7E 79 6D B3 64 5A 71 EA
ep_only = true
[Krypton v0:4]
signature = 54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 61 34 ?? ?? 2B 85 60 37 ?? ?? 83 E8 06
ep_only = true
[Krypton v0:5]
signature = 54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 71 44 ?? ?? 2B 85 64 60 ?? ?? EB 43 DF
ep_only = true
[kryptor 3]
signature = EB 66 87 DB
ep_only = true
[kryptor 5]
signature = E8 03 ?? ?? ?? E9 EB 6C 58 40 FF E0
ep_only = true
[kryptor 6]
signature = E8 03 ?? ?? ?? E9 EB 68 58 33 D2 74 02 E9 E9 40 42 75 02
ep_only = true
[kryptor 8]
signature = EB 6A 87 DB
ep_only = true
[kryptor 9]
signature = 60 E8 ?? ?? ?? ?? 5E B9 ?? ?? ?? ?? 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33
46 ?? 66 B9
ep_only = true
[LamCrypt 1:0 -> LaZaRuS]
signature = 60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8
ep_only = false
[LameCrypt -> LaZaRus]
signature = 60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8 ?? ??
40 00 FF E0
ep_only = true
[LameCrypt v1:0]
signature = 60 66 9C BB ?? ?? ?? ?? 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61
ep_only = true
[LamerStop v1:0c (c) Stefan Esser]
signature = E8 ?? ?? 05 ?? ?? CD 21 33 C0 8E C0 26 ?? ?? ?? 2E ?? ?? ?? 26 ?? ?? ?? 2E ?? ??
?? BA ?? ?? FA
-100-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[Lattice C v1:01]
signature = FA B8 ?? ?? 05 ?? ?? B1 ?? D3 E8 8C CB 03 C3 8E D8 8E D0 26 ?? ?? ?? ?? 2B D8 F7
?? ?? ?? 75 ?? B1 ?? D3 E3 EB
ep_only = true
[Lattice C v3:0]
signature = FA B8 ?? ?? 8E D8 B8 ?? ?? 8E
ep_only = true
[LaunchAnywhere 4:0:0:1]
signature = 55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00
64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75
08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3
ep_only = false
[LaunchAnywhere v4:0:0:1]
signature = 55 89 E5 53 83
64 89 25 00 00 00 00 68 C0
08 6A FF E8 6E 2B 00 00 59
75 14 89 C0 8D 40 00 43 8A
74 07 3C 09 75 D9 EB 01 43
E4 25 01 00 00 00 74 06 0F
50 E8 63 15 FF FF 50 E8 EE
ep_only = true

EC
69
E8
03
8A
B7
2A

48
44
A8
84
03
45
00

55
00
2C
C0
84
E8
00

B8
E8
00
74
C0
EB
59

FF
E4
00
04
74
05
8D

FF
80
E8
3C
04
B8
65

FF
FF
23
22
3C
0A
FC

FF
FF
2E
75
20
00
5B

50
59
00
F5
7E
00

50
E8
00
3C
F5
00

68
4E
FF
22
8D
50

E0
29
15
75
45
53

3E
00
4C
01
B8
6A

42
00
C2
43
50
00

00
E8
44
8A
FF
6A

64
C9
00
03
15
00

FF
0D
89
84
E4
FF

35
00
C3
C0
C1
15

00
00
EB
74
44
08

00
85
19
0B
00
C2

00
C0
3C
3C
8B
44

00
75
22
20
45
00

[Launcher Generator 1:03]

signature = 68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00
6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68
60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00
ep_only = false
[Launcher Generator v1:03]
signature = 68 00 20 40 00
6A 00 E8 93 00 00 00 85 C0
60 23 40 00 68 20 23 40 00
02 A3 5C 20 40 00 BB 70 21
00 8B D8 8B 03 05 70 20 40
26 00 00 00 A1 58 20 40 00
25 60 30 40 00 FF 25 64 30
00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00
ep_only = false

68
0F
6A
40
00
40
40
00
00

10
84
00
00
50
A3
00
00
00

20
7E
E8
03
B8
58
FF
00

40
00
83
C3
70
20
25
00

00
00
00
8B
22
40
68
00

6A
00
00
18
40
00
30
00

00
B8
00
68
00
EB
40
00

6A
00
A1
60
03
A2
00
00

00
00
58
20
05
6A
FF
00

6A
00
20
40
5C
FF
25
00

20
00
40
00
20
E8
6C
00

6A
3B
00
53
40
00
30
00

00
05
3B
B8
00
00
40
00

6A
68
05
F0
FF
00
00
00

00
20
6C
21
30
00
FF
00

6A
40
20
40
FF
FF
25
00

00
00
40
00
35
25
74
00

68
74
00
03
00
5C
30
00

F0
13
74
05
20
30
40
00

22
6A
51
5C
40
40
00
00

40
??
C1
20
00
00
00
00

00
68
E0
40
E8
FF
00
00

[LCC Win32 DLL]

signature = 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 ?? ?? ?? FF 75 10 FF 75 0C FF 75 08 A1
ep_only = true
[LCC Win32 v1:x]
signature = 64 A1 ?? ?? ?? ?? 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 ?? 50
ep_only = true
[LCC-Win32]
signature = 64 A1 00 00 00 00 55 89 E5 6A FF 68 10 30 40 00 68 9A 10 40
ep_only = true
[LGLZ v1:04 [com]
signature = BF ?? ?? 3B FC 72 19 B4 09 BA 12 01 CD 21 B4 4C CD 21
ep_only = true
[LGLZ v1:04b]
-101-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = FC 1E 06 0E 8C C8 ?? ?? ?? ?? BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33
FF B9 ?? ?? F3 A5 4B 48 4A 79
ep_only = true
[LHA-SFX Archive v2:05; v2:13]
signature = EB J3 FC BC ?? ?? 8C C8 05 ?? ?? 8E C0 EB ?? ?? ?? ?? ?? E8 ?? ?? 06 1F B4 30 CD
21 8B D8 1E 3C 03 72 ?? 36 ?? ?? ?? ?? 33 C0 8B F8 B9
ep_only = true
[LHA-SFX Archive v2:05S; v2:54S]
signature = EB J3 ?? ?? ?? FC BC ?? ?? 8C C8 05 ?? ?? 8E C0 EB
ep_only = true
[LHA-SFX Archive v2:13L]
signature = EB J3 FC BC ?? ?? 8C C8 05 ?? ?? 8E C0 E8 ?? ?? BB ?? ?? E8 ?? ?? 06 1F B4 30 CD
21 8B D8 1E
ep_only = true
[LHARC-SFX Archive v1:131c]
signature = EB J3 ?? ?? ?? ?? 24 4C 48 61 72 ?? 27 73 ?? 53 46 58
ep_only = true
[LHARC-SFX Archive v1:13L]
signature = E9 J1 J1 FC BC ?? ?? BB ?? ?? E8 ?? ?? 8C C8 05 ?? ?? 8E C0 B8 ?? ?? CD 21 BE ??
?? 26 ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? AC E8
ep_only = true
[LHICE-SFX Archive v1:13; v1:17]
signature = EB J3 FC BC ?? ?? BB ?? ?? E8 ?? ?? 8C C8 2E ?? ?? ?? ?? 8E D8 8E C0 05 ?? ?? 2E
?? ?? ?? ?? 76 ?? BB
ep_only = true
[Libraries by John Socha]
signature = BB ?? ?? 8E DB 2E 89 ?? ?? ?? 8D ?? ?? ?? 25 ?? ?? FA 8E D3 8B E0 FB 26 A1 A3 ??
?? B4 30 CD 21
ep_only = true
[LOCK98 V1:00:28 -> keenvim]
signature = 55 E8 00 00 00 00 5D 81 ?? ?? ?? ?? ?? EB 05 E9 ?? ?? ?? ?? EB 08
ep_only = true
[Lockless Intro Pack]
signature = 2C E8 ?? ?? ?? ?? 5D 8B C5 81 ED F6 73 ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 06 89 85
ep_only = true
[LockProg v0:5a]
signature = E8 J1 J1 E8 ?? ?? E8 ?? ?? BF ?? ?? 8B EC 8B ?? ?? 2E ?? ?? ?? 03 F9 89 0D B4 30
CD 21 3C 02 73 ?? B4 4C CD 21
ep_only = true
[Lotus Word Pro document file]
signature = 57 6F 72 64 50 72 6F ?? ?? ?? ?? ?? ?? ?? ?? ?? 4C 57 50 37
ep_only = false
[LSI C-86 Run-Time Libray]
signature = B8 ?? ?? 8E C0 06 17 BC ?? ?? 26 8C ?? ?? ?? B4 30 CD 21 26 A3 ?? ?? FC
ep_only = true
[LTC v1:3]
signature = 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06
ep_only = true

-102-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

[LY_WGKX * =?TT V2:X -> www:szleyu:com *

signature = 00 00 00 00 ?? ?? ?? ?? 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00
00 00 00 01 00 4D 79 46 75 6E 00 62 73 00 00
ep_only = false

04 August 2015 15:14

Sign:By:fly
00 00 00 00
00 00 4C 59
00 00 00 ??

* 20080122]
00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00
?? ?? ?? 00 00 00 00 00 00 00 00 00

[LZEXE v0:91; v1:00a (1)]

signature = 06 0E 1F 8B ?? ?? ?? 8B F1 4E 89 F7
ep_only = true
[LZEXE v0:91; v1:00a (2)]
signature = BF ?? ?? 06 89 F9 0E 41 1F 8C CB 89 FE
ep_only = true
[Macromedia Windows Flash Projector/Player 5:0]
signature = 83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84
C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8
8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00
ep_only = false
[Macromedia Windows Flash Projector/Player v3:0]
signature = 55 8B EC 83 EC 44 56 FF 15 94 13 42 00 8B F0 B1 22 8A 06 3A C1 75 13 8A 46 01 46
3A C1 74 04 84 C0 75 F4 38 0E 75 0D 46 EB 0A 3C 20 7E 06
ep_only = true
[Macromedia Windows Flash Projector/Player v4:0]
signature = 83 EC 44 56 FF 15 24 41 43 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84
C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C
ep_only = true
[Macromedia Windows Flash Projector/Player v5:0]
signature = 83 EC 44 56 FF 15 70 61 44 00 8B F0 8A
C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46
8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75
FF 15 80 61 44 00 F6 44 24 30 01 74 0B 8B 44 24 34
6A 00 6A 00 FF 15 74 61 44 00 50 E8 18 00 00 00 50
90 90 90
ep_only = true

06
EB
F4
25
FF

3C
0C
8D
FF
15

22
3C
44
FF
78

75
20
24
00
61

1C
7E
04
00
44

8A
08
C7
EB
00

46
8A
44
05
5E

01
46
24
B8
83

46
01
30
0A
C4

3C
46
00
00
44

22
3C
00
00
C3

74
20
00
00
90

0C
7F
00
50
90

84
F8
50
56
90

[Macromedia Windows Flash Projector/Player v6:0]

signature = 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84
C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C
ep_only = true
[Maked by Grabber v:3:84]
signature = E9 J1 J1 FC 8C DB 8C C8 8E D8 8E C0 89 1E ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? E8
ep_only = true
[Maked by Graphic WorkShop's Self-Displayer v:6:0]
signature = E9 J1 J1 2E C7 ?? ?? ?? ?? ?? B8 ?? ?? A9 ?? ?? 74 ?? 25 ?? ?? BB ?? ?? 2B D8 43
2E 01 1E ?? ?? E8 ?? ?? 3D
ep_only = true
[Maked by Graphic WorkShop: Self-Displayer v:7:0]
signature = E9 J1 J1 2E C7 06 ?? ?? ?? ?? B8 ?? ?? A9 ?? ?? 74 ?? 25 ?? ?? BB ?? ?? 2B D8 43
2E
ep_only = true
[Maked by The DRAW v:?:??]
signature = EB J3 B4 ?? CD 10 BB ?? ?? 3C ?? 74 ?? 3C ?? 74 ?? C6
ep_only = true
-103-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[MASK v2:3]
signature = E8 J1 J1 55 57 CD 03 FC 4D 41 53 4B FA 8B EC 83 ?? ?? ?? FF ?? ?? 5D 49 E8
ep_only = true
[MaskPE V2:0 -> yzkzero]
signature = B8 18 00 00 00 64 8B 18 83 C3 30 C3 40 3E 0F B6 00 C1 E0 ?? 83 C0 ?? 36 01 04 24
C3
ep_only = false
[MASM / TASM]
signature = 6A 00 E8 ?? 0? 00 00 A3 ?? 32 40 00 E8 ?? 0? 00 00
ep_only = true
[MASM / TASM]
signature = 6A 00 E8 ?? ?? 00 00 A3 ?? 32 40 00 E8 ?? ?? 00 00
ep_only = false
[MASM / TASM]
signature = 6A 00 E8 ?? 0? 00 00 A3 ?? ?? 40 00 ?? ?? ?? ?0 ?0 ?? ?? 00 00 00 ?? ?? 0? ?? ??
?0 ?? ?? ?0 ?0 ?? ?? ?? ?0 ?? 0? ?? ?0 ?0 00
ep_only = false
[MASM/TASM - sig1(h)]
signature = CC FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25
?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ??
?? ?? 00 FF 25 ?? ?? ?? 00
ep_only = false
[MASM/TASM - sig2(h)]
signature = C2 ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00
FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00
ep_only = false
[MASM/TASM - sig4
signature = C3 FF
?? ?? ?? 00 FF 25
?? ?? 00 FF 25 ??
ep_only = false

(h)]
25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25
?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ??
?? ?? 00

[MASM/TASM - sig4
signature = FF 25
?? ?? 00 FF 25 ??
?? 00 FF 25 ?? ??
ep_only = false

(h)]
?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ??
?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ??
?? 00

[MASM32]
signature = 6A ?? 68 00 30 40 00 68 ?? 30 40 00 6A 00 E8 07 00 00 00 6A 00 E8 06 00 00 00 FF
25 08 20
ep_only = true
[Matrix Dongle -> TDi GmbH * Sign:By:fly]
signature = E8 00 00 00 00 E8 00 00 00 00 59 5A 2B CA 2B D1 E8 1A FF FF FF
ep_only = true
[Matrix Dongle
signature = 00
00 00 00 00 00
4C 69 62 72 61
4C 33 32 2E 44
2B D9 8B F8 8B
F9 8D 64 24 04

->
00
00
72
4C
4C
FF

TDi GmbH
00 00 00
00 00 00
79 41 00
4C 00 E8
24 2C 33
64 24 FC

* Sign:By:fly]
00 00 00 00 00
00 00 00 00 ??
00 00 47 65 74
B6 00 00 00 00
C0 2B CF F2 AA
60 C7 42 08 ??

00
??
50
00
8B
??

00
??
72
00
3C
??

??
??
6F
00
24
??

-104-

??
??
63
00
8B
E8

??
??
41
00
0A
C5

??
??
64
??
2B
FF

??
??
64
??
CF
FF

??
00
72
??
89
FF

??
00
65
??
5C
C3

??
00
73
??
24
C2

00
00
73
??
20
F7

00
00
00
E8
80
29

00
00
4B
00
37
4E

00
4C
45
00
A2
29

00
6F
52
00
47
5A

00
61
4E
00
49
29

00
64
45
5B
75
E6

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

86 8A 89 63 5C A2 65 E2 A3 A2
ep_only = false
[MCLock v1:2; v1:3]
signature = E9 J1 J1 90 90 90 FA 29 C0 8E C0 26 C6 06
ep_only = true
[MEGALITE v1:20a]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 2D 73 ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 90
ep_only = true
[MESS v1:07]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 ?? ?? F3 ?? AC E3 ?? EB J3 BA ?? ?? B4 09 CD 21
CD 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B4 30 CD 21 3C 02 77
ep_only = true
[MESS v1:20]
signature = ?? ?? ?? ?? FA B9 ?? ?? F3 ?? AC ?? ?? EB J3 1E 0E 1F BA ?? ?? 81 ?? ?? ?? B4 09
CD 21 1F B4 4C CD 21
ep_only = true
[MESS v1:20]
signature = ?? ?? ?? ?? FA B9 ?? ?? F3 ?? ?? E3 ?? EB ?? EB ?? B6
ep_only = true
[MetaWare High C + Phar Lap DOS Extender 1983-89]
signature = B8 ?? ?? 8E D8 B8 ?? ?? CD 21 A3 ?? ?? 3C 03 7D ?? B4 09
ep_only = true
[MetaWare High C + Phar Lap DOS Extender 1983-89]
signature = EB J3 33 ED 2E 8E 1E ?? ?? 26 A1 ?? ?? A3 ?? ?? 26 8B 1E ?? ?? B1 ?? 4B
ep_only = true
[MetaWare High C Run-Time Library + Phar Lap DOS Extender 1983-89]
signature = B8 ?? ?? 50 B8 ?? ?? 50 CB
ep_only = true
[Metrowerks CodeWarrior
signature = 55 89 E5 53
E8 6E FF FF FF 09 C0 75
03 75 0A 53 56 FF 75 08
ep_only = false

(DLL)
56 57
04 31
E8 47

v2:0]
8B 75 0C 8B 5D 10 83 FE 01 74 05 83 FE 02 75 12 53 56 FF 75 08
C0 EB 21 53 56 FF 75 08 E8 ?? ?? ?? ?? 89 C7 09 F6 74 05 83 FE
FF FF FF 89 F8 8D 65 F4 5F 5E 5B 5D C2 0C 00 C9

[Metrowerks CodeWarrior v2:0 (Console)]

signature = 55 89 E5 55 B8 FF FF FF FF 50 50 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00
00 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00
E8
ep_only = false
[Metrowerks CodeWarrior v2:0 (GUI)]
signature = 55 89 E5 53 56 83 EC 44 55 B8 FF FF FF FF 50 50 68 ?? ?? 40 00 64 FF 35 00 00 00
00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00
E8
ep_only = false
[MEW 10 by Northfox]
signature = 33 C0 E9 ?? ?? FF FF ?? 1C ?? ?? 40
ep_only = false
[Mew 10 exe-coder 1:0 -> Northfox [HCC]]
signature = 33 C0 E9 ?? ?? FF FF 6A ?? ?? ?? ?? ?? 70
ep_only = true
-105-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[MEW 10 packer v1:0 -> Northfox]

signature = 33 C0 E9 ?? ?0
ep_only = true
[Mew 10 v1:0 (Eng) -> Northfox]
signature = 33 C0 E9 ?? ?? ?? FF
ep_only = true
[Mew 10 V1:0 (Eng) -> Northfox]
signature = 33 C0 E9 ?? ?? FF FF
ep_only = true
[MEW 11 SE 1:0 -> Northfox]
signature = E9 ?? ?? ?? ?? 00 00 00 02 00 00 00 0C 00
ep_only = false
[MEW 11 SE 1:1 -> Northfox]
signature = E9 ?? ?? ?? ?? 0C ?? ?? ?? 00 00 00 00 00 00 00 00
ep_only = false
[MEW 11 SE 1:2]
signature = E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false
[MEW 11 SE v1:0 -> Northfox]
signature = E9 ?? ?? ?? ?? 00 00 00 02 00 00 00 0C ?0
ep_only = true
[MEW 11 SE v1:1 -> Northfox [HCC]]
signature = E9 ?? ?? ?? FF 0C
ep_only = true
[MEW 11 SE v1:1 -> Northfox [HCC]]
signature = E9 ?? ?? ?? FF 0C ?0
ep_only = true
[MEW 11 SE v1:1]
signature = E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00
ep_only = false
[Mew 11 SE v1:2 (Eng) -> Northfox]
signature = E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C
ep_only = true
[MEW 11 SE v1:2 -> Northfox[HCC]
signature = E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? ?? 00
ep_only = true
[MEW 11 SE v1:2]
signature = E9 ??
00 00 00 00 00 00
00 00 00 00 00 00
00 00 00 00 00 00
00 00 00 00 00 00
00 00 00 00 00 00
00 00 00 00 00 00
00 00 00 00 00 00
00 00 00 00 00 00
ep_only = false

??
00
00
00
00
00
00
00
00

??
00
00
00
00
00
00
00
00

FF
00
00
00
00
00
00
00
00

0C
00
00
00
00
00
00
00
00

??
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

-106-

00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

??
00
00
00
00
00
00
00

??
00
00
00
00
00
00
00

??
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

0C
00
00
00
00
00
00
00

??
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[MEW 5 1:0 -> Northfox]

signature = BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0
ep_only = true
[MicroDog Win32Shell
signature = 60 55 8B
C6 85 BA FE FF FF 00
E8 FC FF FF 00 C6 85
FF 33 C0 B9 3F 00 00
09 00 00 90 68 00 10
68 00 10 00 00 A1 ??
?? ?? ?? 89 85 34 FE
00 00 E9 38 11 00 00
8D DF 00 00 00 8B 45
FF 00 00 0F AF C1 8B
ep_only = true

V4:0:9:3
EC 81 EC
C6 85 BB
E9 FC FF
00 F3 AB
00 00 E8
?? ?? ??
FF FF 8B
66 C7 45
EC 25 FF
4D EC 81

->
34
FE
FF
C7
B8
50
85
EC
FF
E1

SafeNet * Sign:By:fly]
04 00 00 53 56 57 C6 85
FF FF 00 8D BD BC FE FF
00 C6 85 EA FC FF FF 00
85 10 FE FF FF A5 A5 00
F5 FF FF 83 C4 04 89 45
8B 45 D0 50 E8 FF F6 FF
34 FE FF FF 89 45 CC E9
00 00 EB 04 66 FF 45 EC
00 00 8B 4D EC 81 E1 FF
FF FF 00 00 0F AF C1 83

[MicroDog Win32Shell
signature = 80 7C 24
53 56 57 8B 45 08 8B
01 00 00 C7 45 EC 35
8B 45 EC 0F AF 45 FC
00 FF FF 03 C1 40 89
E8 EB 00 5F 5E 5B C9
ep_only = true

V4:0:9:3
08 01 0F
00 C1 E8
4E 00 00
25 FF FF
45 E8 8B
C3

Dll -> SafeNet

85 19 FF FF FF
10 89 45 FC 8B
8B 45 F4 0F AF
00 00 01 45 F0
45 E8 8B 4D 08

[MicroDog Win32Shell
signature = 60 55 8B
C6 85 ?? ?? ?? ?? ??
?? ?? ?? ?? ?? C6 85
?? 33 C0 B9 3F ?? ??
09 00 00 ?? 68 ?? ??
68 ?? ?? ?? ?? A1 ??
?? ?? ?? 89 ?? ?? ??
00 00 E9 38 11 00 00
8D DF 00 00 00 8B ??
FF 00 00 0F AF C1 8B
ep_only = true

V4:X -> SafeNet *

EC 81 EC ?? ?? ??
C6 85 ?? ?? ?? ??
?? ?? ?? ?? ?? C6
?? F3 AB C7 85 ??
?? ?? E8 ?? ?? ??
?? ?? ?? 50 8B ??
?? ?? 8B ?? ?? ??
66 ?? ?? ?? ?? ??
?? 25 FF FF 00 00
?? ?? 81 E1 FF FF

B8
FF
C6
00
D0
FF
CE
8B
FF
C0

FE
33
85
66
83
83
0E
45
00
07

FF
C0
EB
C7
7D
C4
00
EC
00
89

FF
B9
FC
85
D0
0C
00
25
0F
85

00
3F
FF
08
00
A1
E9
FF
AF
EC

C6
00
FF
FE
75
??
36
FF
C1
FB

85
00
00
FF
05
??
11
00
8B
FF

B9
00
8D
FF
E9
??
00
00
4D
FF

FE
F3
BD
0A
C1
??
00
83
EC
EB

FF
AB
EC
00
11
33
E9
F8
81
7E

FF
C6
FC
E9
00
05
3D
03
E1

00
85
FF
13
00
??
11
0F
FF

* Sign:By:fly]
E9 AF EC FF FF
45 08 8B 00 25
45 F8 25 FF FF
8B 45 EC 0F AF
89 01 C1 6D E8

90
FF
00
45
10

90
FF
00
F8
81

90
00
89
8B
65

90
00
45
4D
E8

90
89
F0
F0
FF

55
45
83
C1
7F

8B
F8
7D
E1
00

EC
C7
FC
10
00

83
45
00
81
66

EC
F4
74
E1
8B

18
5A
0F
00
45

??
33
85
66
83
83
0E
??
00
??

??
C0
??
C7
??
??
00
??
00
89

??
B9
??
??
??
??
00
25
0F
??

??
3F
??
??
??
A1
E9
FF
AF
??

C6
??
??
??
75
??
36
FF
C1
??

85
??
??
??
05
??
11
00
8B
??

??
??
8D
??
E9
??
00
00
??
??

??
F3
BD
??
C1
??
00
83
??
EB

??
AB
??
??
11
33
E9
??
81
7E

??
C6
??
E9
00
??
3D
??
E1

??
85
??
13
00
??
11
0F
FF

Sign:By:fly]
?? 53 56 57 C6
?? 8D BD ?? ??
85 ?? ?? ?? ??
?? ?? ?? ?? ??
?? 83 ?? ?? 89
?? 50 E8 ?? ??
?? ?? 89 ?? ??
EB 04 66 ?? ??
8B ?? ?? 81 E1
00 00 0F AF C1

85
??
??
??
??
??
E9
??
FF
83

??
??
C6
??
??
??
CE
8B
FF
??

[MicroJoiner 1:1 -> coban2k]

signature = BE 0C 70 40 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11
ep_only = true
[MicroJoiner 1:5 -> coban2k]
signature = BF 05 10 40 00 83 EC 30 8B EC E8 C8 FF FF FF E8 C3 FF FF FF
ep_only = true
[MicroJoiner 1:6 -> coban2k]
signature = 33 C0 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B
ep_only = true
[MicroJoiner 1:7 -> coban2k]
signature = BF 00 10 40 00 8D 5F 21 6A 0A 58 6A 04 59 60 57 E8 8E 00 00 00
ep_only = true
[Microsoft (R) Full-text index file]
signature = 6C 6C 2D 74 65 78 74 20 69 6E 64 65 78
ep_only = false
[Microsoft (R) Incremental Linker Version 5:12:8078 (MASM/TASM)]
signature = 6A 00 68 00 30 40 00 68 1E 30 40 00 6A 00 E8 0D 00 00 00 6A 00 E8 00 00 00 00 FF
-107-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

25 00 20 40 00 FF 25 08 20 40
ep_only = false
[Microsoft Access Database file]
signature = 00 01 00 00 53 74 61 6E 64 61 72 64 20 4A 65 74 20 44 42 00
ep_only = false
[Microsoft Basic Compiler v5:60 1982-97]
signature = 9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 33 DB BA ?? ?? 9A ?? ?? ?? ?? C7 06
?? ?? ?? ?? 33 DB
ep_only = true
[Microsoft C (1988/1989)]
signature = B4 30 CD 21 3C 02 73 ?? CD 20 BF ?? ?? 8B ?? ?? ?? 2B F7 81 ?? ?? ?? 72
ep_only = true
[Microsoft C (1990/1992)]
signature = B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72
?? BE ?? ?? FA 8E D7
ep_only = true
[Microsoft C for Windows (1)]
signature = 33 ED 55 9A ?? ?? ?? ?? 0B C0 74
ep_only = true
[Microsoft C for Windows (2)]
signature = 8C D8 ?? 45 55 8B EC 1E 8E D8 57 56 89
ep_only = true
[Microsoft C Library 1985]
signature = BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7 81 C4 ?? ?? FB 73
ep_only = true
[Microsoft C v1:04]
signature = FA B8 ?? ?? 8E D8 8E D0 26 8B ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 04 D3 E3 EB
ep_only = true
[Microsoft C++ (1990/1992)]
signature = B8 00 30 CD 21 3C 03 73 ?? 0E 1F BA ?? ?? B4 09 CD 21 06 33 C0 50 CB
ep_only = true
[Microsoft C]
signature = B4 30 CD 21 3C 02 73 ?? B8
ep_only = true
[Microsoft CAB SFX module]
signature = 55 8B EC 83 EC 44 56 FF 15 ?? 10 00 01 8B F0 8A 06 3C 22 75 14 8A 46 01 46 84 C0
74 04 3C 22 75 F4 80 3E 22 75 0D ?? EB 0A 3C 20
ep_only = true
[Microsoft CAB SFX]
signature = E8 0A 00 00 00 E9 7A FF FF FF CC CC CC CC CC
ep_only = true
[Microsoft FORTRAN]
signature = FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? B9 ??
?? 9A ?? ?? ?? ?? 80 ?? ?? ?? ?? 74 ?? E9
ep_only = true
[Microsoft QBasic v3:0]
signature = E9 J1 J1 8C C8 8E D8 E8 ?? ?? 8A 17 0A D2 74 ?? B4 ?? CD 21 43
ep_only = true
-108-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Microsoft QBasic v4:0]

signature = EB J3 0E 1F B8 ?? ?? 50 9A ?? ?? ?? ?? 8E DA 93 8A 17 0A D2 74 ?? B4 ?? CD 21 43
ep_only = true
[Microsoft Resource Cursors file]
signature = 00 00 02 00 01 00 20 20 00 00 ?? 00 ?? 00 E8 02 00 00 16
ep_only = false
[Microsoft Visual Basic 5:0]
signature = FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00
ep_only = false
[Microsoft Visual Basic v5:0 - v6:0]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 ?? 00 00 00 30 ?? 00
ep_only = false
[Microsoft Visual Basic v5:0 - v6:0]
signature = FF 25 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF
ep_only = false
[Microsoft Visual Basic v5:0/v6:0]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 00 00 00 00 30 00 00 00
ep_only = true
[Microsoft Visual Basic v5:0]
signature = ?? ?? ?? ?? ?? ?? ?? FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00
ep_only = true
[Microsoft Visual Basic v6:0 DLL]
signature = 5A 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E9 ?? ?? FF
ep_only = true
[Microsoft Visual Basic v6:0]
signature = FF 25 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF ?? ?? ?? ?? ?? ?? 30
ep_only = false
[Microsoft Visual C 2:0]
signature = 64 A1 00 00 00 00 55 8B EC 6A FF 68
ep_only = true
[Microsoft Visual C 5:0]
signature = 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 A8 53 56 57
ep_only = false
[Microsoft Visual C v2:0]
signature = 53 56 57 BB ?? ?? ?? ?? 8B ?? ?? ?? 55 3B FB 75
ep_only = true
[Microsoft Visual C / Basic :NET]
signature = FF 25 00 20 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true
[Microsoft Visual C v7:0 / Basic :NET]
signature = FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false
[Microsoft Visual C++ (3:0 old crap)]
signature = 64 A1 00 00 00 00 55 ?? ?? 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 ?? ?? ?? ?? ??
00 00 83 EC 10
-109-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[Microsoft Visual C++ 4:2]
signature = 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ??
?? ?? 83 ?? ?? 53 56 57 89
ep_only = true
[Microsoft Visual
signature = 55 8B
?? ?? E8 ?? ?? ??
?? ?? ?? ?? 8B E5
ep_only = false

C++ 5:0 - 7:1]

EC 81 EC 04 01 00 00 68 04 01 00 00 8D 85 FC FE FF FF 50 6A 00 FF 15 ?? ??
?? 8D 8D FC FE FF FF 51 E8 ?? ?? ?? ?? 83 C4 04 E8 ?? ?? ?? ?? 6A 00 FF 15
5D C2 10 00

[Microsoft Visual
signature = 68 ??
56 57 8B 45 F8 89
C3 8B 4D F0 64 89
ep_only = true

C++ 6:0 - 8:0]

?? ?? ?? 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53
65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00
0D 00 00 00 00 59 5F 5E 5B C9 51 C3 & 40 =T RU NC AT ED HE RE & 41

[Microsoft Visual
signature = 68 ??
56 57 8B 45 F8 89
C3 8B 4D F0 64 89
ep_only = false

C++ 6:0 - 8:0]

?? ?? ?? 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53
65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00
0D 00 00 00 00 59 5F 5E 5B C9 51 C3

[Microsoft Visual
signature = 68 ??
56 57 8B 45 F8 89
C3 8B 4D F0 64 89
ep_only = true

C++ 6:0 - 8:0]

?? ?? ?? 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53
65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00
0D 00 00 00 00 59 5F 5E 5B C9 51

[Microsoft Visual C++ 6:0 - 8:0]

signature = 8B 44 24 08 8B 4C 24 10 0B C8 8B 4C 24 0C 75 09 8B 44 24 04 F7 E1 C2 10 00 53 F7
E1 8B D8 8B 44 24 08 F7 64 24 14 03 D8 8B 44 24 08 F7 E1 03 D3 5B C2 10 00
ep_only = false
[Microsoft Visual
signature = 68 ??
8D 6C 24 10 2B E0
4D F0 64 89 0D 00
ep_only = false

C++ 6:0 - 8:0]

?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 8B 44 24 10 89 6C 24 10
53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 C3 8B
00 00 00 59 5F 5E 5B C9 51 C3

[Microsoft Visual
signature = 68 ??
56 57 8B 45 F8 89
C3 8B 4D F0 64 89
ep_only = false

C++ 6:0 - 8:0]

?? ?? ?? 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53
65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00
0D 00 00 00 00 59 5F 5E 5B C9 51 C3 &40=TRUNCATED HERE&41

[Microsoft Visual C++ 6:0 - 8:0]

signature = 3D 00 10 00 00 73 0E F7 D8 03 C4 83 C0 04 85 00 94 8B 00 50 C3 51 8D 4C 24 08 81
E9 00 10 00 00 2D 00 10 00 00 85 01 3D 00 10 00 00 73 EC 2B C8 8B C4 85 01 8B E1 8B 08 8B 40
04 50 C3
ep_only = false
[Microsoft Visual
signature = 8B 44
?? ?? 0F 85 ?? ??
?? ?? 83 20 00 A1
ep_only = false

C++ 6:0 - 8:0]

24 08 85 C0 0F 84 ?? ?? ?? ?? 83 F8 01 8B 0D ?? ?? ?? ?? 8B 09 89 0D ?? ??
?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 85 C0 59 A3 ?? ?? ?? ?? 0F 84 ?? ??
?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8

[Microsoft Visual C++ 6:0 DLL (Debug)]

signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 ?? ?? 83
-110-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = false
[Microsoft Visual
signature = 55 8B
26 83 FE 01 74 05
53 E8 15 FF FF FF
ep_only = false

C++ 6:0 DLL]

EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 75 09 83 3D ?? ?? ?? ?? ?? EB
83 FE 02 75 22 A1 ?? ?? ?? ?? 85 C0 74 09 57 56 53 FF D0 85 C0 74 0C 57 56
85 C0 75 04 33 C0 EB 4E

[Microsoft Visual C++ 6:0 SFX Custom]

signature = E8 21 48 00 00 E9 16 FE FF FF 51 C7 01 08 B4 00 30 E8 A4 48 00 00 59 C3 56 8B F1
E8 EA FF FF FF F6 ?? ?? ?? ?? 74 07 56 E8 F6 04 00 00 59 8B C6 5E C2 04 00 8B 44 24 04 83 C1
09 51 83 C0 09 50
ep_only = true
[Microsoft Visual C++ 7:0 Custom]
signature = 60 BE 00 B0 44 00 8D BE 00 60 FB FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46
88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11
DB 11 C0 01 DB 73
ep_only = true
[Microsoft Visual C++ 7:0 DLL]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? 01
ep_only = false
[Microsoft Visual C++ 7:0 MFC]
signature = 6A 60 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF 94 00 00 00 8B C7 E8 ?? ?? ?? ?? 89
ep_only = true
[Microsoft Visual C++ 7:0]
signature = 6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 40 89 45 E4 8B 75 0C
ep_only = true
[Microsoft Visual C++ 7:0]
signature = 6A 18 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF 94 00 00 00 8B C7 E8 ?? ?? ?? ?? 89
ep_only = true
[Microsoft Visual
signature = 8B FF
00 A3 ?? ?? ?? ??
0F 84 ?? ?? ?? ??
ep_only = false

C++ 7:1]
55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B
0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ??
89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3

[Microsoft Visual
signature = 55 8B
00 00 00 89 45 F8
C4 04 0B C0 74 7B
ep_only = false

C++ 7:1]
EC 83 EC 08 53 56 57 55 FC 8B 5D 0C 8B 45 08 F7 40 04 06 00 00 00 0F 85 AB
8B 45 10 89 45 FC 8D 45 F8 89 43 FC 8B 73 0C 8B 7B 08 53 E8 ?? ?? ?? ?? 83
83 FE FF 74 7D 8D 0C 76 8B 44 8F 04 0B C0 74 59 56 55

[Microsoft Visual
signature = 8B FF
00 A3 ?? ?? ?? ??
0F 84 ?? ?? ?? ??
?? ?? FF 05 ?? ??
ep_only = false

C++ 7:1]
55 8B EC
0F 85 ??
89 30 A1
?? ?? 59

[Microsoft Visual
signature = 8B FF
83 7D 0C 01 A1 ??
59 A3 ?? ?? ?? ??
ep_only = false

C++ 7:1]
55 8B EC 56 33 F6 39 75 0C 75 0E 39 35 ?? ?? ?? ?? 7E 2D FF 0D ?? ?? ?? ??
?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 75 3D 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6
75 04 33 C0 EB 67 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68

56
??
??
59

33
??
??
33

F6
??
??
C0

39
68
??
40

75
80
68
5E

0C
00
??
5D

0F
00
??
C2

84
00
??
0C

-111-

?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B
FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ??
?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ??
00

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Microsoft Visual C++ 7:1]

signature = 8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B
00 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 39 75 0C 0F 84 ?? ?? ?? ?? 33 C0 40 5E 5D C2 0C 00
ep_only = false
[Microsoft Visual
signature = 8B FF
00 A3 ?? ?? ?? ??
?? ?? 89 30 A1 ??
ep_only = false

C++ 7:1]
55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B
75 44 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ??
?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8

[Microsoft Visual
signature = C0 ??
?? ?? ?? 00 00 ??
?? 00 00 00 00 00
ep_only = true

C++ 8:0 (MFC)]

?? 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ??
?? ?? ?? ?? 00 00 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 00

[Microsoft Visual C++ 8:0 (MFC)]

signature = 48 83 EC 28 E8 ?? ?? 00 00 48 83 C4 28 E9 0E FD FF FF CC CC CC CC CC CC CC CC CC
CC CC CC CC CC
ep_only = true
[Microsoft Visual
signature = E9 ??
?? ?? ?? E9 ?? ??
?? ?? E9 ?? ?? ??
?? E9 ?? ?? ?? ??
ep_only = true

C++ 8:0 [Debug]

?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ??
?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ??
?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ??
E9 ?? ?? ?? ?? E9

[Microsoft Visual
signature = E9 ??
?? ?? ?? E9 ?? ??
?? ?? E9 ?? ?? ??
ep_only = true

C++ 8:0 [Debug]]

?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ??
?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ??
?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9

[Microsoft Visual
signature = 6A 14
D7 50 FF ?? ?? ??
?? ?? 56 85 C0 75
ep_only = true

C++ 8:0]
68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B ?? ?? ?? ?? ?? FF
?? ?? 8B F0 85 F6 75 0A 6A 12 E8 ?? ?? ?? ?? 59 EB 18 89 1E 56 FF ?? ?? ??
14 50 FF D7 50 FF ?? ?? ?? ?? ?? B8

[Microsoft Visual C++ 8:0]

signature = E8 ?? ?? 00 00 E9 ?? ?? FF FF
ep_only = true
[Microsoft Visual
signature = 83 3D
04 FF 15 ?? ?? ??
59 75 54 56 57 68
ep_only = false

C++ 8:0]
?? ?? ?? ?? 00 74 1A 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59 74 0B FF 74 24
?? 59 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 59
?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B C6 BF

[Microsoft Visual C++ 8:0]

signature = 48 83 EC 28 E8 ?? ?? 00 00 48 83 C4 28 E9 ?? ?? FF FF CC CC CC CC CC CC CC CC CC
CC CC CC CC CC
ep_only = true
[Microsoft Visual
signature = ?? ??
?? ?? ?? 00 00 ??
?? 00 00 00 00 00
ep_only = true

C++ 8:0]
?? 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ??
?? ?? ?? ?? 00 00 00 00 00 ?? ?? 00 00 00 00 00 ?? ?? ?? 00 00

-112-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Microsoft Visual C++ ?:?]

signature = 83 ?? ?? 6A 00 FF 15 F8 10 0B B0 8D ?? ?? ?? 51 6A 08 6A 00 6A 00 68
ep_only = true
[Microsoft Visual C++ DLL]
signature = 53 55 56 8B 74 24 14 85 F6 57 B8 01 00 00 00
ep_only = true
[Microsoft Visual C++ DLL]
signature = 55 8B EC 56 57 BF 01 00 00 00 8B 75 0C
ep_only = true
[Microsoft Visual C++ DLL]
signature = 53 B8 01 00 00 00 8B 5C 24 0C 56 57 85 DB 55 75 12 83 3D ?? ?? ?? ?? ?? 75 09 33
C0
ep_only = true
[Microsoft Visual C++ DLL]
signature = 53 56 57 BB 01 ?? ?? ?? 8B ?? 24 14
ep_only = true
[Microsoft Visual C++ v4:2 DLL]
signature = 53 B8 ?? ?? ?? ?? 8B ?? ?? ?? 56 57 85 DB 55 75
ep_only = true
[Microsoft Visual C++ v4:2]
signature = 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ??
?? ?? 83 ?? ?? 53 56 57 89 ?? ?? C7
ep_only = true
[Microsoft Visual C++ v4:2]
signature = 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ??
?? ?? 83 ?? ?? 53 56 57 89 ?? ?? FF
ep_only = true
[Microsoft Visual C++ v4:x]
signature = 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 89 25 00 00
00 00 83 EC ?? 53 56 57
ep_only = true
[Microsoft Visual
signature = ?? ??
?? ?? ?? 8B ?? 24
?? ?? ?? ?? ?? ??
ep_only = true

C++ v5:0
24 ?? ??
0C ?? ??
?? ?? ??

DLL]
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? 83

[Microsoft Visual
signature = ?? ??
?? ?? ?? 8B ?? 24
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
ep_only = true

C++ v5:0
24 ?? ??
0C ?? ??
?? ?? ??
?? ?? ??
?? ?? ??
?? ?? ??
?? ?? ??

DLL]
?? ??
?? ??
?? ??
?? ??
?? ??
?? ??
?? ??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
83
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
8D

??
??
??
??
??
??

??
??
??
??
??
??

00
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

[Microsoft Visual C++ v5:0/v6:0 (MFC)]

signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50
ep_only = true
[Microsoft Visual C++ v5:0]
signature = 55 8B EC 6A FF 68 68 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 53 56 57
-113-

??
??
??
??
??
??

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[Microsoft Visual
signature = 55 8B
?? ?? ?? 00 ?? ??
?? ?? ?? ?? ?? ??
ep_only = true

C++ v6:0
EC 51 ??
?? ?? ??
?? ?? ??

(Debug Version)]
?? ?? 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00

[Microsoft Visual
signature = 55 8B
?? ?? ?? 00 ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? E8 ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
ep_only = true

C++ v6:0
EC 51 ??
?? ?? ??
?? ?? ??
?? ?? ??
?? ?? ??
?? ?? ??
?? ?? ??

(Debug Version)]
?? ?? 01 ?? ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? 00

??
??
??
??
??
??
00

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
00
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
10
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
00
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
00
??
??
??
8B
??

[Microsoft Visual C++ v6:0 DLL]

signature = 83 7C 24 08 01 75 09 8B 44 24 04 A3 ?? ?? 00 10 E8 8B FF FF FF
ep_only = true
[Microsoft Visual
signature = ?? ??
?? ?? ?? ?? ?? ??
00 ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? 00
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
ep_only = true

C++ v6:0
?? ?? ??
?? ?? ??
?? ?? ??
?? ?? ??
?? ?? 8B
?? ?? ??
?? ?? ??
?? ?? ??

DLL]
?? ??
?? ??
?? 8B
?? ??
?? ??
?? ??
?? ??
?? ??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
4D

??
??
??
??
??
??
??
??

??
??
??
00
??
??
??
??

??
??
??
??
??
??
??
??

00
??
??
??
??
??
??
??

??
51
??
??
??
??
??
02

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

[Microsoft Visual C++ v6:0 DLL]

signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C
ep_only = true
[Microsoft Visual C++ v6:0 DLL]
signature = 55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? 00
ep_only = false
[Microsoft Visual C++ v6:0 DLL]
signature = 8B 44 ?? 08
ep_only = false
[Microsoft Visual C++ v6:0 DLL]
signature = 55 8D 6C ?? ?? 81 EC ?? ?? ?? ?? 8B 45 ?? 83 F8 01 56 0F 84 ?? ?? ?? ?? 85 C0 0F
84
ep_only = true
[Microsoft Visual C++ v6:0 SPx]
signature = 55 8B EC 83 EC 44 56 FF 15 ?? ?? ?? ?? 8B F0 8A ?? 3C 22
ep_only = true
[Microsoft Visual C++ v6:0 SPx]
signature = 55 8B EC 83 EC 44 56 FF 15 ?? ?? ?? ?? 6A 01 8B F0 FF 15
ep_only = true
[Microsoft Visual C++ v6:0]
signature = 55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00
-114-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

00 00 83 EC ?? 53 56 57 89 65 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
FF
ep_only = false
[Microsoft Visual
signature = ?? ??
?? ?? ?? ?? ?? ??
?? 00 ?? ?? ?? 0D
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
ep_only = true

C++ v6:0]
?? ?? ?? ??
?? ?? ?? ??
?? ?? ?? 00
?? ?? ?? ??
?? ?? ?? ??

??
??
??
??
??

??
??
??
??
??

??
??
??
1C
??

00
??
??
??
??

??
??
??
??
??

??
??
??
00
??

??
??
??
??
??

??
??
??
??
??

??
??
??
??
??

??
??
??
??
??

??
??
00
??
??

??
??
??
??
??

??
??
??
??
??

??
??
??
??
??

??
??
??
??
??

??
??
??
??
00

??
??
??
00
??

??
??
??
FF
??

??
??
00
??
??

??
??
??
??
??

??
??
??
??
00

[Microsoft Visual C++ v6:0]

signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ??
?? ?? 83 EC ?? 53 56 57
ep_only = false
[Microsoft Visual C++ v6:0]
signature = 55 8B EC 83 EC 50 53 56 57 BE ?? ?? ?? ?? 8D 7D F4 A5 A5 66 A5 8B
ep_only = true
[Microsoft Visual
signature = ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? 00
?? ?? 00 ?? 00 ??
?? 00 ?? 00 ?? 00
00 ?? 00 ?? 00 ??
?? 00 ?? 00 ?? 00
?? ?? ?? ?? ?? ??
?? 00 ?? 00 ?? 00
ep_only = true

C++ v7:0
41 00 00
?? ?? ??
?? ?? 20
?? ?? 00
?? 00 ??
00 ?? 00
?? 00 ??
?? ?? ??
?? 00 ??

(64 Bit)]
00 00 00 00
?? ?? ?? ??
?? ?? 00 ??
?? ?? ?? ??
?? ?? 00 ??
?? ?? ?? 00
00 ?? ?? ??
?? 00 ?? ??
00

[Microsoft Visual
signature = ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? 00
ep_only = false

C++ v7:0
41 00 00
?? ?? ??
?? ?? 20

(64 Bit)]
00 00 00 00 00 63 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ??
?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? 00

00
??
00
??
00
??
00
??

63
??
??
??
??
00
??
??

00
??
??
??
00
??
00
??

00
00
??
00
??
00
??
??

00
??
??
??
00
??
00
??

00
00
??
00
??
00
??
??

00
??
??
??
00
??
00
??

??
00
??
00
??
00
??
??

00
??
00
??
00
??
00
??

??
??
??
00
??
00
??
00

??
??
??
??
00
??
00
??

??
??
??
00
??
00
??
00

??
??
??
??
??
??
00
??

??
??
??
00
??
??
??
00

00
??
??
??
00
??
??
??

??
??
??
00
??
00
??
??

00
??
??
??
00
??
??
??

??
??
??
00
??
00
??
00

[Microsoft Visual C++ v7:0 DLL]

signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 ?? ?? 83
ep_only = false
[Microsoft Visual C++ v7:0 DLL]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10
ep_only = true
[Microsoft Visual C++ v7:0]
signature = 6A 0C 68 88 BF 01 10 E8 B8 1C 00 00 33 C0 40 89 45 E4 8B 75 0C 33 FF 3B F7 75 0C
39 3D 6C 1E 12 10 0F 84 B3 00 00 00 89 7D FC 3B F0 74 05 83 FE 02 75 31 A1 98 36 12 10 3B C7
74 0C FF 75 10 56
ep_only = true
[Microsoft Visual C++ v7:0]
signature = 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 89 65 ??
8B F4 89 3E 56 FF 15 ?? ?? ?? ?? 8B 4E ?? 89 0D ?? ?? ?? ?? 8B 46 ?? A3
ep_only = true
[Microsoft Visual C++ v7:1 DLL (Debug)]
signature = 55 8B EC ?? ?? 0C 83 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 8B
ep_only = true
-115-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Microsoft Visual C++ v7:1 DLL]

signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 C4 E4 53 56 57 89 65 E8 C7 45 E4 01 00 00 00 C7 45 FC
ep_only = true
[Microsoft Visual C++ v7:1 DLL]
signature = 6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 40 89 45 E4
ep_only = true
[Microsoft Visual C++ v7:1 DLL]
signature = 83 7C 24 08 01 75 ?? ?? ?? 24 04 50 A3 ?? ?? ?? 50 FF 15 00 10 ?? 50 33 C0 40 C2
0C 00
ep_only = true
[Microsoft Visual C++ v7:1 DLL]
signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 75 09 83 3D ?? ?? 40 00 00 EB
26 83 FE 01 74 05 83 FE 02 75 22 A1
ep_only = true
[Microsoft Visual C++ v7:1 EXE]
signature = 6A ?? 68 ?? ?? ?? 01 E8 ?? ?? 00 00 66 81 3D 00 00 00 01 4D 5A 75 ?? A1 3C 00 00
01 ?? ?? 00 00 00 01
ep_only = true
[Microsoft Visual C++ v7:1 EXE]
signature = 6A ?? 68 ?? ?? ?? ?? E8
ep_only = true
[Microsoft Visual
signature = E9 ??
?? ?? ?? E9 ?? ??
?? ?? E9 ?? ?? ??
?? E9 ?? ?? ?? ??
ep_only = true

C++ V8:0
?? ?? ??
?? ?? E9
?? E9 ??
E9 ?? ??

[Debug]]
E9 ?? ??
?? ?? ??
?? ?? ??
?? ?? E9

[Microsoft Visual
signature = ?? ??
?? 00 00 00 ?? ??
?? ?? ?? 00 00 ??
?? ?? ?? ?? ?? ??
?? 00 00 ?? ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
00 ?? ?? ?? ?? ??
ep_only = true

C++ vx:x
?? ?? ??
?? ?? ??
?? ?? ??
?? ?? ??
?? ?? ??
?? ?? ??
?? ?? ??
?? ?? ??
?? 00 ??

DLL]
?? ??
?? ??
?? ??
?? ??
?? ??
?? ??
?? ??
?? ??
00

[Microsoft Visual
signature = ?? ??
?? 00 00 00 ?? ??
?? ?? ?? 00 00 ??
ep_only = true

C++ vx:x
?? ?? ??
?? ?? ??
?? ?? ??

DLL]
?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68

[Microsoft Visual
signature = 55 8B
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
ep_only = true

C++ vx:x]
EC ?? ?? ??
?? ?? ?? ??
?? ?? ?? ??
?? ?? ?? ??
?? ?? ?? ??
?? ?? ?? ??

??
??
??
??
??
??

00
??
??
??
??
??
??
??

??
??
??
??
??
??

??
??
E9
??

??
E9
??
??

E9
??
??
??

?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ??
?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ??
?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
00

??
??
??
??
??
00

??
??
??
??
??

??
00
??
??
??

??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??

-116-

??
??
??
??
??
??
??
??

??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??

??
00
??
??
??
??
??
00

??
??
??
??
??

??
00
??
??
??
??
??
??

??
??
??
??
00

??
??
68
??
??
??
??
00

??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
83

??
??
??
??
??
??
??
??

??
??
??
??
??

??
00
??
??
??
??
??
??

??
??
??
??
??

00
00
??
??
??
??
??
00

??
??
??
??
??

00
??
??
??
??
??
??
00

??
??
??
??
??

00
??
??
??
??
??
??
??

??
??
??
??
??

??
??
??
??
??
??
??
??

??
04
??
??
00

??
00
??
??
??
??
??
??

??
??
??
??
??

??
00
??
??
??
??
??
00

??
??
??
??
??

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Microsoft Visual C++ vx:x]

signature = 55 8B EC 56 57 BF ?? ?? ?? ?? 8B ?? ?? 3B F7 0F
ep_only = true
[Microsoft Visual C++ vx:x]
signature = 53 55 56 8B ?? ?? ?? 85 F6 57 B8 ?? ?? ?? ?? 75 ?? 8B ?? ?? ?? ?? ?? 85 C9 75 ??
33 C0 5F 5E 5D 5B C2
ep_only = true
[Microsoft Visual C++ vx:x]
signature = 55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 04
ep_only = true
[Microsoft Visual C++]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00
00 00
ep_only = false
[Microsoft Visual C++]
signature = 8B 44 24 08 83 ?? ?? 74
ep_only = true
[Microsoft Visual C++]
signature = 8B 44 24 08 56 83 E8 ?? 74 ?? 48 75
ep_only = true
[Microsoft Visual Studio :NET]
signature = FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true
[Microsoft WAV Audio file]
signature = 52 49 46 46 ?? ?? ?? ?? 57 41 56 45 66 6D 74
ep_only = false
[Microsoft Windows Shortcut file]
signature = 4C 00 00 00 01 14 02 00 00 00
ep_only = false
[Microsoft Windows Update CAB
signature = E9 C5 FA FF FF 55
6A 05 FF 75 28 E8 2E 11 00 00
89 50 04 8B 55 10 89 50 0C 8B
ep_only = false

SFX module]
8B EC 56 8B 75 08 68 04 08 00 00 FF D6 59 33 C9 3B C1 75 0F 51
33 C0 EB 69 8B 55 0C 83 88 88 00 00 00 FF 83 88 84 00 00 00 FF
55 14 89 50 10 8B 55 18 89 50 14 8B 55 1C 89 50 18

[Microsoft Windows Update CAB

signature = E9 C5 FA FF FF 55
6A 05 FF 75 28 E8 2E 11 00 00
89 50 04 8B 55 10 89 50 0C 8B
50 1C 8B 55 24 89 50 20 8B 55
C7 80 B2 00 00 00 0F 00 89 88
ep_only = false

SFX module]
8B EC 56 8B
33 C0 EB 69
55 14 89 50
28 89 48 48
A0 00 00 00

75
8B
10
89
89

08
55
8B
48
88

68
0C
55
44
A8

04
83
18
89
00

08
88
89
48
00

00
88
50
4C
00

00
00
14
B9
89

FF
00
8B
FF
88

D6
00
55
FF
A4

59
FF
1C
00
00

33
83
89
00
00

C9
88
50
89

3B
84
18
70

C1
00
8B
08

75
00
55
89

0F
00
20
10

51
FF
89
66

[MIDI Music file]

signature = 4D 54 68 64 00 00 00 06 ?? ?? ?? ?? ?? ?? 4D 54
ep_only = false
[MinGW 3:2:x (Dll_main)]
signature = 55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10
89 54 24 08 8B 55 08 89 14 24 E8 96 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D
-117-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00
ep_only = false
[MinGW 3:2:x (Dll_WinMain)]
signature = 55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10
89 54 24 08 8B 55 08 89 14 24 E8 76 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D
00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00
ep_only = false
[MinGW 3:2:x (main)]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31
C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC
31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D
ep_only = false
[MinGW 3:2:x (WinMain)]
signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31
C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC
31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D
ep_only = false
[MinGW GCC 2:x]
signature = 55 89 E5 ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 00
ep_only = true
[MinGW GCC DLL v2xx]
signature = 55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
00
ep_only = true
[MinGW GCC DLL
signature = 55
00 ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
ep_only = true

v2xx]
89 E5
?? ??
?? ??
?? ??
?? ??
?? ??
?? ??
?? ??

[MinGW GCC v2:x]

signature = 55 89
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
ep_only = true

E5
??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

00
??
??
??
??
??
??
??

00
??
??
??
??
??
??
??

00
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
00

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
68

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??
??
??

??
??
??
00
??
??
??
??
??

??
??
??
??
??
??
00
??
00

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

FF
??
??
??
??
??
??
??

FF
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
00
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

00
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

00
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

??
??
??
??
??
??
??
??

00
??
??
??
??
??
??
??

00
??
??
??
??
??
00
??

00
??
??
??
??
??
??
??

00
??
??
??
??
??
??
??

[MinGW GCC v2:x]

signature = 55 89 E5 E8 ?? ?? ?? ?? C9 C3 ?? ?? 45 58 45
ep_only = true
[MinGW v3:2:x (_mainCRTStartup)]
signature = 55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90
90 90 90 90 90 FF 25 38 20 40 00 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF
FF FF 00 00 00 00 00
ep_only = true
-118-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

[MinGW v3:2:x (Dll_main)]

signature = 55 89 E5 83 EC
89 54 24 08 8B 55 08 89 14
00 30 00 10 85 C9 75 10 31
8D B4 26 00 00 00 00 85 C0
F4 05 00 00 A3 00 30 00 10
01 00 00 E9 75 FF FF FF E8
89 5D FC 8B 15 00 30 00 10
2A 83 EB 04 39 D3 73 F3 89
48 05 00 00 8B 5D FC 89 EC
ep_only = true

04 August 2015 15:14

18
24
DB
75
85
BC
85
14
5D

89
E8
89
D0
C0
05
D2
24
C3

75
96
D8
E8
74
00
74
E8

FC
01
8B
47
1A
00
29
6B

8B
00
5D
00
C7
C7
8B
05

75
00
F8
00
00
00
1D
00

0C
83
8B
00
00
0C
10
00

89
EC
75
EB
00
00
30
31

5D
0C
FC
C9
00
00
00
C0

F8
83
89
90
00
00
10
A3

83
FE
EC
8D
A3
31
83
00

FE
01
5D
74
10
C0
EB
30

01
89
C2
26
30
EB
04
00

74
C3
0C
00
00
98
39
10

5C
74
00
C7
10
89
D3
C7

89
2C
E8
04
E8
F6
72
04

74
85
59
24
3B
55
0D
24

24
F6
00
80
02
89
8B
00

04
75
00
00
00
E5
03
00

8B
0C
00
00
00
83
85
00

55
8B
EB
00
E8
EC
C0
00

10
0D
EB
E8
C6
08
75
E8

[MinGW v3:2:x (Dll_mainCRTStartup)]

signature = 55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90
90 90 90 90 90 FF 25 38 20 00 10 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF
FF FF 00 00 00 00 00
ep_only = true
[MinGW v3:2:x (Dll_WinMain)]
signature = 55 89 E5 83 EC 18
89 54 24 08 8B 55 08 89 14 24
00 30 00 10 85 C9 75 10 31 DB
8D B4 26 00 00 00 00 85 C0 75
A4 05 00 00 A3 00 30 00 10 85
01 00 00 E9 75 FF FF FF E8 6C
89 5D FC 8B 15 00 30 00 10 85
2A 83 EB 04 39 D3 73 F3 89 14
F8 04 00 00 8B 5D FC 89 EC 5D
ep_only = true

89
E8
89
D0
C0
05
D2
24
C3

75
76
D8
E8
74
00
74
E8

FC
01
8B
47
1A
00
29
1B

8B
00
5D
00
C7
C7
8B
05

75
00
F8
00
00
00
1D
00

0C
83
8B
00
00
0C
10
00

89
EC
75
EB
00
00
30
31

5D
0C
FC
C9
00
00
00
C0

F8
83
89
90
00
00
10
A3

83
FE
EC
8D
A3
31
83
00

FE
01
5D
74
10
C0
EB
30

01
89
C2
26
30
EB
04
00

74
C3
0C
00
00
98
39
10

5C
74
00
C7
10
89
D3
C7

89
2C
E8
04
E8
F6
72
04

74
85
59
24
1B
55
0D
24

24
F6
00
80
02
89
8B
00

04
75
00
00
00
E5
03
00

8B
0C
00
00
00
83
85
00

55
8B
EB
00
E8
EC
C0
00

10
0D
EB
E8
A6
08
75
E8

[MinGW v3:2:x (main)]

signature = 55 89 E5 83
C0 5D C3 89 F6 55 89 E5
31 C0 5D C3 89 F6 55 89
8D BC 27 00 00 00 00 55
00 8D BC 27 00 00 00 00
85 02 00 00 C7 04 24 00
89 54 24 0C 8D 55 F4 89
74 76 A3 30 20 40 00 A1
04 24 89 5C 24 04 E8 C1
ep_only = true

EC
83
E5
89
55
20
54
F0
06

08
EC
83
E5
89
40
24
40
00

C7
08
EC
83
E5
00
08
40
00

04
C7
08
EC
53
8B
C7
00

24
04
8B
08
83
15
44
85

01
24
55
8B
EC
10
24
C0

00
02
08
55
24
20
04
74

00
00
89
08
C7
40
04
1F

00
00
14
89
04
00
20
89

FF
00
24
14
24
8D
40
04

15
FF
FF
24
A0
4D
00
24

E4
15
15
FF
11
F8
E8
E8

40
E4
00
15
40
C7
02
C3

40
40
41
F4
00
45
07
06

00
40
40
40
E8
F8
00
00

E8
00
00
40
8D
00
00
00

68
E8
89
00
07
00
A1
8B

00
48
EC
89
00
00
20
1D

00
00
5D
EC
00
00
20
20

00
00
C3
5D
83
89
40
20

89
00
8D
C3
EC
4C
00
40

EC
89
76
8D
04
24
85
00

31
EC
00
76
E8
10
C0
89

[MinGW v3:2:x (WinMain)]

signature = 55 89 E5 83 EC
C0 5D C3 89 F6 55 89 E5 83
31 C0 5D C3 89 F6 55 89 E5
8D BC 27 00 00 00 00 55 89
00 8D BC 27 00 00 00 00 55
55 03 00 00 C7 04 24 00 20
89 54 24 0C 8D 55 F4 89 54
74 76 A3 30 20 40 00 A1 08
04 24 89 5C 24 04 E8 91 07
ep_only = true

08
EC
83
E5
89
40
24
41
00

C7
08
EC
83
E5
00
08
40
00

04
C7
08
EC
53
8B
C7
00

24
04
8B
08
83
15
44
85

01
24
55
8B
EC
10
24
C0

00
02
08
55
24
20
04
74

00
00
89
08
C7
40
04
1F

00
00
14
89
04
00
20
89

FF
00
24
14
24
8D
40
04

15
FF
FF
24
A0
4D
00
24

FC
15
15
FF
11
F8
E8
E8

40
FC
18
15
40
C7
D2
93

40
40
41
0C
00
45
07
07

00
40
40
41
E8
F8
00
00

E8
00
00
40
5D
00
00
00

68
E8
89
00
08
00
A1
8B

00
48
EC
89
00
00
20
1D

00
00
5D
EC
00
00
20
20

00
00
C3
5D
83
89
40
20

89
00
8D
C3
EC
4C
00
40

EC
89
76
8D
04
24
85
00

31
EC
00
76
E8
10
C0
89

(h)]
C7 04
08 C7
?? ??
5D E9

24
04
00
??

01
24
89
??

00
02
E5
00

00
00
5D
00

00
00
FF
90

FF
00
E1
90

15
FF
8D
90

??
15
74
90

??
??
26
90

??
??
00
90

00 E8 C8 FE FF FF 90 8D B4
?? 00 E8 A8 FE FF FF 90 8D
55 8B 0D ?? ?? ?? 00 89 E5
90

[MingWin32 - Dev C++

signature = 55 89 E5
26 00 00 00 00 55 89
B4 26 00 00 00 00 55
5D FF E1 90 90 90 90
ep_only = true

v4:9:9:1
83 EC 08
E5 83 EC
8B 0D ??
55 89 E5

-119-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

[MingWin32 - Dev C++

signature = 55 89 E5
?? ?? ?? ?? 00 55 89
?? ?? ?? ?? ?? 00 55
ep_only = true

04 August 2015 15:14

v4:x (h)]
83 EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
E5 83 EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? 00

[MingWin32 GCC 3:x]

signature = 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? 40 00 E8 ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? 55 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true
[MingWin32 v?:? (h)]
signature = 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FE FF FF 90 8D B4
26 00 00 00 00 55
ep_only = true
[Minke 1:0:1 signature = 55
DB 40 00 10 64
66 00 10 8B 16
ep_only = true

by
8B
FF
E8

Codius]
EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68
30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C
88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8

[Minke V1:0:1 -> Codius

signature = 26 3D 4F 38
00 01 64 53 74 75 62 00
6E 69 74 00 0C 4B 57 69
ep_only = false

> Sign by fly]

C2 82 37 B8 F3 24 42 03 17 9B 3A 83 01 00 00 CC 00 00 00 00 06 00 00
10 55 54 79 70 65 73 00 00 C7 53 79 73 74 65 6D 00 00 81 53 79 73 49
6E 64 6F 77 73 00 00 8A 75 46 75 6E 63 74 69 6F 6E 73

[modified HACKSTOP v1:11f]

signature = 52 B4 30 CD 21 52 FA ?? FB 3D ?? ?? EB ?? CD 20 0E 1F B4 09 E8
ep_only = true
[MoleBox v2:0]
signature = E8 ?? ?? ?? ?? 60 E8 4F
ep_only = false
[MoleBox V2:X -> MoleStudio:com]
signature = E8 00 00 00 00 60 E8 4F 00 00 00
ep_only = true
[Morphine 2:7 -> Holy_Father & Ratter/29A
signature = ?? ?? ?? ?? 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 ??
?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32
ep_only = false

(h)]
00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00
?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ??
2E 64 6C 6C 00 00 47 65 74 50 72 6F 63

[Morphine 2:7 -> Holy_Father & Ratter/29A]

signature = 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64
64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false
[Morphine 3:3 -> Holy_Father & Ratter/29A]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00
00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72
ep_only = false
[Morphine 3:3 -> Silent
signature = 28 ?? ?? ??
00 00 00 00 00 00 00 00
?? ?? 00 00 00 00 4B 65

Software
00 00 00
00 00 00
52 6E 45

& Silent
00 00 00
00 00 4C
6C 33 32

Shield (c)2005
00 00 40 ?? ??
?? ?? ?? 5C ??
2E 64 4C 6C 00
-120-

(h)]
?? 34 ?? ?? ?? 00 00 00 00 00 00 00
?? ?? 00 00 00 00 4C ?? ?? ?? 5C ??
00 47 65 74 50 72 6F 63

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = false
[Morphine v1:2
signature = ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
ep_only = true

(DLL)]
?? ?? ??
?? 00 ??
?? ?? ??
?? ?? ??
?? ?? ??
?? ?? ??
?? ?? ??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
00

??
??
??
??
??
??
00

??
??
??
??
??
??
00

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
00
??
??

??
??
??
5B
??
??

??
??
??
??
??
??

??
??
??
??
66
??

??
??
??
??
??
??

00
??
??
??
??
??

00
??
??
00
??
??

00
??
??
??
??
??

[Morphine v1:2 - v1:3]

signature = FF 25 34 ?? 5A 00 8B C0 FF 25 38 ?? 5A 00 8B C0
ep_only = false
[Morphine v1:2]
signature = ?? ??
?? ?? E8 ?? 00 00
?? ?? ?? ?? ?? ??
?? ?? ?? 00 00 ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
E2 ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
ep_only = true

??
00
51
??
??
??
82
00

??
66
66
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
59
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

00
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
??
??
??
??
??

??
??
6C
41
00

??
??
6C
00
00

??
??
00
00
00

??
??
00
00
00

??
??
47
00
00

??
00
65
00
00

??
00
74
00
00

??
00
50
00
00

00
00
72
00
00

00
??
6F
00
00

00
??
63
00
00

00
??
41
00
00

00
??
64
00
00

00
??
64
00
00

00
??
72
00
00

[Morphine v2:7 ->

signature = ?? ??
00 00 00 00 00 00
?? ?? 00 00 00 00
65 73 73 00 00 4C
00 00 00 00 00 00
00 00 00 00 00 00
ep_only = false

Holy_Father
?? ?? 00 00
00 00 00 00
6B 65 72 6E
6F 61 64 4C
00 00 00 00
00 00 00

& Ratter/29A (h)]

00 00 00 00 00 00
00 00 00 ?? ?? ??
65 6C 33 32 2E 64
69 62 72 61 72 79
00 00 00 00 00 00

[Morphine v2:7 ->

signature = 00 00
64 72 65 73 73 00
00 00 00 00 00 00
00 00 00 00 00 00
ep_only = false

Holy_Father
00 00 6B 65
00 4C 6F 61
00 00 00 00
00 00 00 00

& Ratter/29A]
72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64
64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00

[Morphine V3:3 ->

signature = 00 00
00 00 00 00 00 00
00 00 4B 65 52 6E
00 4C 6F 61 64 4C
ep_only = false

Holy_Father
00 00 00 00
00 00 00 ??
45 6C 33 32
69 62 72 61

& Ratter/29A]
00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00
?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00
2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00
72 79 41

[Morphine v3:3 ->

signature = 28 ??
00 00 00 00 00 00
?? ?? 00 00 00 00
65 73 73 00 00 4C
ep_only = false

Silent Software &

?? ?? 00 00 00 00
00 00 00 00 00 00
4B 65 52 6E 45 6C
6F 61 64 4C 69 62

Silent Shield (c)2005 (h)]

00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00
00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ??
33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72
72 61 72 79 41

[Morphnah Beta -> Kas]

signature = 2E 6E 61 68 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00
00 00 00 00 00 00 00 00 00 A0 00 00 E0
ep_only = true

-121-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[mPack 0:0:3 -> DeltaAziz]

signature = 55 8B EC 83 C4 F0 33 C0 89 45 F0 B8 A8 76 00 10 E8 67 C4 FF FF 33 C0 55 68 C2 78
00 10 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 08 A5 00 10
33 C0 55 68 A5 78 00 10 64 FF 30 64 89 20 A1 08 A5 00 10 E8 FA C9 FF FF 83 F8 FF
ep_only = true
[mPACK v0:0:2 -> DeltaAziz
signature = E9 00 00 00 00
00 00 00 E8 58 61 E8 AA 00
00 00 00 00 00 00 00 00 00
?? 00 00 00 00 4B 45 52 4E
72 65 73 73 00 00 00 47 65
69 62 72 61 72 79 41 00 ??
00 00 00 ?? ?? ?? 0C ?? ??
07 53 E8 5D 00 00 00 EB FF
5E 83 C6 4C 75 F4 59 8D 71
24 00 00 81 36 50 56 8B 36
EC FC E9 E7 00 00 00 5B EB
ep_only = true

(h)]
60 E8
00 00
00 00
45 4C
74 4D
?? 00
?? CC
71 E8
E8 75
EB FF
FF F3

14
4E
00
33
6F
00
E4
C2
09
77
EB

00
??
00
32
64
??
??
50
81
C4
FF

00
??
00
2E
75
??
??
00
F6
36
C3

00
00
00
64
6C
00
??
EB
EB
81
83

5D
00
00
6C
65
00
??
D6
FF
F6
EB

81
00
00
6C
48
56
??
5E
51
EB
FD

ED
00
00
00
61
69
??
F3
B9
87

00
00
00
00
6E
72
00
68
01
34

00
00
00
00
64
74
00
89
00
24

00
00
??
00
6C
75
00
74
83
8B

00
00
??
47
65
61
00
24
EE
8B

6A
00
??
65
41
6C
00
48
FC
1C

45
5E
??
74
00
41
00
74
49
24

E8
??
??
50
00
6C
00
24
FF
83

A3
??
??
72
00
6C
00
58
71
EC

00
00
??
6F
4C
6F
5D
FF
C7
FC

00
4E
??
63
6F
63
68
8D
75
EB

00
??
??
41
61
00
00
74
19
01

68
??
??
64
64
00
FE
24
8B
E8

00
00
??
64
4C
00
9F
58
74
83

[mPack V0:03 -> DeltaAziz * Sign:By:fly]

signature = 55 8B EC 83 ?? ?? 33 C0 89 45
?? ?? 64 FF 30 64 89 20 8D 55 F0 33 C0 E8
33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20
B2 FF FF E9 1B 01 00 00 C7 05 ?? ?? ?? ??
C9 FF FF BA ?? ?? ?? ?? A1 ?? ?? ?? ?? B9
0A E8 47 B2 FF FF E9 DA 00 00 00 A1 ?? ??
10 A1 ?? ?? ?? ?? B9 04 00 00 00 E8 8E C9
E8 0A CB FF FF A3 ?? ?? ?? ?? A1 ?? ?? ??
84 00 00 00 6A 00 6A 00 B8 ?? ?? ?? ?? 8B
FF FF EB 65 8B 0D ?? ?? ?? ?? 8B 15 ?? ??
?? 75 0D A1 ?? ?? ?? ?? 8B 40 3C E8 6E FB
FF FF 33 C0 5A 59 59 64 89 10 68 ?? ?? ??
A0 C6 FF FF C3 E9 AE B0 FF FF EB E4 33 C0
FF FF C3 E9 91 B0 FF FF EB F0 E8 62 B4 FF
ep_only = true

F0
93
A1
32
04
??
FF
??
15
??
FF
??
5A
FF

B8
C8
??
00
00
??
FF
E8
??
??
FF
A1
59

??
FF
??
00
00
8B
83
63
??
A1
6A
??
59

??
FF
??
00
00
15
F8
C9
??
??
03
??
64

??
8B
??
A1
E8
??
04
FF
??
??
E8
??
89

??
45
E8
??
C5
??
74
FF
E8
??
07
??
10

E8
F0
FA
??
C9
??
0A
83
D4
??
C4
E8
68

67
E8
C9
??
FF
??
E8
F8
CD
E8
FF
AA
??

C4
87
FF
??
FF
E8
14
FF
FF
0F
FF
C6
??

FF
CB
FF
8B
83
92
B2
75
FF
FA
A1
FF
??

FF
FF
83
15
3D
C9
FF
0A
84
FF
??
FF
??

33
FF
F8
??
??
FF
FF
E8
C0
FF
??
A1
8D

C0
A3
FF
??
??
FF
E9
F1
75
3B
??
??
45

55
??
75
??
??
BA
A7
B1
07
05
??
??
F0

68
??
0A
??
??
18
00
FF
E8
??
E8
??
E8

??
??
E8
E8
32
A5
00
FF
CF
??
C1
??
A7

??
??
88
C9
77
00
00
E9
B1
??
C6
E8
B5

[mPack V0:03 -> DeltaAziz]

signature = 55 8B EC 83 ?? ?? 33 C0 89 45 F0 B8 ?? ?? ?? ?? E8 67 C4 FF FF 33 C0 55 68 ?? ??
?? ?? 64 FF 30 64 89 20 8D 55 F0 33 C0 E8 93 C8 FF FF 8B 45 F0 E8 87 CB FF FF A3 ?? ?? ?? ??
33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? E8 FA C9 FF FF 83 F8 FF
ep_only = true
[MPEG movie file]
signature = 00 00 01 BA 2F FF FD E6 C1 80 18 61 00 00 01 BB
ep_only = false
[Mr:HDKiller ProtectioN v1:2]
signature = E9 J1 J1 48 51 44 2E ?? ?? ?? 2D ?? ?? 8B D8 05 ?? ?? 8B F0 BF ?? ?? B9 ?? ?? ??
F3 A4 8B CB D1 E9
ep_only = true
[MS FORTRAN Library 19??]
signature = FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC B8 ?? ?? 8E C0 26 C7 ?? ??
?? ?? ?? 26
ep_only = true
[MS FORTRAN Library 19??]
signature = FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? 9A ??
?? ?? ?? 9B DB E3 9B D9 2E ?? ?? 33 C9
ep_only = true

-122-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[MS Run-Time Library (OS/2) & FORTRAN Compiler 1989]

signature = B4 30 CD 21 86 E0 2E A3 ?? ?? 3D ?? ?? 73
ep_only = true
[MS Run-Time Library 1987]
signature = B4 30 CD 21 3C 02 73 ?? 9A ?? ?? ?? ?? B8 ?? ?? 50 9A ?? ?? ?? ?? 92
ep_only = true
[MS Run-Time Library 1988 (04)]
signature = 1E B8 ?? ?? 8E D8 B4 30 CD 21 3C 02 73 ?? BA ?? ?? E8 ?? ?? 06 33 C0 50 CB
ep_only = true
[MS Run-Time Library 1990 (06)]
signature = EB J3 B4 30 CD 21 86 E0 2E A3 ?? ?? 3D ?? ?? 73
ep_only = true
[MS Run-Time Library 1990 (07)]
signature = 2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F 8B 1E ?? ?? 0B DB 74 ?? 8C D1 8B D4
FA 8E D3 BC ?? ?? FB
ep_only = true
[MS Run-Time Library 1990 (10)]
signature = E8 ?? ?? 2E FF 2E ?? ?? BB ?? ?? E8 ?? ?? CB
ep_only = true
[MS Run-Time Library 1990; 1992 (09)]
signature = B4 30 CD 21 3C 02 73 ?? C3 8C DF 8B 36 ?? ?? 2E
ep_only = true
[MS Run-Time Library 1992 (11)]
signature = B4 51 CD 21 8E DB B8 ?? ?? 83 E8 ?? 8E C0 33 F6 33 FF B9 ?? ?? FC F3 A5
ep_only = true
[MS Run-Time Library 1992 (13)]
signature = BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB 33 DB B8 ?? ?? CD 21
ep_only = true
[MS Run-Time Library 1992 (14)]
signature = 1E 06 8C C8 8E D8 8C C0 A3 ?? ?? 83 C0 ?? A3 ?? ?? B4 30
ep_only = true
[MS Visual C++
signature = E8
C0 EB 51 A1 3C
00 00 74 1B 81
83 B8 74 00 00
?? 00 00 50 FF
01 8B 0D ?? ??
?? ?? ?? 01 E8
?? ?? 00 00 33
ep_only = true

v:8 (h-good
?? ?? ?? ??
00 00 01 81
F9 0B 02 00
01 0E 76 B8
?? ?? ?? 00
?? 01 89 08
?? ?? 00 00
C0 C3 CC CC

sig; but
E9 8D FE
B8 00 00
00 75 D4
33 C9 39
01 83 0D
FF 15 ??
83 3D ??
CC CC CC

is
FF
00
83
88
??
??
??

it
FF
01
B8
E8
??
00
??

MSVC?)]
CC CC CC
50 45 00
84 00 00
00 00 01
?? 01 FF
01 8B 0D
01 00 75

[MS Visual C++ v:8 (h-good

signature = E8 ?? ?? ?? ??
C0 EB 51 A1 3C 00 00 01 81
00 00 74 1B 81 F9 0B 02 00
ep_only = false

sig; but
E9 8D FE
B8 00 00
00 75 D4

is
FF
00
83

it
FF
01
B8

MSVC?)]
CC CC CC CC CC 66 81 3D 00 00 00 01 4D 5A 74 04 33
50 45 00 00 75 EB 0F B7 88 18 00 00 01 81 F9 0B 01
84 00 00 01 0E 76 CB 33 C9 39 88 F8 00

CC
00
01
0F
83
??
0C

CC
75
0E
95
0D
??
68

66
EB
76
C1
??
??
??

81
0F
CB
8B
??
01
??

3D
B7
33
C1
??
89
??

00
88
C9
6A
01
08
01

00
18
39
01
FF
A1
FF

00
00
88
A3
59
??
15

01
00
F8
??
59
??
??

4D
01
00
??
FF
00
??

5A
81
00
??
15
01
00

74
F9
01
01
??
8B
01

04
0B
EB
E8
??
00
59

33
01
11
??
00
A3
E8

[MS Visual C++ v:8 DLL (h-small sig1)]

signature = 8B FF 55 8B EC 83 7D 0C 01 75 05 E8 ?? ?? ?? FF 5D E9 D6 FE FF FF CC CC CC CC CC
ep_only = true

-123-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[MS Visual C++ v:8 DLL (h-small sig2)]

signature = 8B FF 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 0F 84 ?? ?? 00 00 83 FE
01
ep_only = true
[MSCC v1:0cs]
signature = E9 J1 J1 0E 07 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 B9 ?? ?? BE ?? ?? AC CC 98
ep_only = true
[MSLRH 0:32a (fake :BJFNT 1:3) -> emadicius]
signature = EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD
20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8
EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50
ep_only = false
[MSLRH 0:32a (fake ASPack 2:11d)
signature = 60 E8 02 00 00 00 EB
E8 0A 00 00 00 E8 EB 0C 00 00 E8
81 50 E8 02 00 00 00 29 5A 58 6B
ep_only = false

->
09
F6
C0

emadicius]
5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA
FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01
03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75

[MSLRH 0:32a (fake ASPack 2:12) -> emadicius]

signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD
81 EB 00 73 00 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF
E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B
ep_only = true
[MSLRH 0:32a (fake ASPack 2:12) -> emadicius]
signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD
81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2
FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03
ep_only = false
[MSLRH 0:32a (fake EXE32Pack 1:3x) -> emadicius]
signature = 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57
E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00
00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00
ep_only = false
[MSLRH 0:32a (fake Microsoft Visual
signature = 55 8B EC 6A FF 68 CA 37
00 00 64 8F 05 00 00 00 00 83 C4 0C
00 E8 F6 FF FF FF E8 F2 FF FF FF 83
ep_only = false

C++) -> emadicius]

41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00
5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00
C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00

[MSLRH 0:32a (fake MSVC++ 6:0

signature = 55 8B EC 53 8B 5D
00 EB FA E8 0A 00 00 00 E8 EB
02 EB 01 81 50 E8 02 00 00 00
ep_only = false

DLL) -> emadicius]

08 56 8B 75 0C 57 8B 7D 10 85 F6 5F 5E 5B 5D EB 05 E8 EB 04 40
0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB
29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58

[MSLRH 0:32a (fake MSVC++ 7:0

signature = 55 8B EC 53 8B 5D
00 E8 EB 0C 00 00 E8 F6 FF FF
00 00 00 29 5A 58 6B C0 03 E8
ep_only = false

DLL Method 3) -> emadicius]

08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00
FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02
02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB

[MSLRH 0:32a (fake MSVC++ DLL

signature = 55 8B EC 56 57 BF
E8 0A 00 00 00 E8 EB 0C 00 00
81 50 E8 02 00 00 00 29 5A 58
ep_only = false

Method 4) -> emadicius]

01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA
E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01
6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75

-124-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

[MSLRH 0:32a (fake Neolite

signature = E9 A6 00 00 00
40 00 4E 65 6F 4C 69 74 65
65 73 73 6F 72 0D 0A 43 6F
ep_only = false

04 August 2015 15:14

2:0) -> emadicius]

B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62
20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72
70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31

[MSLRH 0:32a (fake nSPack 1:3) -> emadicius]

signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B
06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40
00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74
ep_only = false
[MSLRH 0:32a (fake PC-Guard 4:xx) -> emadicius]
signature = FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB
01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF
FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58
ep_only = false
[MSLRH 0:32a (fake PE Crypt 1:02) -> emadicius]
signature = E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00
EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00
00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB
ep_only = false
[MSLRH 0:32a (fake PE Lock
signature = EB 03 CD 20 C7
EB E8 03 00 00 00 E9 EB 04
EB 04 40 00 EB FA E8 0A 00
ep_only = false

NT
1E
58
00

2:04)
EB 03
40 50
00 E8

->
CD
C3
EB

[MSLRH 0:32a (fake PEBundle 0:2 - 3:x)

signature = 9C 60 E8 02 00 00 00 33 C0
DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8
FF 83 C4 08 74 04 75 02 EB 02 EB 01 81
ep_only = false
[MSLRH 0:32a (fake PEBundle 2:0x
signature = 9C 60 E8 02 00 00 00
DD 83 BD 9C 38 40 00 01 61 9D EB
FF FF FF E8 F2 FF FF FF 83 C4 08
ep_only = false

emadicius]
20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01
EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8
0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83

->
8B
0A
50

emadicius]
C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87
00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF
E8 02 00 00 00 29 5A 58 6B C0 03 E8 02

- 2:4x) -> emadicius]

33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87
05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6
74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29

[MSLRH 0:32a (fake PECompact 1:4x) -> emadicius]

signature = EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF
FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A
ep_only = false
[MSLRH 0:32a (fake PESHiELD 0:25) -> emadicius]
signature = 60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20
4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00
EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04
ep_only = false
[MSLRH 0:32a (fake PEtite 2:1) -> emadicius]
signature = B8 00 50 40 00 6A 00 68 BB 21 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66
9C 60 50 83 C4 04 61 66 9D 64 8F 05 00 00 00 00 83 C4 08 EB 05 E8 EB 04 40 00 EB FA E8 0A 00
00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB
ep_only = false
[MSLRH 0:32a (fake PEX 0:99) -> emadicius]
-125-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8
EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04
75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83
ep_only = false
[MSLRH 0:32a (fake SVKP
signature = 60 E8 00 00
04 40 00 EB FA E8 0A 00
02 EB 02 EB 01 81 50 E8
ep_only = false

1:11)
00 00
00 00
02 00

[MSLRH 0:32a (fake UPX 0:89:6

signature = 60 BE 00 90 8B 00
88 07 47 01 DB 75 07 8B 1E 83
DB 11 C0 01 DB 73 0B 75 19 8B
ep_only = false

->
5D
E8
00

emadicius]
81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB
EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75
00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4

- 1:02 /
8D BE 00
EE FC 11
1E 83 EE

[MSLRH 0:32a (fake WWPack32 1:x)

signature = 53 55 8B E8 33 DB EB
72 65 73 73 69 6F 6E 20 72 6F 75
63 29 20 31 39 39 38 20 50 69 6F
ep_only = false

->
60
74
74

1:05 - 1:24) -> emadicius]

80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46
DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11
FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40

emadicius]
0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70
69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28
72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52

[MSLRH 0:32a (fake yoda's cryptor 1:2)

signature = 60 E8 00 00 00 00 5D 81 ED
90 2C 8A C0 C0 78 90 04 62 EB 01 00 61
00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4
ep_only = false

->
F3
EB
08

emadicius]
1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC
05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00
74 04 75 02 EB 02 EB 01 81 50 E8 02 00

[MSLRH v0:1 -> emadicius]

signature = 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2
FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8
F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8
ep_only = false
[MSLRH V0:31 -> emadicius]
signature = 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1
ep_only = true
[MSLRH v0:31a]
signature = 60 D1
A8 EB 01 DE D0 EC
73 0F CA 87 D9 87
0F CB C1 D9 0C 86
C0 E9 FD 0F C1 D1
DC C4 EB 01 35 0F
01 EC 87 D3 0F CB
D3 B3 EB 01 BF D1
EB 04 40 00 EB FA
ep_only = false

CB
0F
D2
F9
EB
CA
C1
CB
E8

0F
C1
D0
86
01
D3
DB
87
0A

CA
CB
CF
D7
E3
D1
35
C9
00

C1
D0
87
D1
0F
86
D3
0F
00

CA
CF
D9
D9
CA
C8
E2
CA
00

E0
0F
0F
EB
87
EB
0F
0F

D1
C1
C8
01
D9
01
C8
C1

CA
D1
EB
A5
EB
01
86
DB

0F
D2
01
EB
01
0F
E2
EB

C8
DB
C1
01
F3
C0
86
01

EB
0F
EB
11
0F
F5
EC
44

01
C8
01
EB
CB
87
C1
C0

F1
EB
A2
01
87
C8
FB
CA

0F
01
86
1D
C2
D0
12
F2

C0
BC
CA
0F
0F
DE
D2
0F

C9
C0
D0
C1
C0
EB
EE
C1

D2
E9
E1
C2
F9
01
0F
D1

D1
C6
0F
0F
D0
95
C9
0F

0F
C1
C0
CB
F7
EB
D2
CB

C1
D0
CB
0F
EB
01
F6
EB

C0
91
0F
C1
01
E1
0F
01

D3
0F
CA
C2
2F
EB
CA
D3

DA
CB
C0
EB
0F
01
87
EB

C0
EB
C7
01
C9
FD
C3
05

D6
01
91
A1
C0
EB
C1
E8

[MSLRH v0:31a]
signature = 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6
A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01
73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F
ep_only = false
[MSLRH v0:32a (fake :BJFNT
signature = EB 03 3A 4D 3A
20 E8 03 00 00 00 E9 EB 04
EB 0C 00 00 E8 F6 FF FF FF
00 29 5A 58 6B C0 03 E8 02

1:3) -> emadicius

1E EB 02 CD 20 9C
58 40 50 C3 61 9D
E8 F2 FF FF FF 83
00 00 00 29 5A 83

(h)]
EB 02
1F EB
C4 08
C4 04
-126-

CD
05
74
58

20
E8
04
74

EB
EB
75
04

02
04
02
75

CD
40
EB
02

20
00
02
EB

60
EB
EB
02

EB
FA
01
EB

02
E8
81
01

C7
0A
50
81

05
00
E8
0F

EB
00
02
31

02
00
00
50

CD
E8
00
0F

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02
EB 02 EB 01
ep_only = true
[MSLRH v0:32a (fake ASPack
signature = 60 E8 02 00 00
E8 0A 00 00 00 E8 EB 0C 00
81 50 E8 02 00 00 00 29 5A
01 81 0F 31 50 0F 31 E8 0A
ep_only = true

2:11d) -> emadicius (h)]

00 EB 09 5D 55 81 ED 39 39
00 E8 F6 FF FF FF E8 F2 FF
58 6B C0 03 E8 02 00 00 00
00 00 00 E8 EB 0C 00 00 E8

44
FF
29
F6

00
FF
5A
FF

C3
83
83
FF

61
C4
C4
FF

EB
08
04
E8

05
74
58
F2

E8
04
74
FF

EB
75
04
FF

04 40 00 EB FA
02 EB 02 EB 01
75 02 EB 02 EB
FF

[MSLRH v0:32a (fake ASPack

signature = 60 E8 03 00 00
81 EB 00 73 00 00 61 EB 05
E8 F2 FF FF FF 83 C4 08 74
00 00 00 29 5A 83 C4 04 58
00 00 E8 F6 FF FF FF E8 F2
ep_only = true

2:12)
00 E9
E8 EB
04 75
74 04
FF FF

->
EB
04
02
75
FF

emadicius (h)]
04 5D 45 55 C3
40 00 EB FA E8
EB 02 EB 01 81
02 EB 02 EB 01
83 C4 08 2B 04

E8
0A
50
81
24

01
00
E8
0F
74

00
00
02
31
04

00
00
00
50
75

00
E8
00
0F
02

EB
EB
00
31
EB

5D
0C
29
E8
02

BB
00
5A
0A
EB

ED
00
58
00
01

FF
E8
6B
00

FF
F6
C0
00

FF
FF
03
E8

03
FF
E8
EB

DD
FF
02
0C

[MSLRH v0:32a (fake ASPack

signature = 60 E8 03 00 00
81 EB 00 A0 02 EB 05 E8 EB
FF FF FF 83 C4 08 74 04 75
00 29 5A 83 C4 04 58 74 04
E8 F6 FF FF FF E8 F2 FF FF
ep_only = true

2:12)
00 E9
04 40
02 EB
75 02
FF

->
EB
00
02
EB

emadicius (h)]
04 5D 45 55 C3
EB FA E8 0A 00
EB 01 81 50 E8
02 EB 01 81 0F

E8
00
02
31

01
00
00
50

00
E8
00
0F

00
EB
00
31

00
0C
29
E8

EB
00
5A
0A

5D
00
58
00

BB
E8
6B
00

ED
F6
C0
00

FF
FF
03
E8

FF
FF
E8
EB

FF
FF
02
0C

03
E8
00
00

DD
F2
00
00

emadicius (h)]
74 02 81 83 53
EB 05 E8 EB 04
08 74 04 75 02
04 58 74 04 75
E8 F2 FF FF FF

3B
40
EB
02

C9
00
02
EB

74
EB
EB
02

01
FA
01
EB

BC
E8
81
01

56
0A
50
81

3B
00
E8
0F

D2
00
02
31

74
00
00
50

02
E8
00
0F

81
EB
00
31

85
0C
29
E8

57
00
5A
0A

emadicius (h)]
06 38 41 00 64
E8 EB 04 40 00
04 75 02 EB 02
74 04 75 02 EB
FF FF FF 83 C4

A1
EB
EB
02
08

00
FA
01
EB
2B

00
E8
81
01
04

00
0A
50
81
24

00
00
E8
0F
74

50
00
02
31
04

64
00
00
50
75

89
E8
00
0F
02

25
EB
00
31
EB

00
0C
29
E8
02

00
00
5A
0A
EB

F6
FF
00
E8

5F
FF
29
F6

5E
FF
5A
FF

5B
83
83
FF

5D
C4
C4
FF

EB
08
04
E8

05
74
58
F2

E8
04
74
FF

EB
75
04
FF

04 40
02 EB
75 02
FF

emadicius (h)]
5B 5D EB 05 E8
83 C4 08 74 04
83 C4 04 58 74
FF FF E8 F2 FF

EB
75
04
FF

04 40 00 EB FA E8 0A 00 00
02 EB 02 EB 01 81 50 E8 02
75 02 EB 02 EB 01 81 0F 31
FF

[MSLRH v0:32a (fake EXE32Pack

signature = 3B C0 74 02 81 83
E8 00 00 00 00 3B DB 74 01 90
00 E8 F6 FF FF FF E8 F2 FF FF
58 6B C0 03 E8 02 00 00 00 29
00 00 00 E8 EB 0C 00 00 E8 F6
ep_only = true

1:3x)
55 3B
83 C4
FF 83
5A 83
FF FF

->
C0
14
C4
C4
FF

[MSLRH v0:32a (fake Microsoft

signature = 55 8B EC 6A FF 68
00 00 64 8F 05 00 00 00 00 83
00 E8 F6 FF FF FF E8 F2 FF FF
58 6B C0 03 E8 02 00 00 00 29
00 00 00 E8 EB 0C 00 00 E8 F6
01
ep_only = true

Visual C++)
CA 37 41 00
C4 0C 5D EB
FF 83 C4 08
5A 83 C4 04
FF FF FF E8

->
8B
00
58
00

->
68
05
74
58
F2

[MSLRH v0:32a (fake MSVC++

signature = 55 8B EC 53 8B
00 EB FA E8 0A 00 00 00 E8
02 EB 01 81 50 E8 02 00 00
EB 02 EB 01 81 0F 31 50 0F
ep_only = true

6:0 DLL)
5D 08 56
EB 0C 00
00 29 5A
31 E8 0A

emadicius (h)]
75 0C 57 8B 7D
E8 F6 FF FF FF
6B C0 03 E8 02
00 00 E8 EB 0C

[MSLRH v0:32a (fake MSVC++

signature = 55 8B EC 53 8B
00 E8 EB 0C 00 00 E8 F6 FF
00 00 00 29 5A 58 6B C0 03
50 0F 31 E8 0A 00 00 00 E8
ep_only = true

7:0 DLL Method

5D 08 56 8B 75
FF FF E8 F2 FF
E8 02 00 00 00
EB 0C 00 00 E8

[MSLRH v0:32a (fake MSVC++

signature = 55 8B EC 56 57
E8 0A 00 00 00 E8 EB 0C 00
81 50 E8 02 00 00 00 29 5A

DLL Method 4) -> emadicius

BF 01 00 00 00 8B 75 0C 85
00 E8 F6 FF FF FF E8 F2 FF
58 6B C0 03 E8 02 00 00 00

3)
0C
FF
29
F6

->
5E
FF
5A
FF

-127-

10
E8
00
00

85
F2
00
00

(h)]
F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA
FF FF 83 C4 08 74 04 75 02 EB 02 EB 01
29 5A 83 C4 04 58 74 04 75 02 EB 02 EB

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true
[MSLRH v0:32a (fake Neolite 2:0)
signature = E9 A6 00 00 00 B0 7B
40 00 4E 65 6F 4C 69 74 65 20 45
65 73 73 6F 72 0D 0A 43 6F 70 79
4E 65 6F 57 6F 72 78 20 49 6E 63
20 28 63 29 20 31 39 39 37 2D 31
52 69 67 68 74 73 20 52 65 73 65
00 00 00 E8 EB 0C 00 00 E8 F6 FF
E8 02 00 00 00 29 5A 58 6B C0 03
0F 31 50 0F 31 E8 0A 00 00 00 E8
74 04 75 02 EB 02 EB 01
ep_only = true

->
40
78
72
0D
39
72
FF
E8
EB

emadicius (h)]
00 78 60 40 00
65 63 75 74 61
69 67 68 74 20
0A 50 6F 72 74
39 39 20 4C 65
76 65 64 2E 00
FF E8 F2 FF FF
02 00 00 00 29
0C 00 00 E8 F6

7C
62
28
69
65
00
FF
5A
FF

60
6C
63
6F
20
00
83
83
FF

40
65
29
6E
48
00
C4
C4
FF

00
20
20
73
61
EB
08
04
E8

00
46
31
20
73
05
74
58
F2

00
69
39
43
69
E8
04
74
FF

00
6C
39
6F
75
EB
75
04
FF

00
65
38
70
6B
04
02
75
FF

B0
20
2C
79
0D
40
EB
02
83

3F
43
31
72
0A
00
02
EB
C4

00
6F
39
69
41
EB
EB
02
08

00
6D
39
67
6C
FA
01
EB
2B

12
70
39
68
6C
E8
81
01
04

62
72
20
74
20
0A
50
81
24

2D
0F
FF
02
0C

AC
84
E8
00
00

85
F1
F2
00
00

40
01
FF
00
E8

00
00
FF
29
F6

2B
00
FF
5A
FF

E8
61
83
83
FF

8D
9D
C4
C4
FF

B5
EB
08
04
E8

D3
05
74
58
F2

FE
E8
04
74
FF

FF
EB
75
04
FF

FF
04
02
75
FF

8B
40
EB
02
83

[MSLRH v0:32a (fake PC-Guard 4:xx) -> emadicius

signature = FC 55 50 E8 00 00 00 00 5D EB 01 E3
01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB
FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB
02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02
0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true

(h)]
60 E8
FA E8
01 81
EB 01

03
0A
50
81

00
00
E8
0F

00
00
02
31

00
00
00
50

D2
E8
00
0F

EB
EB
00
31

0B
0C
29
E8

58
00
5A
0A

EB
00
58
00

01
E8
6B
00

48
F6
C0
00

40
FF
03
E8

EB
FF
E8
EB

[MSLRH v0:32a (fake PE Crypt 1:02) -> emadicius

signature = E8 00 00 00 00 5B 83 EB 05 EB 04 52
EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD
00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF
02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29
31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6
ep_only = true

(h)]
4E 44
20 58
FF 83
5A 83
FF FF

21
58
C4
C4
FF

85
EB
08
04
E8

C0
05
74
58
F2

73
E8
04
74
FF

02
EB
75
04
FF

F7
04
02
75
FF

05
40
EB
02

50
00
02
EB

E8
EB
EB
02

08
FA
01
EB

00
E8
81
01

00
0A
50
81

00
00
E8
0F

01
03
FF
E8
EB

EB
CD
FF
02
0C

01
20
E8
00
00

EB
03
F2
00
00

60
61
FF
00
E8

EB
9D
FF
29
F6

03
83
FF
5A
FF

CD
C4
83
83
FF

20
04
C4
C4
FF

EB
EB
08
04
E8

EB
05
74
58
F2

01
E8
04
74
FF

- 3:x) -> emadicius (h)]

33 C0 8B C4 83 C0 04 93 8B
FA E8 0A 00 00 00 E8 EB 0C
01 81 50 E8 02 00 00 00 29
EB 01 81 0F 31 50 0F 31 E8

E3
00
5A
0A

8B
00
58
00

5B
E8
6B
00

FC
F6
C0
00

81
FF
03
E8

EB
FF
E8
EB

07
FF
02
0C

30
E8
00
00

40
F2
00
00

00
FF
00
E8

87
FF
29
F6

[MSLRH v0:32a (fake nSPack

signature = 9C 60 E8 00 00
06 83 F8 00 74 11 8D B5 DF
00 EB FA E8 0A 00 00 00 E8
02 EB 01 81 50 E8 02 00 00
EB 02 EB 01 81 0F 31 50 0F
C4 08 2B 04 24 74 04 75 02
ep_only = true

1:3) -> emadicius

00 00 5D B8 B3 85
FE FF FF 8B 06 83
EB 0C 00 00 E8 F6
00 29 5A 58 6B C0
31 E8 0A 00 00 00
EB 02 EB 01

(h)]
40 00
F8 01
FF FF
03 E8
E8 EB

[MSLRH v0:32a (fake PE Lock NT 2:04) -> emadicius (h)]

signature = EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB
EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB
EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF
75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03
04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8
FF FF
ep_only = true
[MSLRH v0:32a (fake PEBundle 0:2
signature = 9C 60 E8 02 00 00 00
DD 61 9D EB 05 E8 EB 04 40 00 EB
FF 83 C4 08 74 04 75 02 EB 02 EB
5A 83 C4 04 58 74 04 75 02 EB 02
FF FF FF E8 F2 FF FF FF
ep_only = true

[MSLRH v0:32a (fake PEBundle 2:0x signature = 9C 60 E8 02 00 00 00 33

DD 83 BD 9C 38 40 00 01 61 9D EB 05
FF FF FF E8 F2 FF FF FF 83 C4 08 74

2:4x)
C0 8B
E8 EB
04 75

->
C4
04
02

emadicius (h)]
83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87
40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6
EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0
-128-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00
E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF
ep_only = true
[MSLRH v0:32a (fake PECompact
signature = EB 06 68 2E A8 00
FC 81 EB 3F 90 40 00 61 9D EB
FF FF E8 F2 FF FF FF 83 C4 08
E8 02 00 00 00 29 5A 83 C4 04
EB 0C 00 00 E8 F6 FF FF FF E8
ep_only = true

1:4x)
00 C3
05 E8
74 04
58 74
F2 FF

->
9C
EB
75
04
FF

emadicius (h)]
60 E8 02 00 00
04 40 00 EB FA
02 EB 02 EB 01
75 02 EB 02 EB
FF

[MSLRH v0:32a (fake PESHiELD 0:25) -> emadicius

signature = 60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A
4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21
EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF
EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8
02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB
ep_only = true
[MSLRH v0:32a (fake PEtite
signature = B8 00 50 40 00
9C 60 50 83 C4 04 61 66 9D
00 00 E8 EB 0C 00 00 E8 F6
02 00 00 00 29 5A 58 6B C0
31 50 0F 31 E8 0A 00 00 00
ep_only = true
[MSLRH v0:32a (fake PEX
signature = 60 E8 01 00
EB 04 40 00 EB FA E8 0A
75 02 EB 02 EB 01 81 50
04 75 02 EB 02 EB 01 81
FF FF 83 C4 08 2B 04 24
ep_only = true

2:1) -> emadicius

6A 00 68 BB 21 40
64 8F 05 00 00 00
FF FF FF E8 F2 FF
03 E8 02 00 00 00
E8 EB 0C 00 00 E8

0:99)
00 00
00 00
E8 02
0F 31
74 04

->
E8
00
00
50
75

00
E8
6B
00

[MSLRH v0:32a (fake SVKP 1:11) -> emadicius (h)]

signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00
04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6
02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0
75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00
FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01
ep_only = true
[MSLRH v0:32a (fake UPX
signature = 60 BE 00 90
88 07 47 01 DB 75 07 8B
DB 11 C0 01 DB 73 0B 75
0A 00 00 00 E8 EB 0C 00
50 E8 02 00 00 00 29 5A
81 0F 31 50 0F 31 E8 0A
ep_only = true

0:89:6 8B 00 8D
1E 83 EE
19 8B 1E
00 E8 F6
58 6B C0
00 00 00

1:02 / 1:05
BE 00 80 B4
FC 11 DB 72
83 EE FC 11
FF FF FF E8
03 E8 02 00
E8 EB 0C 00

33
0A
50
81

C0
00
E8
0F

8B
00
02
31

C4
00
00
50

83
E8
00
0F

C0
EB
00
31

04
0C
29
E8

93
00
5A
0A

8B
00
58
00

E3
E8
6B
00

8B
F6
C0
00

5B
FF
03
E8

67
0D
F2
00
00

69
0A
FF
00
E8

73
0D
FF
29
F6

74
00
FF
5A
FF

41
58
83
83
FF

72
61
C4
C4
FF

65
EB
08
04
E8

64
05
74
58
F2

20
E8
04
74
FF

74
EB
75
04
FF

6F
04
02
75
FF

3A
40
EB
02

20
00
02
EB

FF
C4
83
83
FF

35
08
C4
C4
FF

00
EB
08
04
E8

00
05
74
58
F2

00
E8
04
74
FF

00
EB
75
04
FF

64
04
02
75
FF

89
40
EB
02

25
00
02
EB

00
EB
EB
02

00
FA
01
EB

00
E8
81
01

00
0A
50
81

66
00
E8
0F

00
F6
C0
00

00
FF
03
E8

E9
FF
E8
EB

5D
FF
02
0C

81
E8
00
00

ED
F2
00
00

FF
FF
00
E8

22
FF
29
F6

40
FF
5A
FF

00
83
83
FF

61
C4
C4
FF

EB
08
04
E8

05
74
58
F2

E8
04
74
FF

64
FF
03
E8

A0
FF
E8
EB

23
FF
02
0C

00
E8
00
00

00
F2
00
00

00
FF
00
E8

83
FF
29
F6

C5
FF
5A
FF

06
83
83
FF

61
C4
C4
FF

EB
08
04
E8

05
74
58
F2

E8
04
74
FF

EB
75
04
FF

(h)]
90 90
DB 75
05 E8
74 04
58 74
F2 FF

90
07
EB
75
04
FF

90
8B
04
02
75
FF

90
1E
40
EB
02

90
83
00
02
EB

8A
EE
EB
EB
02

06
FC
FA
01
EB

46
11
E8
81
01

20
31
64
00
02
EB

64
2E
20
EB
EB
02

65
31
52
FA
01
EB

63
32
61
E8
81
01

6F
0D
66
0A
50
81

6D
0A
61
00
E8
0F

70
28
6C
00
02
31

(h)]
52 65
0D 0A
FF E8
02 00
0C 00

(h)]
00 64
00 83
FF FF
29 5A
F6 FF

emadicius (h)]
83 C4 04 E8 01
E8 EB 0C 00 00
00 00 29 5A 58
0F 31 E8 0A 00
02 EB 02 EB 01

00
E8
81
01

- 1:24) -> emadicius

FF 57 83 CD FF EB 3A
ED B8 01 00 00 00 01
DB 72 10 58 61 90 EB
F2 FF FF FF 83 C4 08
00 00 29 5A 83 C4 04
00 E8 F6 FF FF FF E8

[MSLRH v0:32a (fake WWPack32 1:x) -> emadicius (h)]

signature = 53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57
72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65
63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65
20 57 69 65 72 7A 62 69 63 6B 69 0D 0A 0D 0A 5D 5B 90
00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4
00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4
50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF
ep_only = true
-129-

50
72
7A
EB
08
04
E8

61
73
61
05
74
58
F2

63
69
6B
E8
04
74
FF

6B
6F
20
EB
75
04
FF

33
6E
61
04
02
75
FF

32
20
6E
40
EB
02

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[MSLRH v0:32a (fake yoda's

signature = 60 E8 00 00 00
90 2C 8A C0 C0 78 90 04 62
00 E8 F6 FF FF FF E8 F2 FF
58 6B C0 03 E8 02 00 00 00
00 00 00 E8 EB 0C 00 00 E8
ep_only = true

cryptor 1:2) -> emadicius (h)]

00 5D 81 ED F3 1D 40 00 B9 7B 09
EB 01 00 61 EB 05 E8 EB 04 40 00
FF FF 83 C4 08 74 04 75 02 EB 02
29 5A 83 C4 04 58 74 04 75 02 EB
F6 FF FF FF E8 F2 FF FF FF

[MSLRH v0:32a -> emadicius

signature = E8 EB 0C 00 00
74 04 75 02 EB 02 EB 01 81
FF FF FF 83 C4 08 2B 04 24
ep_only = false

(h)]
E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81
0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2
74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8

[MSLRH v0:32a -> emadicius

signature = E8 EB 0C 00 00
74 04 75 02 EB 02 EB 01 81
FF FF FF 83 C4 08 2B 04 24
E8 F6 FF FF FF E8 F2 FF FF
01 68 EB 02 CD 20 EB 01 E8
02 EB 01 81 E8 0A 00 00 00
ep_only = false

(h)]
E8 F6
0F 31
74 04
FF 83
CC 66
E8 EB

FF
50
75
C4
B8
0C

FF
0F
02
08
FE

FF
31
EB
3D
00

E8
E8
02
FF
74

F2
0A
EB
FF
04

FF
00
01
FF
75

FF
00
81
00
02

FF
00
83
EB
EB

83
E8
C4
01
02

00
EB
EB
02

C4
EB
04
68
EB

00
FA
01
EB

08
0C
E8
EB
01

8D
E8
81
01

74
00
0A
02
81

BD
0A
50
81

04
00
00
CD
66

3B
00
E8
0F

75
E8
00
20
E7

1E
00
02
31

02
F6
00
EB
64

40
00
00
50

EB
FF
E8
01
74

00
E8
00
0F

02
FF
EB
E8
04

8B
EB
00
31

EB
FF
0C
76
75

F7
0C
29
E8

01
E8
00
1B
02

AC
00
5A
0A

81
F2
00
EB
EB

[MSLRH v0:32a -> emadicius]

signature = EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF
FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2
FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03
ep_only = false
[MSLRH v32a -> emadicius]
signature = EB 05 E8 EB 04
FF FF 83 C4 08 74 04 75 02
FF FF FF 83 C4 08 74 04 75
00 29 5A 83 C4 04 58 74 04
E8 F6 FF FF FF E8 F2 FF FF
00 00 E8 EB 0C 00 00 E8 F6
20 EB 01 E8 76 1B EB 01 68
E7 64 E8 0A 00 00 00 E8 EB
EB 01 81 0F 31 50 0F 31 E8
2B 04 24 74 04 75 02 EB 02
F2 FF FF FF 83 C4 08 3D FF
EB 01 E8 CC 66 B8 FE 00 74
75 02 EB 02 EB 01 81 74 04
E8 F6 FF FF FF E8 F2 FF FF
00 00 E8 EB 0C 00 00 E8 F6
20 EB 01 E8 76 1B EB 01 68
E7 64 74 04 75 02 EB 02 EB
83 C4 08 74 04 75 02 EB 02
FF E8 F2 FF FF FF 83 C4 08
0C 00 00 E8 F6 FF FF FF E8
76 1B EB 01 68 EB 02 CD 20
75 02 EB 02 EB 01 81 E8 0A
04 75 02 EB 02 EB 01 81 0F
FF FF 83 C4 08 2B 04 24 74
F6 FF FF FF E8 F2 FF FF FF
ep_only = false
[MSLRH v32a
signature =
FF FF 83 C4
FF FF FF 83

->
EB
08
C4

40
EB
02
75
FF
FF
EB
0C
0A
EB
0F
04
75
FF
FF
EB
01
EB
2B
F2
EB
00
31
04
83

00
02
EB
02
83
FF
02
00
00
01
00
75
02
83
FF
02
81
01
04
FF
01
00
50
75
C4

EB
EB
02
EB
C4
FF
CD
00
00
81
00
02
EB
C4
FF
CD
E8
81
24
FF
E8
00
0F
02
08

FA
01
EB
02
08
E8
20
E8
00
83
EB
EB
02
08
E8
20
0A
0F
74
FF
CC
E8
31
EB

E8
81
01
EB
2B
F2
EB
F6
E8
C4
01
02
EB
2B
F2
EB
00
31
04
83
66
EB
E8
02

0A
E8
81
01
04
FF
01
FF
EB
04
68
EB
01
04
FF
01
00
50
75
C4
B8
0C
0A
EB

00
0A
50
81
24
FF
E8
FF
0C
E8
EB
01
81
24
FF
E8
00
0F
02
08
FE
00
00
01

00
00
E8
0F
74
FF
CC
FF
00
0A
02
81
0F
74
FF
CC
E8
31
EB
3D
00
00
00
81

00
00
02
31
04
83
66
E8
00
00
CD
66
31
04
83
66
EB
E8
02
FF
74
E8
00
83

E8
00
00
50
75
C4
B8
F2
E8
00
20
E7
50
75
C4
B8
0C
0A
EB
0F
04
F6
E8
C4

EB
E8
00
0F
02
08
FE
FF
F6
00
EB
64
0F
02
08
FE
00
00
01
00
75
FF
EB
04

0C
EB
00
31
EB
3D
00
FF
FF
E8
01
74
31
EB
3D
00
00
00
81
00
02
FF
0C
E8

00
0C
29
E8
02
FF
74
FF
FF
EB
E8
04
E8
02
FF
74
E8
00
83
EB
EB
FF
00
0A

00
00
5A
0A
EB
0F
04
83
FF
0C
76
75
0A
EB
0F
04
F6
E8
C4
01
02
E8
00
00

E8
00
58
00
01
00
75
C4
E8
00
1B
02
00
01
00
75
FF
EB
04
68
EB
F2
E8
00

F6
E8
6B
00
81
00
02
08
F2
00
EB
EB
00
81
00
02
FF
0C
E8
EB
01
FF
F6
00

FF
F6
C0
00
83
EB
EB
74
FF
E8
01
02
00
83
EB
EB
FF
00
0A
02
81
FF
FF
E8

FF
FF
03
E8
C4
01
02
04
FF
F6
68
EB
E8
C4
01
02
E8
00
00
CD
66
FF
FF
EB

FF
FF
E8
EB
04
68
EB
75
FF
FF
EB
01
EB
04
68
EB
F2
E8
00
20
E7
83
FF
0C

E8
FF
02
0C
E8
EB
01
02
83
FF
02
81
0C
E8
EB
01
FF
F6
00
EB
64
C4
E8
00

F2
E8
00
00
0A
02
81
EB
C4
FF
CD
74
00
0A
02
81
FF
FF
E8
01
74
08
F2
00

FF
F2
00
00
00
CD
66
02
08
E8
20
04
00
00
CD
66
FF
FF
EB
E8
04
74
FF
E8

emadicius]
05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF
74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2
08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00
-130-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

00 29 5A 83 C4 04
E8 F6 FF FF FF E8
00 00 E8 EB 0C 00
20 EB 01 E8 76 1B
E7 64 E8 0A 00 00
EB 01 81 0F 31 50
2B 04 24 74 04 75
F2 FF FF FF 83 C4
EB 01 E8 CC 66 B8
75 02 EB 02 EB 01
E8 F6 FF FF FF E8
00 00 E8 EB 0C 00
20 EB 01 E8 76 1B
E7 64 74 04 75 02
M AC RO S= 1E AA
ep_only = false

04 August 2015 15:14

58
F2
00
EB
00
0F
02
08
FE
81
F2
00
EB
EB

74
FF
E8
01
E8
31
EB
3D
00
74
FF
E8
01
02

04
FF
F6
68
EB
E8
02
FF
74
04
FF
F6
68
EB

75
FF
FF
EB
0C
0A
EB
0F
04
75
FF
FF
EB
01

02
83
FF
02
00
00
01
00
75
02
83
FF
02
81

EB
C4
FF
CD
00
00
81
00
02
EB
C4
FF
CD
E8

02
08
E8
20
E8
00
83
EB
EB
02
08
E8
20
0A

EB
2B
F2
EB
F6
E8
C4
01
02
EB
2B
F2
EB
00

01
04
FF
01
FF
EB
04
68
EB
01
04
FF
01
00

81
24
FF
E8
FF
0C
E8
EB
01
81
24
FF
E8
00

0F
74
FF
CC
FF
00
0A
02
81
0F
74
FF
CC
E8

31
04
83
66
E8
00
00
CD
66
31
04
83
66
EB

50
75
C4
B8
F2
E8
00
20
E7
50
75
C4
B8
0C

0F
02
08
FE
FF
F6
00
EB
64
0F
02
08
FE
00

31
EB
3D
00
FF
FF
E8
01
74
31
EB
3D
00
$[

E8
02
FF
74
FF
FF
EB
E8
04
E8
02
FF
74
MU

0A
EB
0F
04
83
FF
0C
76
75
0A
EB
0F
04
LT

00
01
00
75
C4
E8
00
1B
02
00
01
00
75
IE

00
81
00
02
08
F2
00
EB
EB
00
81
00
02
DI

00
83
EB
EB
74
FF
E8
01
02
00
83
EB
EB
T`

E8 EB 0C 00 00
C4 04 E8 0A 00
01 68 EB 02 CD
02 EB 01 81 66
04 75 02 EB 02
FF FF 83 C4 08
F6 FF FF FF E8
68 EB 02 CD 20
EB 01 81 74 04
E8 EB 0C 00 00
C4 04 E8 0A 00
01 68 EB 02 CD
02 EB 01 81 66
S CO MP IL ED

EB
08
C4
83
FF
0C
76
00
31

05
74
08
C4
E8
00
1B
00
50

E8
04
74
08
F2
00
EB
00
0F

EB
75
04
74
FF
E8
01
E8
31

04
02
75
04
FF
F6
68
EB
E8

40
EB
02
75
FF
FF
EB
0C
0A

00
02
EB
02
83
FF
02
00
00

EB
EB
02
EB
C4
FF
CD
00
00

FA
01
EB
02
08
E8
20
E8
00

E8
81
01
EB
2B
F2
EB
F6
E8

0A
E8
81
01
04
FF
01
FF
EB

00
0A
E8
81
24
FF
E8
FF
0C

00
00
0A
0F
74
FF
CC
FF
00

00
00
00
31
04
83
66
E8
00

E8
00
00
50
75
C4
B8
F2
E8

EB
E8
00
0F
02
08
FE
FF
F6

0C
EB
E8
31
EB
3D
00
FF
FF

00
0C
EB
E8
02
FF
74
FF
FF

00
00
0C
0A
EB
0F
04
83
FF

E8
00
00
00
01
00
75
C4
E8

F6
E8
00
00
81
00
02
08
F2

FF
F6
E8
00
83
EB
EB
74
FF

FF
FF
F6
E8
C4
01
02
04
FF

FF
FF
FF
EB
04
68
EB
75
FF

E8
FF
FF
0C
E8
EB
01
02
83

F2
E8
FF
00
0A
02
81
EB
C4

[MSLRH]
signature = 60 EB
FF FF FF 83 C4 08
F2 FF FF FF 83 C4
E8 F2 FF FF FF 83
00 E8 F6 FF FF FF
00 00 00 E8 EB 0C
CD 20 EB 01 E8 76
66 E7 64 E8 0A 00
02 EB 01 81 0F 31
08 2B 04 24 74 04
ep_only = false

05
74
08
C4
E8
00
1B
00
50
75

E8
04
74
08
F2
00
EB
00
0F
02

EB
75
04
74
FF
E8
01
E8
31
EB

04
02
75
04
FF
F6
68
EB
E8
02

40
EB
02
75
FF
FF
EB
0C
0A
EB

00
02
EB
02
83
FF
02
00
00
01

EB
EB
02
EB
C4
FF
CD
00
00
81

FA
01
EB
02
08
E8
20
E8
00

E8
81
01
EB
2B
F2
EB
F6
E8

0A
E8
81
01
04
FF
01
FF
EB

00
0A
E8
81
24
FF
E8
FF
0C

00
00
0A
0F
74
FF
CC
FF
00

00
00
00
31
04
83
66
E8
00

E8
00
00
50
75
C4
B8
F2
E8

EB
E8
00
0F
02
08
FE
FF
F6

0C
EB
E8
31
EB
3D
00
FF
FF

00
0C
EB
E8
02
FF
74
FF
FF

00
00
0C
0A
EB
0F
04
83
FF

E8
00
00
00
01
00
75
C4
E8

F6
E8
00
00
81
00
02
08
F2

FF
F6
E8
00
83
EB
EB
74
FF

FF
FF
F6
E8
C4
01
02
04
FF

FF
FF
FF
EB
04
68
EB
75
FF

E8
FF
FF
0C
E8
EB
01
02
83

F2
E8
FF
00
0A
02
81
EB
C4

h)]
8B 75
?? ??
EB 4E
F6 74
?? ??

0C
??
57
05
??

85
??
56
83
85

F6
85
53
FE
C0

57
C0
E8
03
74

8B
74
??
75
08

7D
09
??
26
57

10
57
??
57
56

75
56
FF
56
53

09
53
83
53
FF

83
FF
FE
E8
D0

3D
D0
01
??
89

??
85
89
??
45

??
C0
45
??
0C

??
74
0C
FF
8B

??
0C
75
85
45

??
A3
F0
45
??

65
??
15
33
D6

F8
??
??
F0
89

00
??
??
3B
35

83
EB
??
F7
??

65
60
??
75
??

FC
56
33
07
??

00
8D
F0
BE
??

53
45
FF
4F
5E

57
F8
15
E6
5F

BF
50
??
40
5B

4E
FF
??
BB
C9

E6
15
??
EB
C3

40
??
??
0B

BB
??
33
85

3B
??
F0
F3

[MSLRH]
signature = 60
FF FF FF 83 C4
F2 FF FF FF 83
E8 F2 FF FF FF
00 E8 F6 FF FF
00 00 00 E8 EB
CD 20 EB 01 E8
66 E7 64 E8 0A
02 EB 01 81 0F
08
ep_only = true

[MSVC++ DLL v:8 (typical OEP recognized signature = 8B FF 55 8B EC 53 8B 5D 08 56

00 EB 26 83 FE 01 74 05 83 FE 02 75 22 A1
57 56 53 E8 ?? ?? ?? FF 85 C0 75 04 33 C0
0C 85 C0 75 37 57 50 53 E8 ?? ?? ?? FF 85
C0 75 03 21 45 0C 83 7D 0C 00 74 11 A1 ??
0C 5F 5E 5B 5D C2 0C 00
ep_only = true
[MSVC++ v:8 (procedure 1 recognized
signature = 55 8B EC 83 EC 10 A1 ??
C7 BB 00 00 FF FF 74 0D 85 C3 74 09
?? 8B 75 FC 33 75 F8 FF 15 ?? ?? ??
8D 45 F0 50 FF 15 ?? ?? ?? ?? 8B 45
75 07 8B C6 C1 E0 10 0B F0 89 35 ??
ep_only = false

- h)]
?? ??
F7 D0
?? 33
F4 33
?? ??

83
??
FF
F0
F7

[mucki's protector -> mucki]

signature = BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 E9
-131-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[mucki's protector II -> mucki *
signature = E8 24 00 00 00 8B 4C
89 41 14 89 41 18 80 6A 00 E8 85
01 C3 C7 04 24 ?? ?? ?? ?? BE ??
ep_only = true

Sign:By:fly]
24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0
C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74
?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2 F7 C3

[mucki's protector II -> mucki]

signature = E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 00 00 00 31 C0
89 41 14 89 41 18 80 6A 00 E8 85 C0 74 12 64 8B 3D 18 00 00 00 8B 7F 30 0F B6 47 02 85 C0 74
01 C3 C7 04 24 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8A 06 F6 D0 88 06 46 E2
ep_only = true
[MZ0oPE 1:0:6b -> TaskFall]
signature = EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53
8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3
ep_only = true
[MZ0oPE 1:0:6b
signature = EB
8B 1B 80 3F FF
33 C9 E8 64 00
ep_only = true

->
CA
75
00

TaskFall]
89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53
C9 8B E5 61 68 ?? ?? ?? ?? C3 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6
00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00

[MZ_Crypt 1:0 - by BrainSt0rm]

signature = 60 E8 00 00 00 00 5D 81 ED 25 14 40 00 8B BD 77 14 40 00 8B 8D 7F 14 40 00 EB 28
83 7F 1C 07 75 1E 8B 77 0C 03 B5 7B 14 40 00 33 C0 EB 0C 50 8A A5 83 14 40 00 30 26 58 40 46
3B 47 10 76 EF 83 C7 28 49 0B C9 75 D4 8B 85 73 14 40 00 89 44 24 1C 61 FF E0
ep_only = true
[N-Joiner 0:1 (Asm Version) -> NEX]
signature = 6A 00 68 00 14 40 00 68
FF 25 AC 12 40 00 FF 25 B0 12 40 00
25 C0 12 40 00 FF 25 C4 12 40 00 FF
D4 12 40 00 FF 25 D8 12 40 00 FF 25
ep_only = true

00
FF
25
DC

10
25
C8
12

40
B4
12
40

00
12
40
00

6A
40
00
FF

00
00
FF
25

E8
FF
25
E4

14
25
CC
12

00
B8
12
40

00
12
40
00

00
40
00
FF

6A
00
FF
25

00
FF
25
EC

E8
25
D0
12

13
BC
12
40

00 00 00 CC
12 40 00 FF
40 00 FF 25
00

[N-Joy 1:3 -> NEX]

signature = 55 8B EC 83 C4 F0 B8 48 36 40 00 E8 54 EE FF FF 6A 00 68 D8 2B 40 00 6A 0A 6A 00
E8 2C EF FF FF E8 23 E7 FF FF 8D 40 00
ep_only = true
[Naked Packer V1:0 -> BigBoote *
signature = 60 FC 0F B6 05 ?? ??
?? ?? A1 ?? ?? ?? ?? 03 05 ?? ??
?? ?? ?? 01 83 3D ?? ?? ?? ?? 00
?? ?? 50 FF 15 ?? ?? ?? ?? C3 FF
ep_only = true

Sign:By:fly]
?? ?? 85 C0 75
?? ?? A3 ?? ??
75 07 61 FF 25
74 24 04 6A 00

31
??
??
FF

B8
??
??
15

??
E8
??
??

??
9A
??
??

??
00
61
??

??
00
FF
??

2B
00
74
50

05
A3
24
FF

??
??
04
15

??
??
6A
??

??
??
00
??

??
??
FF
??

A3
C6
15
??

?? ??
05 ??
?? ??
C3

[Naked Packer V1:0 -> BigBoote]

signature = 60 FC 0F B6 05 ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ??
?? ?? A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9A 00 00 00 A3 ?? ?? ?? ?? C6 05 ??
?? ?? ?? 01 83 3D ?? ?? ?? ?? 00 75 07 61 FF 25 ?? ?? ?? ?? 61 FF 74 24 04 6A 00
ep_only = true
[Naked Packer V1:X -> BigBoote *
signature = 6A ?? E8 9A 05 00 00
BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05
B9 ?? ?? ?? ?? 2B CF 89 45 E8 89
8B 48 06 66 8B 50 14 81 E1 FF FF
C6 45 FF 00 8D 7D E8 8B F3 8A 0E

Sign:By:fly]
8B D8 53 68 ??
00 00 8B 3D ??
0D ?? ?? ?? ??
00 00 8D 5C 02
8A 17 8A C1 3A

??
??
66
18
CA

-132-

??
??
89
8D
75

??
??
55
41
1E

E8
A1
EC
FF
84

6C
??
8B
E8
C0

FD
??
41
00
74

FF
??
3C
00
16

FF
??
33
00
8A

B9
66
D2
00
56

05
8B
03
EB
01

00
15
C1
01
8A

00
??
83
??
4F

00
??
C4
89
01

8B
??
10
45
8A

F3
??
66
F0
C2

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

3A D1 75 0E 83 C6 02 83 C7 02 84 C0 75 DC 33 C0 EB 05
ep_only = true
[Naked Packer V1:X -> BigBoote]
signature = 6A ?? E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3
BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ??
B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1
ep_only = true
[Nakedbind 1:0 -> nakedcrew]
signature = 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B 4D 5A 74 08 81 EB 00 00
ep_only = true
[NakedPacker 1:0 - by BigBoote]
signature = 60 FC 0F B6 05 34 ?? ?? ?? 85 C0 75 31 B8 50 ?? ?? ?? 2B 05 04 ?? ?? ?? A3 30 ??
?? ?? A1 00 ?? ?? ?? 03 05 30 ?? ?? ?? A3 38 ?? ?? ?? E8 9A 00 00 00 A3 50 ?? ?? ?? C6 05 34
?? ?? ?? 01 83 3D 50 ?? ?? ?? 00 75 07 61 FF 25 38 ?? ?? ?? 61 FF 74 24 04 6A 00
ep_only = true
[Native UD Packer
signature = 31 C0
00 89 C7 68 88 13
84 00 00 00 6A 40
40 00 68 CA 10 40
A4 40 40 00 89 C6
40 00 6A 00 6A 00
40 00 58 6A FF 50
ep_only = true

1:1 (Modded
31 DB 31 C9
00 00 FF 15
68 00 10 00
00 50 FF 15
68 00 30 40
6A 00 56 6A
FF 15 AC 40

Poison Ivy Shellcode) -> okkixot]

EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15
98 40 40 00 FF 15 94 40 40 00 81 C7
00 FF 35 04 30 40 00 6A 00 FF 15 A4
A8 40 40 00 6A 40 68 00 10 00 00 FF
00 FF 35 04 30 40 00 57 FF 35 08 30
00 6A 00 FF 15 9C 40 40 00 50 6A 00
40 00 6A 00 FF 15 A0 40

28
88
40
35
40
6A

41
13
40
08
00
00

40
00
00
30
50
6A

00
00
89
40
6A
11

FF
39
C7
00
02
50

15
F8
FF
6A
FF
FF

94
73
35
00
15
15

40
05
04
FF
4E
4A

40
E9
30
15
41
41

[nBinder v3:6:1]
signature = 6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C 00 5C 6E 35 36 34 35 36
35 33 32 33 34 35 34 33 5F 6E 62 33 5C
ep_only = false
[nBinder v4:0]
signature = 5C 6E 62 34 5F 74 6D 70 5F 30 31 33 32 34 35 34 33 35 30 5C 00 00 00 00 00 00 00
00 00 E9 55 43 4C FF 01 1A 00 00 00 00 96 30 07 77 2C 61 0E EE BA 51 09 99 19 C4 6D 07 8F F4
6A 70 35 A5 63 E9 A3 95 64 9E 32 88 DB 0E A4 B8 DC 79
ep_only = false
[nbuild v1:0 [soft]
signature = B9 ?? ?? BB ?? ?? C0 ?? ?? 80 ?? ?? 43 E2
ep_only = true
[NeoLite v1:0]
signature = E9 9B 00 00 00 A0
ep_only = true
[NeoLite v1:0]
signature = 8B 44 24 04 8D 54 24 FC 23 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 50 FF
25
ep_only = true
[NeoLite v2:00]
signature = 8B 44 24 04 23 05 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0
74
ep_only = true
[NeoLite v2:00]
signature = E9 A6
ep_only = true

-133-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Neolite v2:0]
signature = E9 A6 00 00 00
ep_only = true
[NeoLite v2:0]
signature = E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? 4E 65 6F 4C 69 74 65
ep_only = true
[NeoLite vx:x]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9E 37 00 00 ?? ??
48 ?? ?? ?? 6F 4C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 61
ep_only = true
[Netopsystems FEAD Optimizer]
signature = 60 BE 00 50 43 00 8D BE 00 C0 FC FF
ep_only = true
[Netopsystems FEAD Optimizer]
signature = E8 00 00 00 00 58 BB 00 00 40 00 8B
ep_only = true
[NFO v1:0]
signature = 8D 50 12 2B C9 B1 1E 8A 02 34 77 88 02 42 E2 F7 C8 8C
ep_only = true
[NFO v1:x modified]
signature = 60 9C 8D 50
ep_only = true
[nMacro recorder 1:0]
signature = 5C 6E 6D 72 5F 74 65 6D 70 2E 6E 6D 72 00 00 00 72 62 00 00 58 C7 41 00 10 F8 41
00 11 01 00 00 00 00 00 00 46 E1 00 00 46 E1 00 00 35 00 00 00 F6 88 41 00
ep_only = false
[NME 1:1 Public signature = 55 8B
FF 30 64 89 20 B8
A1 C8 45 14 13 E8
ep_only = true

by
EC
08
04

redlime]
83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64
5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13
F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B

[NME 1:1 Public signature = 55 8B

FF 30 64 89 20 B8
A1 C8 45 14 13 E8
13 A1 C8 45 14 13
FF A3 FC 5A 14 13
14 13 E8 1E E7 FF
5B 14 13 ?? ?? ??
FF 33 C0 5A 59 59
FF FF FF FF 0C 00
ep_only = true

by
EC
08
04
E8
B8
FF
??
64
00

redlime]
83 C4 F0
5C 14 13
F8 FF FF
2C F9 FF
04 5C 14
A1 04 5C
FF 8B C6
89 10 68
00 4E 4D

53
BA
8B
FF
13
14
E8
73
45

56
84
15
A3
E8
13
DF
36
20

B8
36
D0
F8
20
E8
FB
14
31

30
14
45
5A
FB
A8
FF
13
2E

35
13
14
14
FF
DA
FF
C3
31

14
E8
13
13
FF
FF
8B
E9
20

13
7D
A1
8B
8B
FF
C6
0F
53

E8
E2
C8
15
D8
??
E8
DF
74

9A
FF
45
D0
85
??
9C
FF
75

E6
FF
14
45
DB
??
DA
FF
62

FF
E8
13
14
74
??
FF
EB

FF
C0
E8
13
48
5C
FF
F8

33
EA
F4
A1
B8
14
B8
5E

C0
FF
F7
C8
00
13
00
5B

55
FF
FF
45
5B
50
5B
E8

68
8B
FF
14
14
8B
14
7E

6C
15
8B
13
13
CE
13
E0

36
CC
15
E8
8B
8B
E8
FF

14
45
CC
17
15
D3
72
FF

13
14
45
F9
C4
B8
E7
00

64
13
14
FF
45
00
FF
00

[NoName Packer]
signature = 60 E8 00 00 00 00 5D 81 ED 2E 34 46 00 B9 55 4A 46 00 81 E9 26 37 46 00 89 EA 81
C2 26 37 46 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E
64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C
ep_only = true
[NoodleCrypt 2:00 (Eng) -> NoodleSpa]
signature = EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A
E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01
-134-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02
ep_only = false
[NoodleCrypt v2:00 (Eng) -> NoodleSpa]
signature = EB 01 9A E8 76 00 00 00 EB
E8 55 00 00 00 EB 01 9A E8 43 04 00 00
9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00
01 9A E8 19 07 00 00 EB 01 9A E8 9C 00
EB 01 9A 8B F8 C3 E8 00 00 00 00 58 EB
EB 01 9A 81 C2 C8 00 00 00 EB 01 9A B9
9A 42 E2 EE 0F 6E C0 EB 01 9A 0F 7E C0
65 07 45 45 00 85 EB 75 C7 C6 00 85 EB
85 EB 7F 61 06 45 45 00 85 EB 7F
ep_only = true

01
EB
00
00
01
00
EB
65

9A
01
EB
00
9A
17
01
CF

E8
9A
01
EB
25
00
9A
8A

65
E8
9A
01
00
00
8B
00

00
E1
E8
9A
F0
EB
D0
85

00
00
25
E8
FF
01
00
EB

00
00
00
9C
FF
9A
85
D5

EB
00
00
06
8B
C0
EB
FD

01
EB
00
00
F8
0A
A5
C0

9A
01
EB
00
EB
06
F5
00

E8
9A
01
E8
01
EB
65
85

7D
E8
9A
00
9A
01
4B
EB

00
3D
E8
00
0F
9A
45
7F

00
00
02
00
6E
80
45
E5

00
00
04
00
F8
2A
00
05

EB
00
00
0F
C3
15
85
05

01
EB
00
7E
8B
EB
EB
05

9A
01
EB
F8
D0
01
B3
00

[NoodleCrypt v2:0]
signature = EB 01 9A E8 ?? 00 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01
ep_only = false
[NoodleCrypt v2:0]
signature = EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01
ep_only = true
[Noodlecrypt2 -> r>sc]
signature = EB 01 9A E8 76 00 00 00
ep_only = true
[North Star PE Shrinker 1:3 -> Liuxingping]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5
ep_only = true
[North Star PE Shrinker
signature = 9C 60 E8 00
06 83 F8 00 74 11 8D B5
8B 85 4F ?? FF FF 2B D0
ep_only = false

1:3 by Liuxingping]
00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B
7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5
89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01

[North Star PE Shrinker

signature = 9C 60 E8 00
06 83 F8 00 74 11 8D B5
8B 85 4F ?? FF FF 2B D0
FD 60 6A 40 68 00 10 00
85 63 ?? FF FF E8 00 00
61 03 BD 47 ?? FF FF 8B
83 C3 04 83 3B 00 74 2D
56 57 FF 95 63 ?? FF FF
63 ?? FF FF FF 95 A7 ??
ep_only = false

v1:3 by Liuxingping]
00 00 00 5D B8 B3 85
7F ?? FF FF 8B 06 83
89 95 4F ?? FF FF 01
00 68 00 10 00 00 6A
00 00 5B B9 31 89 40
DF 83 3F 00 75 0A 83
01 13 8B 33 03 7B 04
5B 5A 59 5F 83 F9 00
FF FF 8D

40
F8
95
00
00
C7
57
74

00
01
67
FF
81
04
51
05

2D
0F
??
95
E9
B9
52
83

AC
84
FF
A3
2E
00
53
C3

85
F1
FF
??
86
00
FF
08

40
01
8D
FF
40
00
B5
EB

00
00
B5
FF
00
00
A7
CE

2B
00
83
85
03
EB
??
68

E8
C7
??
C0
D9
16
FF
00

8D
06
FF
0F
50
B9
FF
80

B5
01
FF
84
53
01
FF
00

73
00
01
06
E8
00
B5
00

??
00
16
03
3D
00
A3
6A

FF
00
8B
00
02
00
??
00

FF
8B
36
00
00
03
FF
FF

8B
D5
8B
89
00
3B
FF
B5

[Norton Speed Disk Configuration file]

signature = 4E 6F 72 74 6F 6E 20 53 70 65 65 64
ep_only = false
[NOTA Version 1:1 (c) Novitex 1990]
signature = EB J3 06 1E 33 C0 8E D8 BE ?? ?? 0E 07 BF ?? ?? B9 ?? ?? FC F3 A4 1F 8C D3 BE ??
?? 8B D4 8E D6 BC ?? ?? 8B F4
ep_only = true
[nPack 1:1:150:2006:Beta -> NEOx]
signature = 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05
?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ??
?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3
-135-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[nPack 1:1:250:2006:Beta -> NEOx/[uinC]]
signature = 83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E
?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B
06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00
ep_only = false
[nPack v1:1 150-200 Beta -> NEOx]
signature = 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05
08 ?? ?? ?? A3 3C ?? ?? 00 E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00
ep_only = true
[nPack v1:1 250 Beta
signature = 83 3D 04
?? ?? ?? 2B 05 08 ??
06 00 00 A1 00 ?? ??
C3 56 57 68
ep_only = true

->
??
??
??

NEOx]
?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E
?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B
C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3

[nPack V1:1:150:2006:Beta -> NEOx *

signature = 83 3D ?? ?? ?? ?? ?? 75
?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00
?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ??
?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ??
A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ??
ep_only = true

Sign:By:fly]
05 E9 01 00 00
00 00 E8 E0 01
?? 01 05 ?? ??
?? ?? ?? 8B F8
?? 5E C3

00
00
??
68

C3
00
??
??

E8
E8
FF
??

41
EC
35
??

00
06
??
??

00
00
??
57

00
00
??
FF

B8
E8
??
D6

??
F7
C3
68

??
05
C3
??

??
00
56
??

??
00
57
??

2B
A1
68
??

05
??
??
57

[nPack V1:1:150:2006:Beta -> NEOx/[uinC]

signature = 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05
08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C
?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3
ep_only = true
[nPack V1:1:150:2006:Beta -> NEOx/[uinC]
signature = 83 3D 40 ?? ?? ?? 00 75 05 E9
08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00
?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01
?? ?? ?? FF 15 00 ?? ?? ?? 8B 35 08 ?? ??
A3 38 ?? ?? ?? FF D6 5F A3 34 ?? ?? ?? 5E
ep_only = true

01
E8
05
??
C3

00
E0
00
8B

00
01
??
F8

00
00
??
68

C3
00
??
44

E8
E8
FF
??

41
EC
35
??

00
06
00
??

00
00
??
57

00
00
??
FF

B8
E8
??
D6

80
F7
C3
68

??
05
C3
38

??
00
56
??

??
00
57
??

2B
A1
68
??

05
3C
54
57

[nPack V1:1:200:2006:Beta -> NEOx/[uinC]

signature = 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05
08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 EC 01 00 00 E8 F8 06 00 00 E8 03 06 00 00 A1 3C
?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3
ep_only = true
[nPack V1:1:250:2006:Beta -> NEOx/[uinC]
signature = 83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E
?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B
06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3
C3
ep_only = true
[nPack V1:1:275:2006:Beta -> NEOx *
signature = 55 8B EC 51 51 56 57 BE
45 FC 66 A5 50 8D 45 F8 50 A4 FF 15
00 C9 C3 E8 46 00 00 00 E8 73 00 00
00 00 00 E8 1A 02 00 00 E8 CA 06 00
?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ??
?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57

Sign:By:fly
?? ?? ?? ??
?? ?? ?? ??
00 B8 ?? ??
00 E8 19 06
?? ?? C3 C3
FF D6 68 ??

* 200800212]
8D 7D F8 66 A5
83 3D ?? ?? ??
?? ?? 2B 05 ??
00 00 A1 ?? ??
56 57 68 ?? ??
?? ?? ?? 57 A3

-136-

A4
??
??
??
??
??

BE
??
??
??
??
??

??
5F
??
C7
FF
??

??
5E
A3
05
15
??

??
75
??
??
??
FF

??
05
??
??
??
D6

8D
E8
??
??
??
5F

7D
02
??
??
??
A3

FC
00
E8
??
8B
??

8D
00
9C
??
??
??

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

?? ?? 5E C3
ep_only = true
[nPack V1:1:300:2006
signature = 83 3D ??
?? ?? ?? 2B 05 ?? ??
06 00 00 A1 ?? ?? ??
C3 56 57 68 ?? ?? ??
?? ?? ?? ?? 57 A3 ??
ep_only = true

Beta -> NEOx *

?? ?? ?? ?? 75
?? ?? A3 ?? ??
?? C7 05 ?? ??
?? FF 15 ?? ??
?? ?? ?? FF D6

Sign:By:fly]
05 E9 01 00 00
?? ?? E8 9C 00
?? ?? ?? ?? ??
?? ?? 8B 35 ??
5F A3 ?? ?? ??

00
00
??
??
??

C3
00
01
??
5E

E8
E8
05
??
C3

46
2D
??
8B

00
02
??
F8

00
00
??
68

00
00
??
??

E8
E8
FF
??

73
DD
35
??

00
06
??
??

00
00
??
57

00
00
??
FF

B8
E8
??
D6

??
2C
C3
68

[nPack v1:1:300:2006 Beta]

signature = 83 3D 4C ?? ?? 00 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00
ep_only = true
[NSIS Installer -> NullSoft]
signature = 83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF
15 30 70 40 00 53 FF 15 80 72 40 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ??
?? BE
ep_only = true
[NSPack -> Nort Star
signature = 83 F9 00
03 C2 50 FF 95 ?? ??
0B F6 0F 84 97 00 00
ep_only = false

Software
74 28 43
FF FF 5A
00 8B 95

- http<//www:nsdsn:com/]
8D B5 ?? ?? FF FF 8B 16 56 51 53 52 56 FF 33 FF 73 04 8B 43 08
5B 59 5E 83 C3 0C E2 E1 61 9D E9 ?? ?? ?? FF 8B B5 ?? ?? FF FF
?? ?? FF FF 03 F2 83 3E 00 75 0E 83 7E 04 00 75 08

[NSPack -> Nort Star

signature = 83 F9 00
03 C2 50 FF 95 ?? ??
0B F6 0F 84 97 00 00
75 02 EB 7A 8B 5E 08
ep_only = true

Software
74 28 43
FF FF 5A
00 8B 95
03 DA 53

- url<<//www:nsdsn:com/]
8D B5 ?? ?? FF FF 8B 16 56
5B 59 5E 83 C3 0C E2 E1 61
?? ?? FF FF 03 F2 83 3E 00
52 56 8D BD ?? ?? FF FF 03

[NsPacK :Net -> LiuXingPing >

signature = 56 69 72 74 75 61
49 6E 66 6F 00 4B 45 52 4E 45
6E 00 6D 73 63 6F 72 65 65 2E
ep_only = false

51
9D
75
7E

53
E9
0E
04

52
??
83
83

56
??
7E
C6

FF
??
04
0C

33 FF 73 04 8B 43 08
FF 8B B5 ?? ?? FF FF
00 75 08 83 7E 08 00
57

Sign by fly]
6C 50 72 6F 74 65 63 74 00 00 BB 01 47 65 74 53 79 73 74 65 6D
4C 33 32 2E 64 6C 6C 00 00 5E 00 5F 43 6F 72 ?? ?? ?? 4D 61 69
64 6C 6C

[NsPack 1:4 -> Liuxingping]

signature = 9C 60 E8 00 00 00 00 5D B8 ?? ?? 40 00 2D ?? ?? 40 00
ep_only = true
[NsPack 1:4 by North Star (Liu Xing Ping)]
signature = 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04
83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53
ep_only = false
[NsPack 2:3 -> Liu Xing
signature = 9C 60 E8 00
11 8D B5 ?? ?? FF FF 8B
FF 2B D0 89 95 ?? ?? FF
ep_only = false
[NsPack 2:9
signature =
8B F5 8D B5
?? ?? FF FF
6A 00 FF 95
00 00 03 D9
04 B9 00 00

->
9C
??
01
??
50
00

North
60 E8
?? FF
95 ??
?? FF
53 E8
00 EB

Ping]
00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74
06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF
FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD

Star]
00 00
FF 8A
?? FF
FF 85
B1 02
16 B9

00
06
FF
C0
00
01

00
3C
8D
0F
00
00

5D
01
B5
84
61
00

B8
0F
??
6A
8B
00

07
84
??
03
36
03

00
42
FF
00
8B
3B

00
02
FF
00
FD
83

00
00
01
89
03
C3

-137-

2B
00
16
85
BD
04

E8
C6
60
??
??
83

8D
06
6A
??
??
3B

B5
01
40
FF
FF
00

??
8B
68
FF
FF
74

??
D5
00
E8
8B
36

FF
2B
10
00
DF

FF
95
00
00
83

8A
??
00
00
3F

06
??
68
00
00

3C
FF
00
5B
75

00
FF
10
B9
0A

74
89
00
68
83

12
95
00
03
C7

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[nSPack 2:x -> North Star/Liu Xing Ping]
signature = FF FF 8B 4E 08 8D 56 10 8B 36 8B FE 83 F9 00 74 3F 8A 07 47 2C E8 3C 01 77 F7 8B
07 80 7A 01
ep_only = true
[nSPack 2:x/3:x :NET
signature = FF 25 A4
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
ep_only = true

->
??
00
00
00
00

North
?? ??
00 00
00 00
00 00

Star/Liu
00 00 00
00 00 00
00 00 00
00 00 00

Xing Ping]
00 00 00 00
00 00 00 00
00 00 00 00
00 00 00 00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

[nSPack 2:x/3:x :NET-> North Star/Liu Xing Ping]

signature = FF 25 A4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true
[NsPack 3:0 by
signature = 9C
00 74 15 8B F5
11 F9 FF FF 89
ep_only = true

North Star (Liu Xing Ping)]

60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 55 F9 FF FF 66 8B 06 66 83 F8
8D B5 7D F9 FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95
95

[NsPack 3:1 -> Liu Xing

signature = 9C 60 E8 00
FF FF 8A 03 3C 01 0F 84
?? ?? FF FF 8D B5 ?? ??
ep_only = false
[NsPack 3:1 -> North
signature = 9C 60 E8
FF FF 8A 03 3C 01 0F
?? ?? FF FF 8D B5 ??
ep_only = false

Ping]
00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74 10 8D 9D ?? ??
42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95
FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00

Star (h)]
00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ??
84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95
?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00

[NsPack 3:1 by
signature = 9C
FF FF 8A 03 3C
?? ?? FF FF 8D
ep_only = true

North Star (Liu Xing Ping)]

60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ??
01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95
B5

[NsPack 3:4 ->

signature = 9C
00 01 8B D5 2B
6A 40 68 00 10
ep_only = true

North
60 E8
95 ??
00 00

Star]
00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF 80 38 01 0F 84 42 02 00 00 C6
?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60
68 00 10 00 00 6A 00 FF 95 ?? ?? FF FF 85 C0 0F 84 6A 03 00

[NsPack 3:4 ->

signature = 9C
00 01 8B D5 2B
6A 40 68 00 10
?? FF FF E8 00
?? FF FF 8B DF
3B 00 74 36 01
8B 85 ?? ?? FF
ep_only = true

North
60 E8
95 ??
00 00
00 00
83 3F
13 8B
FF 05

Star]
00 00
?? FF
68 00
00 5B
00 75
33 03
AA 05

00
FF
10
B9
0A
7B
00

00
89
00
68
83
04
00

5D
95
00
03
C7
57
FF

83
??
6A
00
04
51
D0

ED
??
00
00
B9
52
5B

07
FF
FF
03
00
53
5A

8D
FF
95
D9
00
FF
59

85
01
??
50
00
B5
5F

[NsPack 3:x -> Liu Xing Ping]

-138-

??
95
??
53
00
??
83

??
??
FF
E8
EB
??
F9

FF
??
FF
B1
16
FF
00

FF
FF
85
02
B9
FF
74

80
FF
C0
00
01
FF
05

38
8D
0F
00
00
B5
83

01
B5
84
61
00
??
C3

0F
??
6A
8B
00
??
08

84
??
03
36
03
FF
EB

42
FF
00
8B
3B
FF
C5

02
FF
00
FD
83
8B

00
01
89
03
C3
D6

00
16
85
BD
04
8B

C6
60
??
??
83
CF

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D
ep_only = true
[NSPack 3:x -> Liu Xing Ping]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF ?? 38 01 0F 84 ?? 02 00 00 ??
00 01
ep_only = true
[NsPack V1:1 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D B8 57 84 40 00 2D 50 84 40 00
ep_only = true
[nSpack V1:3 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00
ep_only = true
[NsPack V1:4 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D B8 B1 85 40 00 2D AA 85 40 00
ep_only = true
[nSpack V2:3 -> LiuXingPing]
signature = 9C 60 70 61 63 6B 24 40
ep_only = false
[NsPack v2:3 -> North Star]
signature = 9C 60 E8 00 00 00
11 8D B5 ?? ?? FF FF 8B 06 83
FF 2B D0 89 95 ?? ?? FF FF 01
00 10 00 00 68 00 10 00 00 6A
E8 00 00 00 00 5B B9 54 03 00
ep_only = false

00
F8
95
00
00

5D
01
??
FF
03

B8
0F
??
95
D9

07
84
FF
??
50

00
4B
FF
??
53

00
02
8D
FF
E8

00
00
B5
FF
9D

2B
00
??
85
02

E8
C7
??
C0
00

8D
06
FF
0F
00

B5
01
FF
84
61

??
00
01
56

??
00
16
03

FF
00
8B
00

FF
8B
36
00

8B
D5
8B
89

06
8B
FD
85

83
85
60
??

F8
??
6A
??

00
??
40
FF

74
FF
68
FF

[NsPack V2:X -> LiuXingPing]

signature = 6E 73 70 61 63 6B 24 40
ep_only = false
[nSpack V2:x -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5
ep_only = false
[NsPacK V3:0 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? ?? ?? 66 8B 06 66 83 F8
00 74
ep_only = true
[NsPacK V3:1 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74
ep_only = true
[NsPack v3:1 -> North Star]
signature = 9C 60 E8 00 00 00
FF FF 8A 03 3C 01 0F 84 42 02
?? ?? FF FF 8D B5 ?? ?? FF FF
FF FF 85 C0 0F 84 6A 03 00 00
E8 B1 02 00 00 61 8B 36 8B FD
EB 16 B9 01 00 00 00 03 3B 83
?? FF FF FF B5 ?? ?? FF FF 8B
F9 00 74 05 83 C3 08 EB C5 68
ep_only = true

00
00
01
89
03
C3
D6
00

5D
00
16
85
BD
04
8B
80

83
C6
60
??
??
83
CF
00

ED
03
6A
??
??
3B
8B
00

07
01
40
FF
FF
00
85
6A

8D
8B
68
FF
FF
74
??
00

9D
D5
00
E8
8B
36
??

??
2B
10
00
DF
01
FF

??
95
00
00
83
13
FF

FF
??
00
00
3F
8B
05

FF
??
68
00
00
33
AA

8A
FF
00
5B
75
03
05

03
FF
10
B9
0A
7B
00

3C
89
00
68
83
04
00

00
95
00
03
C7
57
FF

[NsPacK V3:3 -> LiuXingPing]

signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 00 74
-139-

74
??
6A
00
04
51
D0

10
??
00
00
B9
52
5B

8D
FF
FF
03
00
53
5A

9D
FF
95
D9
00
FF
59

??
01
??
50
00
B5
5F

??
95
??
53
00
??
83

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[NsPacK V3:4-V3:5 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 01 0F 84
ep_only = true
[NsPacK V3:6 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 83 38 01 0F 84 47 02 00 00
ep_only = true
[NsPacK V3:7 -> LiuXingPing]
signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 80 39 01 0F ?? ?? ?? 00 00
ep_only = true
[NsPack v3:7 -> North Star
signature = 9C 60 E8 00 00
01 01 8B C5 2B 85 ?? ?? ??
56 6A 40 68 00 10 00 00 68
?? ?? ?? FF E8 00 00 00 00
BD ?? ?? ?? FF 8B DF 83 3F
04 83 3B 00 74 34 01 13 8B
CF 8B 85 ?? ?? ?? FF 05 AA
00 6A 00 FF B5 ?? ?? ?? FF
83 F9 00 74 3F 8A 07 47 2C
66 C1 E8 08 C1 C0 10 86 C4
EB E8 8B C3 E2 C6 E8 3A 01
ep_only = true

(h)]
00 00
FF 89
00 10
5B B9
00 75
33 03
05 00
FF 95
E8 3C
EB 0A
00 00

5D
85
00
67
0A
7B
00
??
01
8A
8D

83
??
00
03
83
04
FF
??
77
5F
8D

ED
??
6A
00
C7
57
D0
??
F7
04

07
??
00
00
04
51
5B
FF
8B
86

8D
FF
FF
03
B9
53
59
8D
07
C4

8D
01
95
D9
00
FF
5F
B5
80
C1

??
85
??
50
00
B5
83
??
7A
C0

??
??
??
53
00
??
F9
??
01
10

??
??
??
E8
00
??
00
??
00
86

FF
??
FF
B0
EB
??
74
FF
74
C4

80
FF
85
02
16
FF
05
8B
14
2B

39
8D
C0
00
B9
FF
83
4E
8A
C7

01
B5
0F
00
01
B5
C3
08
1A
03

0F
??
84
5E
00
??
08
8D
38
C6

84
??
69
5D
00
??
EB
56
1F
89

42
??
03
8B
00
??
C7
10
75
07

02
FF
00
36
03
FF
68
8B
E9
83

00
01
00
8B
3B
8B
00
36
8A
C7

00
06
89
FD
83
D6
80
8B
5F
05

C6
55
85
03
C3
8B
00
FE
04
80

[NTkrnl Secure Suite -> NTkrnl Team (Blue)]

signature = 68 29 19 43 00 E8 01 00 00 00 C3 C3 A2 A9 61 4E A5 0E C7 A6 59 90 6E 4D 4C DB 36
46 FB 6E C4 45 A3 C2 2E 0E 41 59 1A 50 17 39 62 4D B8 61 24 8E CF D1 0E 9E 7A 66 C0 8D 6B 9C
52 7E 96 46 80 AF
ep_only = false
[NTkrnl Secure
signature = 34
00 41 10 00 00
64 4C 69 62 72
ep_only = true

Suite
10 00
50 10
61 72

->
00
00
79

NTkrnl team
28 10 00 00
00 00 00 00
41 00 00 00

(h)]
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61
47 65 74 50 72 6F 63 41 64 64 72 65 73 73

[NTkrnl Secure Suite

signature = 34 10 00
00 41 10 00 00 50 10
64 4C 69 62 72 61 72
ep_only = false

->
00
00
79

NTkrnl team
28 10 00 00
00 00 00 00
41 00 00 00

(h)]
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61
47 65 74 50 72 6F 63 41 64 64 72 65 73 73 79

[NTkrnl Secure
signature = 00
00 00 00 00 00
33 32 2E 64 6C
ep_only = true

0:1-0:15
00 00 00
00 00 00
00 00 4C

Suite
00 00
00 00
6C 00

[NTkrnl Secure Suite

signature = 00 00 00
00 00 00 00 00 00 00
33 32 2E 64 6C 6C 00
41 64 64 72 65 73 73
ep_only = false

->
00
00
6F

NTkrnl Software]
00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00
00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C
61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74

V0:1 -> NTkrnl

00 00 00 00 00
00 00 00 00 00
00 00 4C 6F 61
00 68 ?? ?? ??

Software
00 00 00
00 ?? ??
64 4C 69
?? E8 01

> Sign by fly]

00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00
?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C
62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63
00 00 00 C3 C3

[NTkrnl Secure Suite V0:1 DLL -> NTkrnl Software > Sign by fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C
-140-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63
41 64 64 72 65 73 73 00 8B 44 24 04 05 ?? ?? ?? ?? 50 E8 01 00 00 00 C3 C3
ep_only = false
[NTKrnlPacker -> Ashkbiz Danehkar]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C
33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74
ep_only = false
[NTPacker V2:X -> ErazerZ > Sign by fly]
signature = 4B 57 69 6E 64 6F 77 73 00 10 55 54 79 70 65 73 00 00 3F 75 6E 74 4D 61 69 6E 46
75 6E 63 74 69 6F 6E 73 00 00 47 75 6E 74 42 79 70 61 73 73 00 00 B7 61 50 4C 69 62 75 00 00
00
ep_only = false
[Nullsoft Install
signature = 55 8B
40 00 BF C0 B2 40
01 68 00 00 00 80
ep_only = true

System 1:xx]
EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70
00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A
57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00

[Nullsoft Install
signature = 83 EC
20 FF 15 28 70 40
00 22 75 08 80 C3
ep_only = false

System 1:xx]
0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3
00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41
02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74

[Nullsoft Install
signature = 83 EC
00 55 FF 15 84 72
E8 8D FF FF FF 8B
ep_only = false

System 2:0 RC2]

10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40
40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00
1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00

[Nullsoft Install
signature = 83 EC
15 ?? ?? ?? ?? 53
00 BE ?? ?? ?? ??
ep_only = false

System 2:06]
20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF
FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 02 23 00
56

[Nullsoft Install
signature = 83 EC
?? 53 FF 15 ?? ??
E8 8D FF FF FF 8B
ep_only = true

System 2:0]
0C 53 55 56 57 C7 44 24 10 ?? ?? ?? ?? 33 DB C6 44 24 14 20 FF 15 ?? ?? ??
?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 56 57 A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
2D ?? ?? ?? ?? 85 C0

[Nullsoft Install
signature = 83 EC
00 53 FF 15 84 72
E8 8D FF FF FF 8B
ep_only = false

System 2:0]
0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40
40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00
2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00

[Nullsoft Install
signature = 83 EC
20 FF 15 28 10 40
00 22 75 08 80 C3
ep_only = false

System 2:0a0]
0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3
00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41
02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74

[Nullsoft Install
signature = 83 EC
00 55 FF 15 88 72
E8 9F FF FF FF 8B

System 2:0b4]
10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40
40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00
1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00
-141-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = false
[Nullsoft Install
signature = 83 EC
00 BD 00 04 00 00
BF 80 92 79 00 56
ep_only = false

System 2:0b4]
14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A
56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3
57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71

[Nullsoft Install System v1:98]

signature = 83 EC 0C 53 56 57 FF 15 2C 81 40
ep_only = true
[Nullsoft Install
signature = 83 EC
20 FF 15 28 70 40
00 22 75 08 80 C3
8B F0 8A 06 84 C0
F0 EB F4 80 3E 2F
ep_only = true

System v1:xx]
0C 53 56 57 FF
00 68 00 04 00
02 BE 61 FD 41
75 F1 80 3E 00
75

15
00
00
74

20
FF
8A
05

71
15
06
56

40
28
8B
FF

00
71
3D
D7

05
40
F0
8B

E8
00
71
F0

03
50
40
89

00
56
00
74

00
FF
84
24

BE
15
C0
14

60
08
74
80

FD
71
0F
3E

41
40
3A
20

00
00
C3
75

89
80
74
07

44
3D
0B
56

24
60
56
FF

10
FD
FF
D7

B3
41
D7
8B

[Nullsoft Install
signature = 55 8B
40 00 BF C0 B2 40
01 68 00 00 00 80
75 E4 E8 C1 C9 FF
45 FC 8D 45 F8 56
56 56 56 57 FF D3
F8 56 51 50 57 FF
45 E8 8B 45 F8 29
45 F4 8B 45 F8 01
ep_only = true

System v1:xx]
EC 83 EC 2C 53
00 68 04 01 00
57 FF 15 9C 70
FF 8B 1D 68 70
50 8D 45 E4 6A
39 75 FC 7E 62
75 EC FF 15 48
45 FC 83 C4 0C
45 F0 39 75 FC

56
00
40
40
04
BF
70
39

33
57
00
00
50
74
40
75

F6
50
8B
83
57
A2
00
F4

57
A3
F8
C4
FF
40
85
75

56
AC
83
0C
15
00
C0
11

89
B2
FF
89
48
B8
74
57

75
40
FF
45
70
00
5A
E8

DC
00
89
E8
40
10
FF
D3

89
FF
7D
89
00
00
75
F9

75
15
EC
75
85
00
F8
FF

F4
4C
0F
F0
C0
39
57
FF

BB
70
84
6A
75
45
FF
85

A4
40
C3
02
07
FC
75
C0

9E
00
00
56
BB
7F
E8
59

40
56
00
6A
7C
03
E8
74

00
56
00
FC
9E
8B
4D
06

FF
6A
56
57
40
45
C9
8B

15
03
56
FF
00
FC
FF
45

60
56
56
D3
EB
8D
FF
F0

70
6A
89
89
7A
4D
89
89

[Nullsoft Install
signature = 83 EC
00 55 FF 15 84 72
E8 8D FF FF FF 8B
00 56 FF D3 E8 6A
92 40 00 56 E8 B9
FF 15 44 71 40 00
00 8B 3D 18 72 40
24 1C EB 05 56 FF
20 75 03 83 CD 02
ep_only = false

System v2:0
10 53 55 56
40 00 BE 00
1D 90 70 40
FF FF FF 85
28 00 00 57
80 3D 00 40
00 EB 09 3A
D7 8B F0 80
81 3E 4E 43

RC2]
57 C7
54 43
00 85
C0 0F
FF 15
43 00
4C 24
3E 20
52

44
00
C0
84
BC
22
13
74

24
BF
75
59
70
A3
74
F6

14
00
21
01
40
20
09
80

70
04
68
00
00
EC
50
3E

92
00
FB
00
BE
42
FF
2F

40
00
03
BE
00
00
D7
75

00
56
00
20
40
8B
8A
44

33
57
00
E4
43
C6
08
46

ED
A3
56
42
00
75
84
80

C6
A8
FF
00
50
0A
C9
3E

44
EC
15
56
56
C6
75
53

24
42
5C
FF
FF
44
F1
75

13
00
71
15
15
24
50
0C

20
FF
40
68
B8
13
FF
8A

FF
15
00
70
70
22
D7
46

15
C4
68
40
40
B8
8B
01

2C
70
68
00
00
01
F0
0C

70
40
92
68
6A
40
89
20

40
00
40
5C
00
43
74
3C

[Nullsoft Install
signature = 83 EC
00 53 FF 15 84 72
E8 8D FF FF FF 8B
00 56 FF D5 E8 6A
92 40 00 56 E8 9C
FF 15 44 71 40 00
74 24 14 56 E8 8A
38 20 74 FA 80 38
8A 48 01 80 C9 20
ep_only = false

System v2:0]
0C 53 55 56 57
40 00 BE 00 54
2D 90 70 40 00
FF FF FF 85 C0
28 00 00 57 FF
80 3D 00 40 43
23 00 00 50 FF
22 C6 44 24 14
80 F9 20 75 03

44
00
C0
84
BC
22
80
75

24
BF
75
57
70
A3
71
06

10
00
21
01
40
20
40
40

70
04
68
00
00
EC
00
C6

92
00
FB
00
BE
42
8B
44

40
00
03
BE
00
00
F8
24

00
56
00
20
40
75
89
14

33
57
00
E4
43
0A
7C
22

DB
A3
56
42
00
C6
24
80

C6
A8
FF
00
50
44
18
38

44
EC
15
56
56
24
EB
2F

24
42
5C
FF
FF
14
61
75

14
00
71
15
15
22
80
31

20
FF
40
68
B8
BE
F9
40

FF
15
00
70
70
01
20
80

15
C4
68
40
40
40
75
38

2C
70
68
00
00
43
06
53

70
40
92
68
6A
00
40
75

40
00
40
5C
00
FF
80
0E

[Nullsoft Install
signature = 83 EC
20 FF 15 28 10 40
00 22 75 08 80 C3
8B F0 8A 06 84 C0
ep_only = false

System v2:0a0]
0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3
00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41
02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74 0B 56 FF D7
75 F1 80 3E 00

C7
43
85
0F
15
00
15
20

-142-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Nullsoft Install System v2:0b2; v2:0b3]

signature = 83 EC 0C 53 55 56 57 FF 15 ?? 70 40 00 8B 35 ?? 92 40 00 05 E8 03 00 00 89 44 24
14 B3 20 FF 15 2C 70 40 00 BF 00 04 00 00 68 ?? ?? ?? 00 57 FF 15 ?? ?? 40 00 57 FF 15
ep_only = true
[Nullsoft Install
signature = 83 EC
00 BD 00 04 00 00
BF 80 92 79 00 56
50 E8 78 29 00 00
14 58 91 40 00 E9
ep_only = false

System v2:0b4]
14 83 64 24 04
56 55 FF 15 C4
57 E8 15 26 00
56 E8 47 2B 00
72 02 00 00 57

[Nullsoft Install
signature = 83 EC
00 55 FF 15 88 72
E8 9F FF FF FF 8B
00 56 FF D3 E8 7C
91 40 00 56 E8 FE
FF 15 44 71 40 00
00 8B 3D 10 72 40
24 1C EB 05 56 FF
20 75 03 83 CD 02
ep_only = false

System v2:0b4]
10 53 55 56 57
40 00 BE 00 D4
1D 90 70 40 00
FF FF FF 85 C0
27 00 00 57 FF
80 3D 00 C0 42
00 EB 09 3A 4C
D7 8B F0 80 3E
81 3E 4E 43 52

[Nullsoft PiMP Install System

signature = 83 EC 0C 53 56 57
20 FF 15 28 ?? 40 00 68 00 04
00 22 75 08 80 C3 02 BE ?? ??
ep_only = false

00
70
00
00
FF

53
40
85
6A
15

55
00
C0
00
24

56
56
75
56
71

57
E8
38
FF
40

C6
7D
68
D3
00

44
2B
F8
56
68

24
00
91
57
EC

13
00
40
E8
91

20
8B
00
EA
40

FF
1D
55
25
00

15
8C
56
00
57

30
70
FF
00
E8

70
40
15
85
43

40
00
60
C0

00
6A
71
75

BE
00
40
0D

00
56
00
C7

20
FF
03
44

7A
D3
C6
24

C7
42
85
0F
15
00
24
20

44
00
C0
84
BC
22
13
74

24
BF
75
59
70
A3
74
F6

14
00
21
01
40
E0
09
80

F0
04
68
00
00
6E
50
3E

91
00
FB
00
BE
42
FF
2F

40
00
03
BE
00
00
D7
75

00
56
00
E0
C0
8B
8A
44

33
57
00
66
42
C6
08
46

ED
A3
56
42
00
75
84
80

C6
60
FF
00
50
0A
C9
3E

44
6F
15
56
56
C6
75
53

24
42
60
FF
FF
44
F1
75

13
00
71
15
15
24
50
0C

20
FF
40
68
B8
13
FF
8A

FF
15
00
70
70
22
D7
46

15
C4
68
40
40
B8
8B
01

2C
70
E4
00
00
01
F0
0C

70
40
91
68
6A
C0
89
20

40
00
40
D8
00
42
74
3C

1:x]
FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3
00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ??
?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74

[Nullsoft PIMP Install System v1:3x]

signature = 55 8B EC 81 EC ?? ?? 00 00 56 57 6A ?? BE ?? ?? ?? ?? 59 8D BD
ep_only = true
[Nullsoft PIMP Install System v1:x]
signature = 83 EC 5C 53 55 56 57 FF 15 ?? ?? ?? 00
ep_only = true
[Nullsoft PiMP Install System
signature = 83 EC 0C 53 56 57
20 FF 15 28 ?? 40 00 68 00 04
00 22 75 08 80 C3 02 BE ?? ??
8B F0 8A 06 84 C0 75 F1 80 3E
?? ?? ?? 80 3E 2F
ep_only = false

v1:x]
FF 15
00 00
?? 00
00 74

??
FF
8A
05

??
15
06
56

40
??
8B
FF

00
??
3D
D7

05
40
??
8B

E8
00
??
F0

03
50
40
89

00
56
00
74

00
FF
84
24

BE
15
C0
14

??
??
74
??

??
??
??
??

[Nullsoft PiMP Install System]

signature = 83 EC ?? 53 55 56
ep_only = false
[NX PE Packer v1:0]
signature = FF 60 FF CA FF 00 BA DC 0D E0 40 00 50 00 60 00 70 00 80 00
ep_only = true
[Obsidium 1:2:0:0 -> Obsidium Software]
signature = EB 02 ?? ?? E8 3F 1E 00 00
ep_only = true
[Obsidium 1:2:5:0 -> Obsidium Software]
signature = E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00
-143-

??
40
3A
??

00
00
C3
??

89
80
74
??

44
3D
0B
??

24
??
56
??

10
??
FF
??

B3
??
D7
??

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[Obsidium 1:2:5:0 -> Obsidium Software]
signature = E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67
89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8
2B 13 00 00
ep_only = true
[Obsidium 1:2:5:8
signature = EB 01
B8 00 00 00 24 EB
00 00 EB 01 ?? 64
?? ?? 8B 00 EB 03
?? ?? EB 03 ?? ??
C4 04 EB 01 ?? E8
ep_only = true

->
??
04
67
??
??
7B

Obsidium
E8 29 00
?? ?? ??
89 26 00
?? ?? C3
EB 01 ??
21 00 00

Software]
00 00 EB 02
?? 33 C0 EB
00 EB 03 ??
EB 01 ?? E9
58 EB 01 ??

[Obsidium 1:2:5:8
signature = EB 01
B8 00 00 00 24 EB
00 00 EB 01 ?? 64
ep_only = true

->
??
04
67

Obsidium
E8 29 00
?? ?? ??
89 26 00

Software]
00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82
?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36
00 EB 03 ?? ?? ?? EB 01 ?? 50 EB 03 ?? ?? ?? 33 C0

[Obsidium 1:3:0:0
signature = EB 04
82 B8 00 00 00 22
64 67 FF 36 00 00
ep_only = false

->
25
EB
EB

Obsidium
80 34 CA
02 F2 7F
04 0D F6

Software
E8 29 00
33 C0 EB
A8 7F 64

[Obsidium 1:3:0:0
signature = EB 04
82 B8 00 00 00 22
64 67 FF 36 00 00
?? ?? 33 C0 EB 02
FF FF EB 02 ?? ??
83 C4 04 EB 02 ??
ep_only = true

->
??
EB
EB
??
EB
??

Obsidium
?? ?? ??
02 ?? ??
04 ?? ??
?? 8B 00
03 ?? ??
E8 47 26

Software]
E8 29 00 00
33 C0 EB 04
?? ?? 64 67
EB 01 ?? C3
?? 58 EB 04
00 00

??
02
??
FA
EB

??
??
??
00
02

EB
??
EB
00
??

01
C3
01
00
??

??
EB
??
EB
64

8B
02
50
02
67

54
??
EB
??
8F

24
??
03
??
06

0C
EB
??
E8
00

EB
03
??
D5
00

04
??
??
FF
EB

??
??
33
FF
04

??
??
C0
FF
??

??
64
EB
EB
??

??
67
04
04
??

83
FF
??
??
??

82
36
??
??
83

(h)]
00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83
04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8
67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B

[Obsidium 1:3:0:13 -> Obsidium Software]

signature = EB 01 ?? E8 26 00 00 00 EB 02
00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ??
EB 02 ?? ?? 64 67 89 26 00 00 EB 01 ?? EB
EB 02 ?? ?? C3 EB 02 ?? ?? E9 FA 00 00 00
58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67
E8 13 26 00 00
ep_only = true

00
??
89
EB
??

EB
??
26
04
??

02
??
00
??
??

??
??
00
??
??

??
C3
EB
??
EB

EB
EB
04
??
01

01
04
??
E9
??

??
??
??
FA
64

8B
??
??
00
67

54
??
??
00
8F

24
??
EB
00
06

0C
EB
01
EB
00

EB
04
??
01
00

02
??
50
??
EB

??
??
EB
E8
02

??
??
03
D5
??

83
??
??
FF
??

??
??
03
EB
8F

??
C3
??
01
06

EB
EB
??
??
00

02
01
??
E8
00

??
??
50
D5
EB

??
EB
EB
FF
03

8B
04
01
FF
??

54
??
??
FF
??

24
??
33
EB
??

0C
??
C0
03
83

EB
??
EB
??
C4

01
64
03
??
04

??
67
??
??
EB

83
FF
??
EB
03

82
36
??
02
??

B8
00
8B
??
??

00
00
00
??
??

[Obsidium 1:3:0:13 -> Obsidium Software]

signature = EB 01 ?? E8 26 00 00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00
00 00 21 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00
EB 02 ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 01 ?? 33 C0 EB 03
ep_only = true
[Obsidium 1:3:0:17 -> Obsidium software]
signature = EB 02 ?? ?? E8 28 00 00 00 EB
B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ??
00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ??
02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 01
04 ?? ?? ?? ?? EB 02 ?? ?? 58 EB 03 ?? ??
C4 04 EB 02 ?? ?? E8 4F 26 00 00
ep_only = true

04
??
??
??
??

??
??
EB
E9
EB

??
C3
04
FA
01

-144-

??
EB
??
00
??

??
03
??
00
64

EB
??
??
00
67

01
??
??
EB
8F

??
??
50
03
06

8B
EB
EB
??
00

54
02
04
??
00

24
??
??
??
EB

0C
??
??
E8
04

EB
64
??
D5
??

01
67
??
FF
??

??
FF
33
FF
??

83
36
C0
FF
??

82
00
EB
EB
83

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Obsidium 1:3:0:17 -> Obsidium software]

signature = EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82
B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00
00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04
ep_only = true
[Obsidium 1:3:0:21 -> Obsidium Software]
signature = EB 03 ?? ?? ?? E8 2E 00 00 00
04 ?? ?? ?? ?? 83 82 B8 00 00 00 23 EB 01
?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89
EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB
FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 ?? ??
?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 2B 26
ep_only = true
[Obsidium 1:3:0:37 -> Obsidium Software]
signature = EB 02 ?? ?? E8 26 00 00 00 EB
83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02
00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB
8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ??
?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03
?? ?? ?? E8 23 27 00 00
ep_only = true

EB
??
26
03
??
00

04
33
00
??
??
00

??
C0
00
??
EB

??
EB
EB
??
04

??
04
02
E9
??

??
??
??
FA
??

EB
??
??
00
??

04
??
EB
00
??

??
??
02
00
64

??
C3
??
EB
67

??
EB
??
04
8F

??
03
50
??
06

8B
??
EB
??
00

54
??
01
??
00

24
??
??
??
EB

0C
EB
33
E8
03

EB
02
C0
D5
??

03
??
03
E9
??

??
??
??
FA
??

??
C3
??
00
??

??
EB
??
00
64

EB
01
50
00
67

01
??
EB
EB
8F

??
EB
03
03
06

8B
04
??
??
00

54
??
??
??
00

24
??
??
??
EB

0C
??
33
E8
01

EB
??
C0
D5
??

04
64
EB
FF
83

??
67
03
FF
C4

??
FF
??
FF
04

??
36
??
EB
EB

??
00
??
04
03

[Obsidium 1:3:0:4
signature = EB 02
B8 00 00 00 23 EB
EB 03 ?? ?? ?? 64
ep_only = false

->
??
01
67

Obsidium
?? E8 25
?? 33 C0
89 26 00

Software
00 00 00
EB 02 ??
00 EB 02

(h)]
EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82
?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00
?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01

[Obsidium 1:3:1:1
signature = EB 02
B8 00 00 00 22 EB
EB 04 ?? ?? ?? ??
8B 00 EB 03 ?? ??
?? ?? ?? 58 EB 03
ep_only = true

->
??
04
64
??
??

Obsidium
?? E8 27
?? ?? ??
67 89 26
C3 EB 01
?? ?? EB

Software]
00 00 00 EB
?? 33 C0 EB
00 00 EB 01
?? E9 FA 00
01 ?? 64 67

02
01
??
00
8F

??
??
EB
00
06

??
C3
03
EB
00

EB
EB
??
03
00

03
02
??
??
EB

??
??
??
??
01

??
??
50
??
??

??
EB
EB
E8
83

8B
02
03
D5
C4

54
??
??
FF
04

24
??
??
FF
EB

0C
64
??
FF
03

EB
67
33
EB

01
FF
C0
01

??
36
EB
??

83
00
01
EB

82
00
??
03

[Obsidium 1:3:2:2
signature = EB 04
02 ?? ?? 83 82 B8
64 67 FF 36 00 00
C0 EB 04 ?? ?? ??
D5 FF FF FF EB 02
C4 04 EB 04
ep_only = true

->
??
00
EB
??
??

Obsidium
?? ?? ??
00 00 26
02 ?? ??
8B 00 EB
?? EB 04

Software]
E8 2A 00 00
EB 04 ?? ??
64 67 89 26
02 ?? ?? C3
?? ?? ?? ??

00
??
00
EB
58

EB
??
00
03
EB

03
33
EB
??
01

??
C0
02
??
??

??
EB
??
??
EB

??
02
??
E9
01

EB
??
EB
FA
??

04
??
01
00
64

??
C3
??
00
67

??
EB
50
00
8F

??
01
EB
EB
06

??
??
04
04
00

8B
EB
??
??
00

54
03
??
??
EB

24
??
??
??
01

0C
??
??
??
??

EB
??
33
E8
83

[Obsidium 1:3:3:1
signature = EB 01
B8 00 00 00 24 EB
00 EB 04 ?? ?? ??
?? 8B 00 EB 03 ??
EB 04 ?? ?? ?? ??
?? ?? E8 5F 27 00
ep_only = true

->
??
04
??
??
58
00

Obsidium
E8 29 00
?? ?? ??
64 67 89
?? C3 EB
EB 02 ??

Software]
00 00 EB 02
?? 33 C0 EB
26 00 00 EB
03 ?? ?? ??
?? EB 04 ??

??
02
01
E9
??

??
??
??
FA
??

EB
??
EB
00
??

03
C3
02
00
64

??
EB
??
00
67

??
02
??
EB
8F

??
??
50
02
06

8B
??
EB
??
00

54
EB
01
??
00

24
02
??
E8
EB

0C
??
33
D5
01

EB
??
C0
FF
??

02
64
EB
FF
83

??
67
04
FF
C4

??
FF
??
EB
04

83
36
??
01
EB

82
00
??
??
02

[Obsidium 1:3:3:2
signature = EB 01
B8 00 00 00 24 EB
00 00 EB 03 ?? ??
8B 00 EB 02 ?? ??
?? ?? EB 01 ?? 58

->
??
04
??
C3
EB

Obsidium
E8 2B 00
?? ?? ??
64 67 89
EB 04 ??
01 ?? EB

Software]
00 00 EB 02
?? 33 C0 EB
26 00 00 EB
?? ?? ?? E9
02 ?? ?? 64

??
04
01
FA
67

??
??
??
00
8F

EB
??
EB
00
06

02
??
02
00
00

??
??
??
EB
00

??
C3
??
03
EB

8B
EB
50
??
02

54
02
EB
??
??

24
??
02
??
??

0C
??
??
E8
83

EB
EB
??
D5
C4

03
01
33
FF
04

??
??
C0
FF
EB

??
64
EB
FF
02

??
67
02
EB
??

83
FF
??
03
??

82
36
??
??
E8

-145-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

3B 27 00 00
ep_only = true
[Obsidium 1:3:3:2
signature = EB 01
B8 00 00 00 24 EB
00 00 EB 03 ?? ??
ep_only = true

->
??
04
??

Obsidium
E8 2B 00
?? ?? ??
64 67 89

Software]
00 00 EB 02 ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82
?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36
26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 02 ?? ?? 33 C0

[Obsidium 1:3:3:3
signature = EB 02
82 B8 00 00 00 28
00 00 EB 04 ?? ??
33 C0 EB 01 ?? 8B
FF FF EB 04 ?? ??
?? ?? ?? ?? 83 C4
ep_only = true

->
??
EB
??
00
??
04

Obsidium
?? E8 29
03 ?? ??
?? 64 67
EB 03 ??
?? EB 04
EB 04 ??

Software
00 00 00
?? 33 C0
89 26 00
?? ?? C3
?? ?? ??
?? ?? ??

[Obsidium 1:3:3:3
signature = EB 02
82 B8 00 00 00 28
00 00 EB 04 ?? ??
ep_only = true

->
??
EB
??

Obsidium
?? E8 29
03 ?? ??
?? 64 67

Software]
00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83
?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36
89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04

[Obsidium 1:3:3:3
signature = EB 02
?? B8 00 00 00 28
00 00 EB 04 ?? ??
33 C0 EB 01 ?? 8B
FF FF EB 04 ?? ??
?? ?? ?? ?? 83 C4
ep_only = true

->
??
EB
??
00
??
04

Obsidium
?? E8 29
03 ?? ??
?? 64 67
EB 03 ??
?? EB 04
EB 04 ??

Software]
00 00 00 EB
?? 33 C0 EB
89 26 00 00
?? ?? C3 EB
?? ?? ?? ??
?? ?? ?? E8

03
01
EB
03
58
2B

??
??
02
??
EB
27

??
C3
??
??
01
00

??
EB
??
??
??
00

EB
04
EB
E9
EB

03
??
04
FA
03

??
??
??
00
??

??
??
??
00
??

??
??
??
00
??

8B
EB
??
EB
64

??
02
50
03
67

24
??
EB
??
8F

0C
??
04
??
06

EB
64
??
??
00

01
67
??
E8
00

??
FF
??
D5
EB

83
36
??
FF
04

[Obsidium 1:3:3:4
signature = EB 02
83 82 B8 00 00 00
00 EB 02 ?? ?? 64
8B 00 EB 04 ?? ??
?? EB 03 ?? ?? ??
ep_only = true

->
??
25
67
??
58

Obsidium
?? E8 29
EB 02 ??
89 26 00
?? C3 EB
EB 02 ??

Software]
00 00 00 EB
?? 33 C0 EB
00 EB 02 ??
03 ?? ?? ??
?? EB 03 ??

03
02
??
E9
??

??
??
EB
FA
??

??
??
04
00
64

??
C3
??
00
67

EB
EB
??
00
8F

02
03
??
EB
06

??
??
??
02
00

??
??
50
??
00

8B
??
EB
??
EB

54
EB
02
E8
03

24
01
??
D5

0C
??
??
FF

EB
64
33
FF

03
67
C0
FF

??
FF
EB
EB

??
36
01
02

??
00
??
??

[Obsidium 1:3:3:6
signature = EB 04
83 82 B8 00 00 00
67 FF 36 00 00 EB
ep_only = true

->
??
26
04

Obsidium
?? ?? ??
EB 04 ??
?? ?? ??

Software]
E8 28 00 00 00 EB 01 ?? ?? ?? ?? ?? ?? ?? 8B 54 24 0C EB 01 ??
?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64
?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04

[Obsidium 1:3:3:6
signature = EB 04
83 82 B8 00 00 00
67 FF 36 00 00 EB
?? 33 C0 EB 02 ??
?? E8 D5 FF FF FF
EB 04
ep_only = true

->
??
26
04
??
EB

Obsidium
?? ?? ??
EB 04 ??
?? ?? ??
8B 00 EB
01 ?? EB

Software]
E8 28 00 00
?? ?? ?? 33
?? 64 67 89
04 ?? ?? ??
03 ?? ?? ??

??
??
EB
04
??

??
C3
03
??
??

??
EB
??
??
EB

??
03
??
??
04

??
??
??
??
??

??
??
EB
E9
??

??
??
04
FA
??

8B
EB
??
00
??

54
04
??
00
64

24
??
??
00
67

0C
??
??
EB
8F

EB
??
50
03
06

01
??
EB
??
00

??
64
01
??
00

[Obsidium 1:3:3:7
signature = EB 02
82 B8 00 00 00 23
00 EB 04 ?? ?? ??
EB 04 ?? ?? ?? ??
01 ?? 58 EB 04 ??

(2007:06:23) -> Obsidium Software]

?? ?? E8 27 00 00 00 EB 03 ?? ?? ??
EB 03 ?? ?? ?? 33 C0 EB 02 ?? ?? C3
?? 64 67 89 26 00 00 EB 01 ?? EB 01
C3 EB 02 ?? ?? E9 FA 00 00 00 EB 04
?? ?? ?? EB 01 ?? 64 67 8F 06 00 00

EB
EB
??
??
EB

01
01
50
??
02

??
??
EB
??
??

8B
EB
02
??
??

54
03
??
E8
83

24
??
??
D5
C4

0C
??
33
FF
04

EB
??
C0
FF
EB

03
64
EB
FF
01

??
67
01
EB
??

??
FF
??
01
E8

??
36
8B
??
F7

83
00
00
EB
26

* Sign:By:haggar]
EB 03 ?? ?? ?? EB
EB 01 ?? C3 EB 04
00 EB 02 ?? ?? EB
EB 03 ?? ?? ?? E9
?? 58 EB 01 ?? EB
E8 2B 27

00
C0
26
??
58

EB
EB
00
C3
EB

01
01
00
EB
02

-146-

03
??
04
FA
03

??
??
??
00
??

??
??
??
00
??

??
??
??
00
??

8B
EB
??
EB
64

54
02
50
03
67

24
??
EB
??
8F

0C
??
04
??
06

EB
64
??
??
00

01
67
??
E8
00

??
FF
??
D5
EB

83
36
??
FF
04

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

00 00
ep_only = true
[Obsidium 1:3:3:7
signature = EB 02
?? ?? 83 82 B8 00
64 67 FF 36 00 00
33 C0 EB 02 ?? ??
D5 FF FF FF EB 02
00 EB 01 ?? 83 C4
ep_only = true

->
??
00
EB
8B
??
04

Obsidium
?? E8 2C
00 27 EB
04 ?? ??
00 EB 04
?? EB 04
EB 03 ??

Software]
00 00 00 EB
04 ?? ?? ??
?? ?? 64 67
?? ?? ?? ??
?? ?? ?? ??
?? ?? E8 23

[Obsidium 1:3:3:8
signature = EB 04
83 82 B8 00 00 00
00 00 EB 03 ?? ??
ep_only = true

->
??
??
??

Obsidium
?? ?? ??
EB 04 ??
64 67 89

Software]
E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ??
?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36
26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04

[Obsidium 1:3:3:8
signature = EB 04
83 82 B8 00 00 00
00 00 EB 03 ?? ??
?? ?? 8B 00 EB 03
02 ?? ?? EB 04 ??
?? 83 C4 04 EB 04
ep_only = true

->
??
??
??
??
??
??

Obsidium
?? ?? ??
EB 04 ??
64 67 89
?? ?? C3
?? ?? 58
?? ?? ??

Software]
E8 28 00 00
?? ?? ?? 33
26 00 00 EB
EB 03 ?? ??
EB 04 ?? ??
E8 57 27 00

[Obsidium 1:3:3:9
signature = EB 02
83 82 B8 00 00 00
FF 36 00 00 EB 03
ep_only = true

->
??
28
??

Obsidium
?? E8 29
EB 02 ??
?? ?? 64

Software]
00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ??
?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67
67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03

[Obsidium 1:3:3:9
signature = EB 02
83 82 B8 00 00 00
FF 36 00 00 EB 03
?? ?? ?? 8B 00 EB
FF FF EB 02 ?? ??
03 ?? ?? ?? 83 C4
ep_only = true

->
??
28
??
04
EB
04

Obsidium
?? E8 29
EB 02 ??
?? ?? 64
?? ?? ??
04 ?? ??
EB 04 ??

Software]
00 00 00 EB
?? 33 C0 EB
67 89 26 00
?? C3 EB 04
?? ?? 58 EB
?? ?? ?? E8

[Obsidium 1:3:4:1
signature = EB 01
83 82 B8 00 00 00
00 EB 01 ?? 64 67
ep_only = true

->
??
21
89

Obsidium
E8 2A 00
EB 02 ??
26 00 00

Software]
00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ??
?? 33 C0 EB 03 ?? ?? ?? C3 EB 02 ?? ?? EB 01 ?? 64 67 FF 36 00
EB 02 ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33

[Obsidium 1:3:4:1
signature = EB 01
83 82 B8 00 00 00
00 EB 01 ?? 64 67
?? 8B 00 EB 04 ??
EB 01 ?? 58 EB 03
02 ?? ?? E8 C3 27
ep_only = true

->
??
21
89
??
??
00

Obsidium
E8 2A 00
EB 02 ??
26 00 00
?? ?? C3
?? ?? EB
00

Software]
00 00 EB 04
?? 33 C0 EB
EB 02 ?? ??
EB 02 ?? ??
04 ?? ?? ??

04
??
89
C3
58
27

00
C0
02
??
??
00

03
02
00
??
03
CF

??
03
EB
E9
??

??
33
26
EB
EB
00

EB
EB
??
E9
??

??
??
EB
??
??
27

??
??
03
FA
64

??
C0
00
02
04
00

01
03
??
FA
EB

??
??
01
??
??
00

??
??
??
00
67

[Obsidium v1:0:0:59 Final]

signature = E8 AB 1C
ep_only = true
[Obsidium v1:0:0:61]
-147-

??
EB
00
??
??

??
??
EB
00
02

??
C3
??
??
??
00

??
??
??
00
8F

??
02
EB
??
??

EB
??
01
00
??

EB
EB
EB
E9
EB

EB
C3
??
00
06

EB
??
03
E9
??

01
??
??
00
??

01
03
01
FA
04

02
EB
50
EB
00

04
??
??
FA
??

??
C3
50
EB
64

??
??
??
00
??

??
02
EB
02
00

??
C3
??
00
EB

8B
EB
EB
03
67

8B
??
50
00
??

??
??
04
??
EB

??
EB
??
00
03

54
01
04
??
8F

54
??
EB
00
??

8B
??
??
??
04

??
02
EB
00
??

24
??
??
??
06

24
EB
03
EB
??

54
EB
??
E8
??

??
??
01
EB
??

0C
EB
??
??
00

0C
04
??
03
64

24
01
??
D5
??

8B
??
??
04
??

EB
01
??
E8
00

EB
??
??
??
67

0C
??
??
FF
??

54
EB
50
??
64

04
??
??
D5
EB

04
??
??
??
8F

EB
64
33
FF
??

24
03
EB
??
67

??
64
33
FF
04

??
??
33
??
06

03
67
C0
FF
83

0C
??
02
??
8F

??
67
C0
FF
??

??
??
C0
E8
00

??
FF
EB
EB
C4

EB
??
??
??
06

??
FF
EB
FF
??

??
64
EB
D5
00

??
36
02
01
04

02
??
??
E8
00

??
36
02
EB
??

??
67
03
FF
EB

??
00
??
??
EB

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = E8 AF 1C 00 00
ep_only = true
[Obsidium v1:1:1:1]
signature = EB 02 ?? ?? E8 E7 1C 00 00
ep_only = true
[Obsidium V1:2 -> Obsidium Software]
signature = EB 02 ?? ?? E8 77 1E 00 00
ep_only = true
[Obsidium V1:2:5:8 -> Obsidium Software]
signature = EB 01 ?? E8 ?? 00 00 00
ep_only = true
[Obsidium V1:2:5:8-V1:3:3:X -> Obsidium Software > Sign by fly]
signature = EB 01 ?? E8 ?? 00 00 00 EB 02 ?? ?? EB
ep_only = true
[Obsidium V1:2:X -> Obsidium Software * Sign:By:fly]
signature = E8 0E 00 00 00 33 C0 8B 54 24 0C 83 82 B8 00 00 00 0D C3 64 67 FF 36 00 00 64 67
89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8
2B 13 00 00
ep_only = true
[Obsidium V1:25 -> Obsidium Software]
signature = E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3
ep_only = true
[Obsidium v1:3:0:0 -> Obsidium Software (h)]
signature = EB 04 25 80 34 CA E8 29 00 00 00
82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65
64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89
0B 93 33 C0 EB 02 28 B9 8B 00 EB 01 04 C3 EB
FF FF EB 02 2B 49 EB 03 7C 3E 76 58 EB 04 B8
83 C4 04 EB 02 A9 CB E8 47 26 00 00
ep_only = true

EB
7E
26
04
94

02
14
00
65
92

C1
79
00
B3
56

81
C3
EB
54
EB

EB
EB
04
0A
01

01
04
8D
E9
72

3A
05
68
FA
64

8B
AD
C7
00
67

54
7F
FB
00
8F

24
45
EB
00
06

0C
EB
01
EB
00

EB
04
6B
01
00

02
05
50
A2
EB

32
65
EB
E8
02

92
0B
03
D5
23

83
E8
8A
FF
72

[Obsidium V1:3:0:0 -> Obsidium Software]

signature = EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 02 ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83
82 B8 00 00 00 22 EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ??
64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 01
ep_only = true
[Obsidium V1:3:0:0 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 ?? 00 00 00
ep_only = true
[Obsidium V1:3:0:0 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 29 00 00 00
ep_only = true
[Obsidium v1:3:0:37 -> Obsidium Software (h)]
signature = EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ??
83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00
00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB
ep_only = true
[Obsidium v1:3:0:37 -> Obsidium Software (h)]
signature = EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ??
83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00
00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ??
-148-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04
?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03
?? ?? ?? E8 23 27
ep_only = true
[Obsidium v1:3:0:4 -> Obsidium Software (h)]
signature = EB 02 ?? ?? E8 25 00 00 00 EB 04
B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3
EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ??
?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ??
58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06
00 00
ep_only = true

??
EB
EB
E8
00

??
02
01
D5
00

??
??
??
FF
EB

??
??
50
FF
03

EB
EB
EB
FF
??

01
04
01
EB
??

??
??
??
03
??

8B
??
33
??
83

54
??
C0
??
C4

24
??
EB
??
04

0C
64
01
EB
EB

EB
67
??
04
01

01
FF
8B
??
??

??
36
00
??
E8

83
00
EB
??
3B

82
00
01
??
26

[Obsidium V1:3:0:4 -> Obsidium Software]

signature = EB 02 ?? ?? E8 ?? 00 00 00
ep_only = true
[Obsidium V1:3:0:X -> Obsidium Software > Sign by fly]
signature = EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B ?? ?? ?? EB
04 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3
ep_only = true
[Obsidium V1:3:1:1 -> Obsidium Software]
signature = EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82
B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00
EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33
ep_only = true
[Obsidium V1:3:2:2 -> Obsidium Software]
signature = EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB
02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ??
64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04
ep_only = true
[Obsidium v1:3:3:1 -> Obsidium Software (h)]
signature = EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82
B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00
00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB
ep_only = true
[Obsidium V1:3:3:3 -> Obsidium Software]
signature = EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B ?? 24 0C EB 01 ?? 83
?? B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36
00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04
ep_only = true
[Obsidium V1:3:3:4 -> Obsidium Software]
signature = EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ??
83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00
00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33
ep_only = true
[Obsidium V1:3:3:7 -> Obsidium Software]
signature = EB 02 ?? ?? E8 2C 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02
?? ?? 83 82 B8 00 00 00 27 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 03 ?? ?? ??
64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 01 ?? 50
ep_only = true
[Obsidium V1:3:4:2 -> Obsidium Software&nbsp= &nbsp=* Sign:By:fly]
signature = EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82
B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB
-149-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

03 ?? ?? ?? 64
?? ?? ?? 8B 00
EB 01 ?? EB 03
?? ?? 83 C4 04
ep_only = true

67
EB
??
EB

89
03
??
01

26
??
??
??

00
??
58
E8

04 August 2015 15:14

00
??
EB
C3

EB
C3
04
27

03
EB
??
00

?? ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 03
03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF
?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ??
00

[Obsidium V1:3:5:0 -> Obsidium Software *

signature = EB 03 ?? ?? ?? E8 ?? ?? ?? ??
?? ?? ?? 83 82 B8 00 00 00 20 EB 03 ?? ??
67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26
?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ??
?? ?? ?? EB 01 ?? EB 02 ?? ?? 58 EB 04 ??
83 C4 04 EB 01 ?? E8
ep_only = true

Sign:By:fly]
EB 02 ?? ?? EB
?? 33 C0 EB 01
00 00 EB 01 ??
?? ?? C3 EB 02
?? ?? ?? EB 02

04
??
EB
??
??

??
C3
04
??
??

??
EB
??
E9
64

??
02
??
FA
67

??
??
??
00
8F

8B
??
??
00
06

54
EB
50
00
00

24
03
EB
EB
00

0C
??
04
01
EB

EB
??
??
??
02

04
??
??
E8
??

??
64
??
??
??

[Obsidium V1:3:5:2 -> Obsidium Software *

signature = EB 04 ?? ?? ?? ?? E8 28 00 00
00 00 00 25 EB 03 ?? ?? ?? 33 C0 EB 04 ??
00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00
C0 EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 03 ??
FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04
03 ?? ?? ?? 83 C4 04 EB 03 ?? ?? ?? E8
ep_only = true

Sign:By:fly]
00 EB 01 ?? EB
?? ?? ?? C3 EB
EB 02 ?? ?? EB
?? ?? E9 FA 00
?? ?? ?? ?? EB

01
04
03
00
04

??
??
??
00
??

8B
??
??
EB
??

54
??
??
04
??

24
??
50
??
??

0C
EB
EB
??
64

EB
01
04
??
67

01
??
??
??
8F

??
64
??
E8
06

83
67
??
D5
00

82
FF
??
FF
00

B8
36
33
FF
EB

[Obsidium V1:3:5:3 -> Obsidium Software *

signature = EB 02 ?? ?? E8 2B 00 00 00 EB
?? 83 82 B8 00 00 00 24 EB 02 ?? ?? 33 C0
67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89
04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04
?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01
00 00 EB 03 ?? ?? ?? 83 C4 04 EB 02 ?? ??
ep_only = true

Sign:By:fly
04 ?? ?? ??
EB 02 ?? ??
26 00 00 EB
?? ?? ?? ??
?? 58 EB 03
E8

* 20080120]
?? EB 02 ??
C3 EB 04 ??
04 ?? ?? ??
C3 EB 03 ??
?? ?? ?? EB

??
??
??
??
04

8B
??
EB
??
??

54
??
04
E9
??

24
EB
??
FA
??

0C
03
??
00
??

EB
??
??
00
64

03
??
??
00
67

??
??
50
EB
8F

??
64
EB
04
06

[Obsidium V1:3:5:4 -> Obsidium Software *

signature = EB 03 ?? ?? ?? E8 2D 00 00 00
?? ?? 83 82 B8 00 00 00 25 EB 03 ?? ?? ??
64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89
C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3
FF FF EB 03 ?? ?? ?? EB 02 ?? ?? 58 EB 04
?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 5B
ep_only = true

Sign:By:fly
EB 04 ?? ??
33 C0 EB 04
26 00 00 EB
EB 01 ?? E9
?? ?? ?? ??
28 00 00

* 200800207]
?? ?? EB 01 ??
?? ?? ?? ?? C3
03 ?? ?? ?? EB
FA 00 00 00 EB
EB 03 ?? ?? ??

8B
EB
02
04
64

54
03
??
??
67

24
??
??
??
8F

0C
??
50
??
06

EB
??
EB
??
00

04
EB
01
E8
00

??
01
??
D5
EB

??
??
33
FF
03

* Sign:By:fly * 20080102]
?? ?? EB 04 ?? ?? ?? ?? 8B
C0 EB 04 ?? ?? ?? ?? C3 EB
89 26 00 00 EB 02 ?? ?? EB
C3 EB 01 ?? E9 ?? ?? ?? ??
?? ?? ?? ?? EB 04 ?? ?? ??
E8

54
03
03
EB
??

24
??
??
01
64

0C
??
??
??
67

EB
??
??
E8
8F

03
EB
50
D5
06

??
03
EB
FF
00

??
??
04
FF
00

[Obsidium V1:4:0:0:Beta
signature = EB 01 ?? E8
?? 83 82 B8 00 00 00 21
?? ?? 64 67 FF 36 00 00
?? ?? ?? ?? 33 C0 EB 02
FF EB 03 ?? ?? ?? EB 04
EB 04 ?? ?? ?? ?? 83 C4
ep_only = true

->
2F
EB
EB
??
??
04

Obsidium
00 00 00
04 ?? ??
03 ?? ??
?? 8B 00
?? ?? ??
EB 04 ??

Software
EB 03 ??
?? ?? 33
?? 64 67
EB 01 ??
58 EB 04
?? ?? ??

[Obsidium vx:x:x:x]
signature = E8 47 19
ep_only = true
[Obsiduim 1:3:0:4 -> Obsiduim Software]
signature = EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82
B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00
EB 03 ?? ?? ?? 64
ep_only = true
[ocBat2Exe 1:0 -> OC]
-150-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

signature = 55
FF 33 C0 55 68
55 EC 33 C0 E8
02 00 00 6A 02
E0 FA FF FF 83
42 0F 00 E8 61
E8 E8 04 FB ??
05 00 00 00 BA
FF
ep_only = true

8B
8A
81
6A
3D
F4
??
01

EC
3F
E9
00
60
FF
??
00

B9
40
FF
6A
99
FF
??
00

08
00
FF
EE
4F
8B
E8
00

04 August 2015 15:14

00
64
8B
57
00
45
B8
A1

00
FF
45
E8
12
E0
58
58

00
30
EC
FC
0F
B9
99
99

6A
64
E8
FA
85
12
4F
4F

00
89
41
FF
56
00
00
00

6A
20
F6
FF
02
00
E8
E8

00
6A
FF
6A
00
00
67
04

49
00
FF
00
00
BA
F3
F6

75
6A
50
68
8D
01
FF
FF

F9
00
E8
60
45
00
FF
FF

53
6A
F3
99
E4
00
33
8B

56
03
FA
4F
50
00
C0
45

57
6A
FF
00
8D
E8
A3
DC

B8
00
FF
6A
45
3B
60
BA

58
6A
8B
12
E0
F6
99
A4

3C
01
F8
68
BA
FF
4F
3F

40
68
83
18
18
FF
00
40

00
00
FF
57
57
8B
8D
00

E8
00
FF
40
40
45
45
E8

6C
00
0F
00
00
E4
DC
E3

FA
80
84
57
B9
8D
50
F4

FF
8D
83
E8
40
55
B9
FF

[Open Source Code

signature = 55 8B
FF 33 C0 55 68 9F
D8 85 DB 75 07 6A
ep_only = true

Crypter -> p0ke]

EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF
47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B
00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0

[Open Source Code

signature = 55 8B
FF 33 C0 55 68 9F
D8 85 DB 75 07 6A
01 00 00 00 B8 2C
EC B8 2C 68 40 00
40 00 E8 A2 FC FF
FF FF B8 24 67 40
24 67 40 00 E8 42
ep_only = true

Crypter -> p0ke]

EC B9 09 00 00 00
47 40 00 64 FF 30
00 E8 C2 F8 FF FF
68 40 00 E8 E1 F0
BA BC 47 40 00 E8
FF 8B D8 85 DB 0F
00 E8 7A F3 FF FF
FD FF FF 8B 55 E8

6A
64
BA
FF
54
84
8B
B8

00
89
28
FF
F2
52
D0
24

6A
20
67
BF
FF
02
8B
67

00
BA
40
0A
FF
00
C3
40

49
B0
00
00
A1
00
8B
00

75
47
8B
00
2C
B8
0D

F9
40
C3
00
68
24
20

53
00
8B
8D
40
67
67

56
B8
0D
55
00
40
40

57
1C
1C
EC
E8
00
00

B8
67
67
8B
52
8B
E8

34
40
40
C6
F3
15
77

44
00
00
E8
FF
20
E0

40
E8
E8
92
FF
67
FF

00
07
F0
FC
8B
40
FF

E8
FD
E0
FF
D0
00
8D

28
FF
FF
FF
B8
E8
55

F8
FF
FF
8B
20
78
E8

FF
8B
BE
4D
67
F4
A1

[ORiEN 2:11 (DEMO)]

signature = E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D
2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D
20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F
ep_only = false
[ORiEN 2:11 - 2:12 -> Fisun Alexander]
signature = E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D
2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D
20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F
ep_only = false
[ORiEN V1:X-V2:X -> Fisun A:V: > Sign by fly]
signature = 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74
65 63 74 69 6F 6E 20 73 79 73 74 65 6D
ep_only = false
[ORiEN v2:11 (DEMO)]
signature = E9 5D 01
2D 2D 2D 2D 2D 2D 2D
20 4F 52 69 45 4E 20
69 6F 6E 20 73 79 73
20 41 2E 20 46 69 73
2D 2D 2D 2D 2D 20 57
72 75 2F 20 2D 2D 2D
61 6C 65 78 66 40 68
2D 2D 2D 2D 2D 2D 2D
ep_only = true
[ORiEN v2:11 signature = E9
2D 2D 2D 2D 2D
20 4F 52 69 45
69 6F 6E 20 73

00
2D
65
74
75
57
2D
6F
2D

00
2D
78
65
6E
57
2D
74
2D

CE
2D
65
6D
2C
3A
2D
6D
2D

D1
2D
63
20
20
20
2D
61
2D

CE
2D
75
2D
31
68
0D
69

CE
2D
74
0D
39
74
0A
6C

0D
2D
61
0A
39
74
2D
2E

0A
2D
62
2D
34
70
2D
72

2D
2D
6C
2D
2D
3A
2D
75

2D
2D
65
2D
32
2F
2D
20

2D
2D
20
2D
30
2F
2D
2D

2D
2D
66
2D
30
7A
2D
2D

2D
2D
69
2D
33
61
2D
2D

2D
2D
6C
20
20
6C
2D
2D

2D
2D
65
43
2D
65
20
2D

2D
2D
73
72
2D
78
65
2D

2D
2D
20
65
2D
66
2D
2D

2D
2D
70
61
2D
2E
6D
2D

2D
2D
72
74
2D
6E
61
2D

2D
2D
6F
65
2D
61
69
0D

2D
2D
74
64
0D
72
6C
0A

2D
0D
65
20
0A
6F
3A
2D

2D
0A
63
62
2D
64
20
2D

2D
2D
74
79
2D
2E
7A
2D

2:12 -> Fisun Alexander]

5D 01 00 00 CE D1 CE ?? 0D
2D 2D 2D 2D 2D 2D 2D 2D 2D
4E 20 65 78 65 63 75 74 61
79 73 74 65 6D 20 2D 0D 0A

0A
2D
62
2D

2D
2D
6C
2D

2D
2D
65
2D

2D
2D
20
2D

2D
2D
66
2D

2D
2D
69
2D

2D
2D
6C
20

2D
2D
65
43

2D
2D
73
72

2D
2D
20
65

2D
2D
70
61

2D
2D
72
74

2D
2D
6F
65

2D
2D
74
64

2D
0D
65
20

2D
0A
63
62

2D
2D
74
79

-151-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

20 41 2E 20 46
2D 2D 2D 2D 2D
72 75 2F 20 2D
61 6C 65 78 66
2D 2D 2D 2D 2D
ep_only = true

69
20
2D
40
2D

73
57
2D
68
2D

75
57
2D
6F
2D

6E
57
2D
74
2D

04 August 2015 15:14

2C
3A
2D
6D
2D

20
20
2D
61
2D

31
68
0D
69

39
74
0A
6C

39
74
2D
2E

34
70
2D
72

2D
3A
2D
75

32
2F
2D
20

30
2F
2D
2D

30
7A
2D
2D

33
61
2D
2D

20
6C
2D
2D

2D
65
20
2D

2D
78
65
2D

2D
66
2D
2D

2D
2E
6D
2D

2D
6E
61
2D

2D
61
69
0D

0D
72
6C
0A

0A
6F
3A
2D

2D
64
20
2D

2D
2E
7A
2D

[ORiEN V2:12 -> Fisun A:V:]

signature = E9 5D 01 00 00 CE D1 CE CD 0D
ep_only = true
[Pack Master v1:0]
signature = 60 E8 01 ?? ?? ?? E8 83 C4 04 E8 01 ?? ?? ?? E9 5D 81 ED D3 22 40 ?? E8 04 02 ??
?? E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46
ep_only = true
[Pack Master v1:0]
signature = 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED D3 22 40 00 E8 04 02 00
00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46
ep_only = true
[Packanoid -> Arkanoid]
signature = BF 00 10 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8
ep_only = true
[Packanoid 1:0
signature = BF
?? ?? 00 8B 43
04 EB EE 83 C3
ep_only = true

->
00
04
08

ackanoid]
?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ??
91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2
5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00

[Packanoid 1:0
signature = BF
?? ?? 00 8B 43
04 EB EE 83 C3
?? 00 00 ?? 00
F3 A4 E9 ?? ??
00 00 00 00 E0
00 00 00 73 F6
00 00 10 C0 73
4D 11 C9 EB 1C
ep_only = true

->
00
04
08
00
??
00
31
F7
91

ackanoid]
?? 40 00 BE
91 E3 1F 51
5E EB DB B9
00 00 00 00
00 00 ?? ??
00 C0 6B 65
C9 E8 64 00
75 3F AA EB
48 C1 E0 08

??
FF
??
00
00
72
00
D4
AC

??
D6
??
00
00
6E
00
E8
E8

??
56
00
00
??
65
73
4D
2C

00
96
00
00
??
6C
1C
00

E8
8B
BE
00
00
33
31
00

9D
13
00
00
??
32
C0
00

00
8B
??
00
??
2E
E8
29

00
02
??
00
??
64
5B
D9

00
91
00
00
00
6C
00
75

B8
E3
EB
00
00
6C
00
10

??
0D
01
00
02
00
00
E8

??
52
00
00
00
FC
73
42

??
51
BF
00
00
B2
23
00

00
56
??
00
00
80
B3
00

8B
FF
??
00
00
31
02
00

30
D7
??
00
00
DB
41
EB

8B
5A
00
E0
00
A4
B0
28

78
89
EB
00
00
B3
10
AC

04
02
21
00
00
02
E8
D1

BB
83
00
C0
00
E8
4F
E8

??
C2
??
00
00
6D
00
74

[Packanoid v1 -> Arkanoid]

signature = BF ?? ?? ?? ?? BE ?? ?? ?? ?? E8 9D 00 00 00 B8 ?? ?? ?? ?? 8B 30 8B 78 04 BB ??
?? ?? ?? 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2
04 EB EE 83 C3 08
ep_only = true
[Packed with? PKLITE v1:50 with CRC check (1)]
signature = 1F B4 09 BA ?? ?? CD 21 B8 ?? ?? CD 21
ep_only = true
[PackItBitch V1:0-> archphase
signature = 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00
?? ?? ?? 00 00 00 00 00 00 4C
41 64 64 72 65 73 73 00 00 ??
00 00 00 00 00 00 00 00 00 00
ep_only = false

> Sign by fly]

00 00 00 00 00
00 00 00 4B 45
6F 61 64 4C 69
00 00 00 00 00
00 00 00

00
52
62
00

??
4E
72
??

[PackItBitch V1:0-> archphase]

-152-

??
45
61
??

??
4C
72
??

??
33
79
??

??
32
41
??

??
2E
00
??

??
44
00
??

??
4C
00
??

00
4C
47
00

00
00
65
00

00
??
74
00

00
??
50
00

00
??
72
00

00
??
6F
00

00
??
63
00

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ??
?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74
ep_only = true
[Packman 0:0:0:1 -> bubba]
signature = 60 E8 00 00 00 00 58 8D A8 ?? FE FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00
ep_only = true
[Packman 0:0:0:1 -> Bubbasoft
signature = 0F 85 ?? FF FF FF
F6 75 02 8B F7 03 F3 03 FB EB
55 04 AB 58 83 C6 04 8B 0E 85
00 ?? ?? 00 0B C0 74 34 03 C3
FA 03 75 0D 81 E5 FF 0F 00 00
?? FE FF FF 02 D2 75 05 8A 16
ep_only = false

(h)]
8D B3
1B D1
C9 75
EB 2A
03 EF
46 12

??
C1
DF
8D
03
D2

??
D1
5E
70
EB
C3

??
E9
83
08
01

??
73
C6
03
4D

EB
05
14
40
00

3D
0F
8B
04
46

8B
B7
7E
33
46

46
C9
10
ED
3B

0C
EB
85
33
F0

03
05
FF
D2
75

C3
03
75
66
DC

50
CB
BC
8B
8B

FF
8D
8D
2E
38

55
49
8B
66
85

00
02
00
0F
FF

56
50
00
A4
75

8B
51
??
EA
D0

36
50
??
04
61

0B
FF
B8
80
E9

[Packman 0:0:0:1 -> Bubbasoft]

signature = 0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B
F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF
55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00
ep_only = true
[Packman Executable Image Packer 0:0:0:1 -> bubba]
signature = 60 E8 00 00 00 00 58 8D A8 ?? ?? FF FF 8D 98 ?? ?? ?? FF
ep_only = true
[Packman V0:0:0:1 -> Bubbasoft]
signature = 60 E8 00 00 00 00 58 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ??
?? 48
ep_only = true
[Packman v0:0:0:1]
signature = 60 E8 00 00 00 00 58 8D A8 ?? ?? FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00 ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00
ep_only = true
[Packman v1:0 -> Brandon LaCombe]
signature = 60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA 8B
E8 C6 06 E9 8B 43 0C 89 46 01 6A 04 68 00 10 00 00 FF 73 08 51 FF 55 08 8B
ep_only = true
[Packman V1:0 -> Brandon LaCombe]
signature = 60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA
ep_only = true
[PACKWIN v1:01p]
signature = 8C C0 FA 8E D0 BC ?? ?? FB 06 0E 1F 2E ?? ?? ?? ?? 8B F1 4E 8B FE 8C DB 2E ?? ??
?? ?? 8E C3 FD F3 A4 53 B8 ?? ?? 50 CB
ep_only = true
[PAK-SFX Archive]
signature = 55 8B EC 83 ?? ?? A1 ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? ?? ?? 8C D7 8E C7 8D ?? ?? BE
?? ?? FC AC 3C 0D
ep_only = true
[PassCOM v2:0 / PPC]
signature = E9 J1 J1 BE ?? ?? B9 ?? ?? 87 1C EB ?? FB FA 87 ?? ?? ?? 87 ?? ?? ?? FB 1F 58 4B
EB ?? 50 1E 33 C0 8E D8 EB
ep_only = true

-153-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[PassEXE v2:0]
signature = 06 1E 0E 0E 07 1F BE ?? ?? B9 ?? ?? 87 14 81 ?? ?? ?? EB ?? C7 ?? ?? ?? 84 00 87
?? ?? ?? FB 1F 58 4A
ep_only = true
[PassLock 2000
signature = 55
E8 1F 01 00 00
44 00 00 00 C7
ep_only = true

1:0 (Eng) -> Moonlight-Software]

8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00
C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24
44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24

[PassLock 2000
signature = 55
E8 1F 01 00 00
44 00 00 00 C7
00 74 05 0F B7
61 40 00 89 43
00 72 0D 53 E8
01 75 3F E8 81
00 89 43 4C FF
66 FF 43 5A 8B
ep_only = true

v1:0 (Eng) -> Moonlight-Software]

8B EC 53 56 57 BB 00 50 40 00 66 2E
C7 43 60 01 00 00 00 8D 83 E4 01 00
44 24 2C 00 00 00 00 54 FF 15 E8 61
44 24 30 83 C4 44 89 43 56 FF 15 D0
48 6A 00 FF 15 E4 61 40 00 89 43 5C
96 00 00 00 5B FF 4B 10 FF 4B 18 5F
00 00 00 8D 83 E4 01 00 00 50 FF 15
15 D4 61 40 00 89 43 48 8B 45 08 89
45 0C 89 43 60 53

F7
00
40
61
E8
5E
F0
43

05
50
00
40
F9
5B
61
5C

34
FF
B8
00
00
5D
40
E8

20
15
0A
E8
00
50
00
9A

40
F0
00
9E
00
FF
FF
00

00
61
00
00
E8
15
15
00

04
40
00
00
AA
C8
D0
00

00
00
F7
00
00
61
61
E8

0F
83
44
89
00
40
40
4B

85
EC
24
43
00
00
00
00

98
44
2C
4C
B8
C3
E8
00

00
C7
01
FF
FF
83
3A
00

00
04
00
15
00
7D
00
72

00
24
00
D4
00
0C
00
11

[PassLock 2000 v1:0 (Eng) -> Moonlight-Software]

signature = 55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00
E8 1F 01
ep_only = true
[Password Protector (c) MiniSoft 1992]
signature = 06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA
ep_only = true
[Password Protector (c) MiniSoft 1992]
signature = E9 J1 J1 06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA
ep_only = true
[Password Protector for
signature = C8 50 01 00
00 00 55 53 45 52 33 32
61 72 61 6D 41 00 53 65
ep_only = true

the UPX 0:30 -> g0d]

60 E8 EC 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41
2E 64 6C 6C 00 44 69 61 6C 6F 67 42 6F 78 49 6E 64 69 72 65 63 74 50
6E 64 4D 65 73 73 61 67 65 41 00 45 6E 64 44 69 61 6C 6F

[Password protector my SMT]

signature = E8 ?? ?? ?? ?? 5D 8B FD 81 ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ??
?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 46 80 ?? ?? 74
ep_only = true
[Patch Creation Wizard 1:2
signature = E8 7F 03 00 00
01 50 E8 2C 03 00 00 6A 00
C1 00 00 00 6A 01 FF 35 B8
ep_only = false

Byte Patch]
6A 00 E8 24 03 00 00 A3 B8 33 40 00 6A 00 68 29 10 40 00 6A 00 6A
E8 EF 02 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85
33 40 00 E8 1B 03 00 00 50 6A 01 68 80 00 00 00 FF 75

[Patch Creation Wizard 1:2

signature = 6A 00 E8 9B 02
00 00 68 5A 31 40 00 68 12
E8 51 02 00 00 85 C0 74 31
ep_only = false

Memory Patch]
00 00 A3 7A 33 40 00 6A 00 68 8E 10 40 00 6A 00 6A 01 50 E8 B5 02
31 40 00 6A 00 6A 00 6A 04 6A 01 6A 00 6A 00 68 A2 30 40 00 6A 00
FF 35 62 31 40 00 6A 00 6A 30 E8 62 02 00 00 E8 0B 01

[Patch Creation Wizard 1:2 Seek and Destroy Patch]

signature = E8 C5 05 00 00 6A 00 E8 5E 05 00 00 A3 CE 39 40 00 6A 00 68 29 10 40 00 6A 00 6A
01 50 E8 72 05 00 00 6A 00 E8 2F 05 00 00 55 8B EC 56 51 57 8B 45 0C 98 3D 10 01 00 00 0F 85
-154-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

C1 00 00 00 6A 01 FF 35 CE 39 40 00 E8 61 05 00 00 50 6A 01 68 80 00 00 00 FF 75
ep_only = false
[Patch Creation Wizard v1:2 Byte
signature = E8 7F 03 00 00 6A 00
01 50 E8 2C 03 00 00 6A 00 E8 EF
C1 00 00 00 6A 01 FF 35 B8 33 40
00 00 68 5F 30 40 00 6A 65 FF 75
00 68 01 31 40 00 6A 66 FF 75 08
C7 05 BC 33 40 00 2C 00 00 00 C7
BC 33 40 00 6A 01 6A FF FF 35 B4
E0 33 40 00 00 30 40 00 C7 05 E4
40 00 E8 65 02 00 00 EB 5F EB 54
ep_only = false

Patch]
E8 24 03
02 00 00
00 E8 1B
08 E8 14
E8 F6 02
05 C0 33
33 40 00
33 40 00

[Patch Creation Wizard v1:2 Memory Patch]

signature = 6A 00 E8 9B 02 00 00 A3 7A 33
00 00 68 5A 31 40 00 68 12 31 40 00 6A 00
E8 51 02 00 00 85 C0 74 31 FF 35 62 31 40
5A 31 40 00 E8 22 02 00 00 FF 35 5E 31 40
30 40 00 68 FE 30 40 00 6A 00 E8 63 02 00
98 3D 10 01 00 00 75 6B 6A 01 FF 35 7A 33
08 E8 34 02 00 00 68 00 30 40 00 6A 65 FF
E8 1C 02 00 00 68 A2 30 40 00 6A 66 FF 75
40 00 68 E8 03 00 00 68 9A 02 00
ep_only = false
[Patch Creation Wizard v1:2 Seek
signature = E8 C5 05 00 00 6A 00
01 50 E8 72 05 00 00 6A 00 E8 2F
C1 00 00 00 6A 01 FF 35 CE 39 40
00 00 68 5F 30 40 00 6A 65 FF 75
00 68 01 31 40 00 6A 66 FF 75 08
C7 05 D2 39 40 00 2C 00 00 00 C7
D2 39 40 00 6A 01 6A FF FF 35 CA
F6 39 40 00 00 30 40 00 C7 05 FA
40 00 E8 AB 04 00 00 EB 5F EB 54
ep_only = false

00
55
03
03
00
40
E8
01

00
8B
00
00
00
00
97
00

A3
EC
00
00
6A
10
02
00

B8
56
50
68
00
00
00
00

33
51
6A
B0
FF
00
00
68

40
57
01
30
75
00
C7
BC

00
8B
68
40
08
C7
05
33

6A
45
80
00
E8
05
C4
40

00
0C
00
6A
C8
C4
33
00

68
98
00
67
02
33
40
6A

29
3D
00
FF
00
40
00
01

10
10
FF
75
00
00
00
6A

40
01
75
08
A3
00
00
FF

00
00
08
E8
B4
08
00
FF

6A
00
E8
05
33
00
00
35

00
0F
1D
03
40
00
C7
B4

6A
85
03
00
00
68
05
33

40
6A
00
00
00
40
75
08

00
00
6A
E8
6A
00
08
E8

6A
6A
00
53
00
E8
E8
0D

00
04
6A
02
E8
38
2B
02

68
6A
30
00
08
02
02
00

8E
01
E8
00
02
00
00
00

10
6A
62
6A
00
00
00
8B

40
00
02
00
00
50
68
45

00
6A
00
E8
55
6A
51
08

6A
00
00
22
8B
01
30
A3

00
68
E8
02
EC
68
40
7E

6A
A2
0B
00
56
80
00
33

01
30
01
00
51
00
6A
40

50
40
00
6A
57
00
67
00

E8
00
00
10
8B
00
FF
68

B5
6A
FF
68
45
FF
75
3B

02
00
35
F7
0C
75
08
11

Patch]
00 A3 CE
8B EC 56
00 00 50
00 00 68
00 6A 00
00 10 00
DD 04 00
00 00 00

39
51
6A
B0
FF
00
00
68

40
57
01
30
75
00
C7
D2

00
8B
68
40
08
C7
05
39

6A
45
80
00
E8
05
DA
40

00
0C
00
6A
0E
DA
39
00

68
98
00
67
05
39
40
6A

29
3D
00
FF
00
40
00
01

10
10
FF
75
00
00
00
6A

40
01
75
08
A3
00
00
FF

00
00
08
E8
CA
08
00
FF

6A
00
E8
4B
39
00
00
35

00
0F
63
05
40
00
C7
CA

6A
85
05
00
00
68
05
39

and Destroy
E8 5E 05 00
05 00 00 55
00 E8 61 05
08 E8 5A 05
E8 3C 05 00
05 D6 39 40
39 40 00 E8
39 40 00 01

[PC Guard for Win32 5:00 -> SofPro/Blagoje Ceklic (h)]

signature = FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB
01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35
FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C
ep_only = false
[PC Guard for Win32 v5:00 -> SofPro/Blagoje Ceklic
signature = FC 55 50 E8 00 00 00 00 5D 60 E8 03 00
01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03
FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8
40 EB 01 36 FF E0
ep_only = true

(h)]
00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB
00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35
03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35

[PC PE Encryptor Alpha preview]

signature = 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 ?? 2B 8D EE 32 40 00 83
E9 0B 89 8D F2 32 40 ?? 80 BD D1 32 40 ?? 01 0F 84
ep_only = true
[PC Shrinker v0:20]
signature = E8 E8 01 ?? ?? 60 01 AD B3 27 40 ?? 68
ep_only = true
[PC Shrinker v0:29]
-155-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = ?? BD ?? ?? ?? ?? 01 AD 55 39 40 ?? 8D B5 35 39 40
ep_only = true
[PC Shrinker v0:45]
signature = ?? BD ?? ?? ?? ?? 01 AD E3 38 40 ?? FF B5 DF 38 40
ep_only = true
[PC Shrinker v0:71]
signature = 9C 60 BD ?? ?? ?? ?? 01 AD 54 3A 40 ?? FF B5 50 3A 40 ?? 6A 40 FF 95 88 3A 40 ??
50 50 2D ?? ?? ?? ?? 89 85
ep_only = true
[PC-Guard 5:00d]
signature = FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB
01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35
FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C
ep_only = false
[PC-Guard v3:03d; v3:05d]
signature = 55 50 E8 ?? ?? ?? ?? 5D EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01
ep_only = true
[PC-Guard v4:05d; v4:10d; v4:15d]
signature = FC 55 50 E8 00 00 00 00 5D EB 01
ep_only = true
[PC-Guard v5:00d]
signature = FC 55
01 36 FF E0 0B 61
FF E0 E7 61 2B E8
40 EB 01 36 FF E0
00 D2 EB 0B 58 EB
9D E5 EA 41 00 60
E9 EA 41 00 EB 01
EA 41 00 60 E8 03
41 00 9C EB 01 D5
ep_only = true

50
B8
9C
0B
01
E8
E3
00
9D

E8
30
EB
61
48
03
60
00
EB

00
D2
01
89
40
00
E8
00
01

00
40
D5
85
EB
00
03
83
0B

00
00
9D
E1
01
00
00
EB
89

00
EB
EB
EA
35
83
00
0E

5D
01
01
41
FF
EB
00
EB

60
E3
0B
00
E0
0E
D2
01

E8
60
58
9C
E7
EB
EB
0C

03
E8
60
EB
61
01
0B
58

00
03
E8
01
89
0C
58
EB

00
00
03
D5
85
58
EB
01

00
00
00
9D
F9
EB
01
35

83
00
00
EB
EA
01
48
40

EB
D2
00
01
41
35
40
EB

0E
EB
83
0B
00
40
EB
01

EB
0B
EB
58
9C
EB
01
36

01
58
0E
EB
EB
01
35
FF

0C
EB
EB
01
01
36
FF
E0

58
01
01
E3
D5
FF
E0
0B

EB
48
0C
60
9D
E0
E7
61

01
40
58
E8
EB
0B
61
89

35
EB
EB
03
01
61
89
B5

40
01
01
00
0B
89
95
F1

EB
35
35
00
89
8D
ED
EA

[PCIENC Cryptor]
signature = 06 50 43 49 45 4E
ep_only = false
[PCPEC "alpha - preview"]
signature = 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 00
ep_only = true
[PCPEC [alpha]]
signature = 53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 8B CD 81 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 83
ep_only = true
[PCrypt v3:51]
signature = 50 43 52 59 50 54 FF 76 33 2E 35 31 00 E9
ep_only = true
[PcShare v4:0 -> ]
signature = 55 8B EC 6A FF 68 90 34 40 00 68 B6 28 40 00 64 A1
ep_only = true
[PCShrink 0:71 beta]
signature = 01 AD 54 3A 40 00 FF B5 50 3A 40 00 6A 40 FF 95 88 3A 40 00
ep_only = true

-156-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[PCShrink v0:40b]
signature = 9C 60 BD ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 6A ?? FF ?? ?? ?? ?? ??
50 50 2D
ep_only = true
[PDS graphics file format]
signature = 49 4D 41 47 45 49 44 45 4E 54 49 46 49 45 52 20
ep_only = false
[PE Crypt 1:5 -> BitShape Software]
signature = 60 E8 00 00 00 00 5D 81 ED 55 20 40 00 B9 7B 09 00 00 8D BD 9D 20 40 00 8B F7 AC
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC
ep_only = true
[PE Crypt v1:00/v1:01]
signature = E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB
ep_only = true
[PE Crypt v1:02]
signature = E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44
ep_only = false
[PE Crypt32 (Console v1:0; v1:01; v1:02)]
signature = E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB
ep_only = true
[PE Crypt32 v1:02]
signature = E8 00 00 00 00 5B 83 ?? ?? EB ?? 52 4E 44 21
ep_only = true
[PE Diminisher V0:1 -> Teraphy]
signature = 53 51 52 56 57 55 E8 00 00 00 00
ep_only = true
[PE Diminisher
signature = 53
EA 0B 00 00 00
40 00 8B 1B 8D
ep_only = true

v0:1 -> Teraphy]

51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81
89 95 9A 33 40 00 80 BD 99 33 40 00 00 74 50 E8 02 01 00 00 8B FD 8D 9D 9A 33
87

[PE Diminisher v0:1]

signature = 53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81
EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74
ep_only = true
[PE Diminisher v0:1]
signature = 5D 8B D5 81 ED A2 30 40 ?? 2B 95 91 33 40 ?? 81 EA 0B ?? ?? ?? 89 95 9A 33 40 ??
80 BD 99
ep_only = true
[PE Intro v1:0]
signature = 8B 04 24 9C 60 E8 ?? ?? ?? ?? 5D 81 ED 0A 45 40 ?? 80 BD 67 44 40 ?? ?? 0F 85 48
ep_only = true
[PE Lock NT v2:01]
signature = EB 03 CD 20 EB EB 01 EB 1E EB 01 EB EB 02 CD 20 9C EB 03 CD
ep_only = true
[PE Lock NT v2:02c]
signature = EB 02 C7 85 1E EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD
ep_only = true
-157-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[PE Lock NT v2:03]

signature = EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB 01
ep_only = true
[PE Lock NT v2:04]
signature = EB ?? CD ?? ?? ?? ?? ?? CD ?? ?? ?? ?? ?? EB ?? EB ?? EB ?? EB ?? CD ?? ?? ?? ??
?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 50 C3
ep_only = true
[PE Lock v1:06]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4C 6F 61 64 4C 69 62
72 61 72 79 41 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 4B 45
ep_only = true
[Pe Ninja -> +DzA
signature = BE 5B
90 90 90 90 90 90
90 90 90 90 90 90
90 90 90 90 90 90
90 90 90 90 90 90
90 90 90 90 90 90
90 90 90 90 90 90
90 90 90 90 90 90
90 90 90 90 90 90
ep_only = true

kRAker [TNT]
2A 40 00 BF 35
90 90 90 90 90
90 90 90 90 90
90 90 90 90 90
90 90 90 90 90
90 90 90 90 90
90 90 90 90 90
90 90 90 90 90
90 90 90 90 90

[Pe Ninja -> +DzA

signature = BE 5B
90 90 90 90 90 90
90 90 90 90 90 90
ep_only = true

kRAker [TNT]]
2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90

12
90
90
90
90
90
90
90
90

00
90
90
90
90
90
90
90
90

00
90
90
90
90
90
90
90

E8
90
90
90
90
90
90
90

40
90
90
90
90
90
90
90

12
90
90
90
90
90
90
90

00
90
90
90
90
90
90
90

00
90
90
90
90
90
90
90

3D
90
90
90
90
90
90
90

22
90
90
90
90
90
90
90

83
90
90
90
90
90
90
90

A3
90
90
90
90
90
90
90

C6
90
90
90
90
90
90
90

0F
90
90
90
90
90
90
90

85
90
90
90
90
90
90
90

67
90
90
90
90
90
90
90

0F
90
90
90
90
90
90
90

00
90
90
90
90
90
90
90

00
90
90
90
90
90
90
90

90
90
90
90
90
90
90
90

[PE Ninja v1:0 -> +DzA kRAker TNT]

signature = BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
ep_only = true
[PE Pack v0:99]
signature = 60 E8 ?? ?? ?? ?? 5D 83 ED 06 80 BD E0 04 ?? ?? 01 0F 84 F2
ep_only = true
[PE Pack v1:0]
signature = 74 ?? E9
ep_only = true
[PE Packer]
signature = FC 8B 35 70 01 40 ?? 83 EE 40 6A 40 68 ?? 30 10
ep_only = true
[PE Password v0:2 SMT/SMF]
signature = E8 04 ?? ?? ?? 8B EC 5D C3 33 C0 5D 8B FD 81 ED 33 26 40 ?? 81 EF ?? ?? ?? ?? 83
EF 05 89 AD 88 27 40 ?? 8D 9D 07 29 40 ?? 8D B5 62 28 40 ?? 46 80
ep_only = true
[PE Protect 0:9]
signature = E9 ?? 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
C4 C4 C4 C4 C4 C4 0D 0A 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 20 28 43 29 6F
ep_only = false
[PE Protect v0:9]
-158-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 ?? ?? ?? ?? 58 83 C0 07 C6 ?? C3
ep_only = true
[PE Protector 0:9:3 -> CRYPToCRACk]
signature = 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26
0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC
04 0F 85 DD 00 00
ep_only = true
[PE Spin 0:b]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24
72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00
F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9
ep_only = false
[PE Spin v0:4x]
signature = EB 01 68 60 E8 00 00 00 00 8B
ep_only = false
[PE Spin v0:b]
signature = EB
72 C8 46 00 0B
F9 FF E3 C9 C2
40 00 8B 42 3C
8A 20 40 00 8B
0C 5B 6A 17 59
8A 20 40 00 C3
E2 F9 68 1D 01
BD 09 00 00 33
ep_only = true

01
E4
08
03
59
30
92
00
C0

68
74
00
C2
24
0C
EB
00
0F

60
9E
A3
89
03
03
15
59
84

[PE-Armor 0:46
signature = E8
00 00 00 00 00
00 00 00 4B 45
73 73 00 00 00
72 61 72 79 41
00 ?? ?? 00 ??
8D 75 3D 56 FF
FF B5 82 00 00
55 FF E2 60 8B
ep_only = true

->
AA
00
52
47
00
??
55
00
74

China
00 00
00 00
4E 45
65 74
A2 01
?? 00
31 8D
6A 00
24 24

[PE-Armor 0:46
signature = E8
00 00 00 00 00
00 00 00 4B 45
ep_only = true

->
AA
00
52

China
00 00
00 00
4E 45

E8
75
68
85
DA
02
68
8D
C0

00
01
72
76
8B
CB
BB
BD
08

00
C7
01
20
1B
4B
??
2F
00

00
81
FF
40
89
75
00
28

00
73
5D
00
9D
F8
00
40

8B
04
33
41
8E
40
00
00

1C
D7
C9
C1
20
8D
B9
C0

24
7A
41
E1
40
9D
90
0C

83
F7
E2
07
00
41
08
39

C3
2F
26
8B
53
8F
00
02

12
81
E8
0C
8F
4E
00
E2

81
73
01
01
85
00
8D
FA

2B
19
00
03
E2
50
BD
68

E8
77
00
CA
1F
53
FF
A0

B1
00
00
8B
40
81
20
20

06
43
EA
59
00
2C
40
40

00
B7
5A
10
8D
24
00
00

FE
F6
33
03
85
01
4F
50

4B
C3
C9
DA
92
78
30
01

FD
6B
8B
8B
20
0E
1C
6C

82
B7
95
1B
40
00
39
24

2C
00
68
89
00
FF
FE
04

24
00
20
9D
6A
B5
CB
E8

Cracking
00 2D ??
00 00 00
4C 33 32
4D 6F 64
00 00 ??
?? ?? ??
B5 86 00
FF 95 93
8B 7C 24

Group]
?? 00 00
00 00 00
2E 64 6C
75 6C 65
?? 00 00
00 ?? ??
00 00 56
00 00 00
28 FC

00
00
6C
48
56
??
50
50

00
00
00
61
69
00
FF
8B

00
00
00
6E
72
00
55
9D

00
00
00
64
74
00
2D
7E

00
4B
00
6C
75
00
89
00

00
??
47
65
61
00
85
00

00
??
65
41
6C
00
93
00

3D
00
74
00
41
00
00
03

??
5C
50
00
6C
00
00
DD

??
??
72
00
6C
00
00
50

00
??
6F
4C
6F
5D
6A
53

2D
00
63
6F
63
81
04
E8

??
6F
41
61
00
ED
68
04

??
??
64
64
00
05
00
00

00
??
64
4C
00
00
10
00

00
00
72
69
00
00
00
00

00
00
65
62
00
00
00
5A

Cracking
00 2D ??
00 00 00
4C 33 32

Group]
?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00
00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00
2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41

[PE-Armor 0:460-0:759 -> hying]

signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C
33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00
ep_only = true
[PE-Armor 0:49 -> Hying]
signature = 56 52 51 53 55 E8 15 01 00 00 32 ?? ?? 00 00 00 00 00
ep_only = true
[PE-Armor V0:460-V0:759 -> hying * Sign:By:fly]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C
-159-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D
6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00
ep_only = false
[PE-Armor V0:760-V0:765
signature = 00 00 00 00
?? 00 00 00 00 00 00 00
?? ?? 00 00 00 00 4B 45
64 72 65 73 73 00 00 00
65 48 61 6E 64 6C 65 41
ep_only = false

->
00
00
52
4C
00

hying
00 00
00 00
4E 45
6F 61
00 00

* Sign:By:fly]
00 ?? ?? ?? ??
00 00 00 00 00
4C 33 32 2E 64
64 4C 69 62 72
00 00 08 00 00

[PE-Armor V0:760-V0:765
signature = 00 00 00 00
?? 00 00 00 00 00 00 00
?? ?? 00 00 00 00 4B 45
ep_only = true

->
00
00
52

hying]
00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ??
00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72

00
00
6C
61
00

00
00
6C
72
00

00
00
00
79
00

00
00
00
41
00

00
00
00
00
00

00
??
00
00
60

00
??
47
00
E8

00
??
65
47
00

??
??
74
65
00

??
??
50
74
00

??
??
72
4D
00

??
??
6F
6F

??
??
63
64

??
??
41
75

??
??
64
6C

[PE-Crypt 1:02]
signature = E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7
ep_only = true
[PE-Crypter]
signature = 60 E8 00 00 00 00 5D EB 26
ep_only = true
[PE-PACK 0:99]
signature = 60 E8 00 00 00 00 5D 83 ED 06 80 BD E0 04 00 00 01 0F 84 F2
ep_only = true
[PE-PaCK 1:0 -> (C) Copyright
signature = C4 C4 C4 C4 C4 C4
C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
3D FE 20 50 45 2D 50 41 43 4B
ep_only = false
[PE-PaCK v1:0 -> (C)
signature = C4 C4 C4
C4 C4 C4 C4 C4 C4 C4
3D FE 20 50 45 2D 50
68 74 20 31 39 39 38
C4 C4 C4 C4 C4 C4 C4
C4 C4 C4 C4 C4 C4 C4
ep_only = false

1998 by ANAKiN
C4 C4 C4 C4 C4
C4 C4 C4 C4 C4
20 76 31 2E 30

Copyright 1998
C4 C4 C4 C4 C4
C4 C4 C4 C4 C4
41 43 4B 20 76
20 62 79 20 41
C4 C4 C4 C4 C4
C4 C4 C4 C4 C4

by
C4
C4
31
4E
C4
C4

(h)]
C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D
20 2D FE 2D 20 28 43 29 20 43 6F 70

ANAKiN (h)]
C4 C4 C4 C4
C4 C4 C4 C4
2E 30 20 2D
41 4B 69 4E
C4 C4 C4 C4
C4 C4

C4
C4
FE
20
C4

C4
C4
2D
FE
C4

C4
C4
20
3D
C4

C4
C4
28
2D
C4

C4
C4
43
20
C4

C4
C4
29
0D
C4

C4
C4
20
0A
C4

[PE-PACK v1:0 by ANAKiN 1998 (???)]

signature = 74 ?? E9 ?? ?? ?? ?? 00 00 00 00
ep_only = true
[PE-Protect 0:9 by Cristoph Gabler 1998]
signature = 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39
ep_only = false
[PE-PROTECT 0:9]
signature = E9 CF 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
ep_only = true
[PE-SHiELD 0:2]
signature = 60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04
ep_only = true
[Pe123 2006:4:12]
-160-

C4
C4
43
C4
C4

C4
C4
6F
C4
C4

C4
C4
70
C4
C4

C4
0D
79
C4
C4

C4
0A
72
C4
C4

C4
20
69
C4
C4

C4
2D
67
C4
C4

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B
C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61
5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B
ep_only = false
[Pe123 2006:4:4]
signature = 8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A
EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A
8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10
ep_only = false
[Pe123 v2006:4:12]
signature = 8B C0 60
C3 8B C0 E8 00 00 00
5D C2 0C 00 E8 00 00
00 00 58 C1 E8 0C C1
00 00 00 58 83 E8 05
FF FF FF 50 E8 8A FF
70 FF FF FF E8 97 FF
FF 83 C0 38 89 45 8C
0D 00 00 00 6B 65 72
ep_only = true

9C
00
00
E0
C3
FF
FF
60
6E

E8
58
00
0C
8B
FF
FF
8B
65

01
83
58
66
C0
68
03
45
6C

00
C0
83
81
55
F8
85
FC
33

00
05
E8
38
8B
00
CC
8B

00
C3
05
4D
EC
00
FE
00

C3
8B
C3
5A
81
00
FF
89

53
C0
8B
74
C4
8D
FF
45

E8
55
C0
0C
4C
85
83
F8

72
8B
E8
2D
FE
4C
C0
89

00
EC
00
00
FF
FE
34
45

00
60
00
10
FF
FF
89
9C

00
8B
00
00
53
FF
45
8B

50
4D
00
00
6A
50
FC
45

E8
10
58
66
40
E8
E8
8C

1C
8B
83
81
8D
A5
86
8B

03
7D
C0
38
85
FF
FF
00

00
0C
05
4D
44
FF
FF
89

00
8B
C3
5A
FF
FF
FF
45

8B
75
8B
75
FF
03
03
88

D8
08
C0
F4
FF
45
85
89

FF
F3
E8
C3
50
80
CC
45

D3
A4
00
E8
E8
50
FE
98

5B
61
00
00
BC
E8
FF
E8

[Pe123 v2006:4:4]
signature = 8B C0
EB 01 5B C3 8D 40
8B D8 FF D3 5B C3
75 08 F3 A4 61 5D
8B C0 E8 00 00 00
75 F4 C3 E8 00 00
C0 FF FF FF 50 E8
E8 74 FF FF FF E8
FF FF 83 C0 38 89
ep_only = true

01
53
C0
0C
58
00
FF
FF
F4

34
EB
E8
00
C1
58
FF
FF
8B

60
01
00
E8
E8
83
FF
FF
45

EB
6C
00
00
0C
E8
68
03
FC

01
EB
00
00
C1
05
F8
85

2A
01
00
00
E0
C3
00
38

9C
7E
58
00
0C
8B
00
FF

EB
EB
83
58
66
C0
00
FF

02
01
C0
83
81
55
8D
FF

EA
8F
05
E8
38
8B
85
83

C8
E8
C3
05
4D
EC
B8
C0

E8
15
8B
C3
5A
81
FE
34

0F
01
C0
8B
74
C4
FF
89

00
00
55
C0
0C
B8
FF
45

00
00
8B
E8
2D
FE
50
FC

00
50
EC
00
00
FF
E8
E8

EB
E8
60
00
10
FF
A9
8A

03
67
8B
00
00
6A
FF
FF

3D
04
4D
00
00
40
FF
FF

23
00
10
58
66
8D
FF
FF

23
00
8B
83
81
45
03
03

EB
EB
7D
C0
38
B0
45
85

01
01
0C
05
4D
50
EC
38

4A
9A
8B
C3
5A
E8
50
FF

Sold)
E8 79
00 00
?? ??
2E 64
65 61
00 00
6C 65
00 00
00 00

->
01
00
??
6C
74
4D
00
00
00

Flying Cat * Sign:By:fly]

00 00 90 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00
?? ?? ?? ?? ?? ?? ?? ?? ??
6C 00 00 00 47 65 74 53 79
65 46 69 6C 65 41 00 00 00
61 70 56 69 65 77 4F 66 46
00 00 43 6C 6F 73 65 48 61
47 65 74 50 72 6F 63 41 64
00

00
00
??
73
43
69
6E
64

00
00
??
74
72
6C
64
72

00
??
??
65
65
65
6C
65

00
??
??
6D
61
00
65
73

00
??
??
44
74
00
00
73

??
??
??
69
65
00
00
00

[PE_Admin V1:0
signature = 60
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? 00 00 00 00
72 65 63 74 6F
46 69 6C 65 4D
55 6E 6D 61 70
00 4C 6F 61 64
00 00 45 78 69
ep_only = true

EB
00
8B
C2
00
00
8E
9B
45

(EncryptPE V1:2003:5:18
9C 64 FF 35 00 00 00 00
?? ?? 00 00 00 00 00 00
?? ?? ?? ?? ?? ?? ?? ??
6B 65 72 6E 65 6C 33 32
72 79 41 00 00 00 43 72
61 70 70 69 6E 67 41 00
56 69 65 77 4F 66 46 69
4C 69 62 72 61 72 79 41
74 50 72 6F 63 65 73 73

[PE_Admin V1:0 (EncryptPE V1:2003:5:18 Sold) -> Flying Cat]

signature = 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 ??
?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true
[PE_Protector V2:60u?hying's PE-Armor V0:460
signature = 55 53 51 52 56 57 E8 E1 00 00 00
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
9D 9B 00 00 00 03 9D 9F 00 00 00 0B DB 74 14

modifyu?
?? ?? ??
?? ?? ??
?? ?? ??
?? ?? ??
?? ?? ??
?? ?? ??
?? ?? ??
?? ?? ??
8B 83 7F
-161-

->
??
??
??
??
??
??
??
??
46

Engprog * Sign:By:fly]
?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? 5D 81 ED 0B
00 00 03 83 87 46 00 00

??
??
??
??
??
??
??
00
5F

??
??
??
??
??
??
??
00
5E

??
??
??
??
??
??
??
00
5A

??
??
??
??
??
??
??
8B
59

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

5B 5D FF E0 8D
56 FF 55 54 8D
00 00 00 56 50
B0 00 00 00 89
7C 24 0C F7 46
ep_only = true

75
B5
FF
85
04

43
B4
55
9B
07

56
00
50
00
00

FF
00
89
00
00

04 August 2015 15:14

55
00
85
00
00

54
56
D0
55
75

8D
50
00
8D
08

B5
FF
00
9D
81

A3
55
00
F2
3E

00
50
6A
01
27

00
89
40
00
00

00
85
68
00
00

56
C0
00
53
C0

50
00
10
8D
75

FF
00
00
9D
06

55
00
00
CC
B8

50
8D
FF
01
00

89
75
B5
00
00

85
43
97
00
00

B0
56
00
FF
00

00
FF
00
D3
C3

00
55
00
8B

00
54
6A
74

8D
8D
00
24

75
B5
FF
04

43
C4
95
8B

[PEArmor V0:7X -> Hying]

signature = 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 55 56 81 C5 ?? ?? ?? ??
55 C3
ep_only = true
[PEBundle v0:2 - v2:0x]
signature = 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87
DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95
ep_only = true
[PEBundle v2:0b5 - v2:3]
signature = 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87
DD 01 AD ?? ?? ?? ?? 01 AD
ep_only = true
[PEBundle v2:44]
signature = 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87
DD 83 BD
ep_only = true
[PEBundle v3:10]
signature = 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87
DD ?? ?? ?? ?? 40 00 01
ep_only = false
[PECompact 2:00 alpha 38]
signature = B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52
56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01
FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F
ep_only = false
[PECompact 2:0beta/student version -> Jeremy Collake]
signature = B8 ?? ?? ?? EE 05 12 13 13 12 50 64 FF 35 00 00 00 00 64 89 25 00
ep_only = false
[PeCompact 2:53 DLL (Slim Loader) -> BitSum Technologies]
signature = B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43
32 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D 0B 6B
65 72 6E 6C 33 32
ep_only = true
[PeCompact 2:53 DLL -> BitSum Technologies]
signature = B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43
6F 6D 70 61 63 74 32 00 00 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21
E8 BD 0E E6 60 0D
ep_only = true
[PECompact 2:x (beta version) ->Jeremy Collake]
signature = B8 ?? ?? ?? 00 80 00 28 40
ep_only = true
[PECompact 2:x -> Bitsum Technologies]
signature = B8 ?? ?? ?? 02 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43
6F 6D 70 61 63 74 32 00
ep_only = false
-162-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[PeCompact 2:xx (Slim Loader) -> BitSum Technologies]

signature = B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43
32 00
ep_only = true
[PECompact v0:90]
signature = EB 06 68 ?? ?? 40 00 C3 9C 60 BD ?? ?? 00 00 B9 02 00 00 00 B0 90 8D BD 7A 42 40
00 F3 AA 01 AD D9 43 40 00 FF B5
ep_only = true
[PECompact v0:92]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 BD ?? ?? ?? ?? B9 02 ?? ?? ?? B0 90 8D BD A5 4F 40
?? F3 AA 01 AD 04 51 40 ?? FF B5
ep_only = true
[PECompact v0:94]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 ?? ?? ?? ?? 5D 55 58 81 ED ?? ?? ?? ?? 2B 85 ??
?? ?? ?? 01 85 ?? ?? ?? ?? 50 B9 02
ep_only = true
[PECompact v0:971 - v0:976]
signature = EB 06 68 C3 9C 60 E8 5D 55 5B 81 ED 8B 85 01 85 66 C7 85
ep_only = true
[PECompact v0:977]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB A0 86 40 ?? 87 DD 8B 85 2A 87
ep_only = true
[PECompact v0:978:1]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 49 87 40 ?? 87 DD 8B 85 CE 87
ep_only = true
[PECompact v0:978:2]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB D1 84 40 ?? 87 DD 8B 85 56 85
ep_only = true
[PECompact v0:978]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 24 88 40 ?? 87 DD 8B 85 A9 88
ep_only = true
[PECompact v0:98]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB D7 84 40 ?? 87 DD 8B 85 5C 85
ep_only = true
[PECompact v0:99]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 2F 85 40 ?? 87 DD 8B 85 B4 85
ep_only = true
[PECompact v1:00]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB C4 84 40 ?? 87 DD 8B 85 49 85
ep_only = true
[PECompact v1:10b1]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
-163-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

FC 81 EB 28 63 40 ?? 87 DD 8B 85 AD 63
ep_only = true
[PECompact v1:10b2]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 0F 60 40 ?? 87 DD 8B 85 94 60
ep_only = true
[PECompact v1:10b3]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB
95
ep_only = true
[PECompact v1:10b4]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB
44
ep_only = true
[PECompact v1:10b5]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB
49
ep_only = true
[PECompact v1:10b6]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 0F 60 ?? 00 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01
85 92 60 40 ?? BB B7
ep_only = true
[PECompact v1:10b7]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 0F 60 40 ?? 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01
85 92 60 40 ?? BB 14
ep_only = true
[PECompact v1:20 - v1:20:1]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 0F 70 40 ?? 87 DD 8B 85 9A 70 40
ep_only = true
[PECompact v1:22]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 ?? 70 40 ?? 90 90 01
85 9E 70 40 ?? BB F3 08
ep_only = true
[PECompact v1:23b3 - v1:24:1]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85
9E 70 40 BB ?? D2 08
ep_only = true
[PECompact v1:24:2 - v1:24:3]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85
9E 70 40 BB ?? D2 09
ep_only = true
[PECompact v1:25]
-164-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85
9E 70 40 BB ?? F3 0D
ep_only = true
[PECompact v1:26b1 - v1:26b2]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85
9E 70 40 BB ?? 05 0E
ep_only = true
[PECompact v1:33]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 00 80 40 ?? 90 90 01
85 9E 80 40 ?? BB E8 0E
ep_only = true
[PECompact v1:34 - v1:40b1]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 00 80 ?? 40 90 90
01 85 9E 80 ?? 40 BB F8 10
ep_only = true
[PECompact v1:40 - v1:45]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01
85 9E A0 40 ?? BB C3 11
ep_only = true
[PECompact v1:40b2 signature = EB 06 68
FC 81 EB 0F A0 40 ??
85 9E A0 40 ?? BB 86
ep_only = true

v1:40b4]
?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01
11

[PECompact v1:40b5 signature = EB 06 68

FC 81 EB 0F A0 40 ??
85 9E A0 40 ?? BB 8A
ep_only = true

v1:40b6]
?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01
11

[PECompact v1:46]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01
85 9E A0 40 ?? BB 60 12
ep_only = true
[PECompact v1:47 - v1:50]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01
85 9E A0 40 ?? BB 5B 12
ep_only = true
[PECompact v1:4x+]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81
ep_only = false
[PECompact v1:55]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A2 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01
85 9E 80 40 ?? BB 2D 12
-165-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[PECompact v1:56]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 0F 90 40 ?? 87 DD 8B 85 A2 90 40 ?? 01 85 03 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01
85 9E 90 40 ?? BB 2D 12
ep_only = true
[PECompact v1:60 - v1:65]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 3F 80 40 ?? 87 DD 8B 85 D2 80 40 ?? 01 85 33 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01
85 CE 80 40 ?? BB BB 12
ep_only = true
[PECompact v1:66]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 3F 90 40 ?? 87 DD 8B 85 E6 90 40 ?? 01 85 33 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01
85 DA 90 40 ?? 01 85 DE 90 40 ?? 01 85 E2 90 40 ?? BB 5B 11
ep_only = true
[PECompact v1:67]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01
85 DE 90 40 01 85 E2 90 40 BB 8B 11
ep_only = true
[PECompact v1:68 - v1:84]
signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B
FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01
85 DE 90 40 01 85 E2 90 40 BB 7B 11
ep_only = true
[PECompact v1:84]
signature = 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81
ep_only = true
[PECompact v2:0 beta -> Jeremy Collake]
signature = B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC 90
90 90 90
ep_only = true
[PECompact v2:00 alpha 38]
signature = B8 ?? ?? ?? ??
56 8D 98 0F 10 00 10 8B 53
FF D0 8B F8 50 8B 33 8B 53
FF D1 58 03 43 08 8B F8 8B
D7 89 85 BB 10 00 10 5E 5A
00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00
ep_only = false

80
14
14
53
5F
00
00
00
00

B8
8B
03
14
59
00
00
00
00

BF
E8
F2
8B
5B
00
00
00

10
6A
8B
F0
5D
00
00
00

00
40
4B
8B
9D
00
00
00

10
68
0C
46
FF
00
00
00

01
00
03
FC
E0
00
00
00

74
10
CA
83
8B
00
00
00

7A
00
8D
C0
80
00
00
00

C6
00
85
04
BB
00
00
00

80
FF
B7
2B
10
00
00
00

BF
73
10
F0
00
00
00
00

10
04
00
89
10
00
00
00

00
6A
10
56
FF
00
00
00

10
00
FF
08
E0
00
00
00

01
8B
73
8B
00
00
00
00

9C
4B
04
4B
00
00
00
00

55
10
8F
10
00
00
00
00

53
03
00
89
00
00
00
00

51
CA
50
4E
00
00
00
00

57
8B
57
18
00
00
00
00

52
01
56
FF
00
00
00
00

[PeCompact v2:08 -> Bitsum Technologies(signature by loveboom)]

signature = B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43
6F 6D
ep_only = true
[PECompact v2:0]
signature = B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43
6F 6D 70 61 63 74 32 00
ep_only = true
-166-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[PECompact v2:5 Retail (Slim Loader) -> Bitsum Technologies]

signature = B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43
32 00
ep_only = true
[PECompact v2:5 Retail -> Bitsum Technologies]
signature = B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43
6F 6D 70 61 63 74 32 00
ep_only = true
[PECompact V2:X -> Bitsum Technologies]
signature = B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43
ep_only = true
[PECompact v2:xx]
signature = B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43
6F 6D 70 61 63 74 32 00
ep_only = false
[PeCompact2 2:53-2:76 -> BitSum Technologies]
signature = B8 ?? ?? ?? ?? 55 53 51 57 56 52 8D 98 C9 11 00 10 8B 53 18 52 8B E8 6A 40 68 00
10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 5A 8B F8 50 52 8B 33 8B 43 20 03 C2 8B 08
89 4B 20 8B 43 1C 03 C2 8B 08 89 4B 1C 03 F2 8B 4B 0C 03 CA 8D 43 1C 50 57 56 FF
ep_only = false
[PECrc32 0:88 -> ZhouJinYu]
signature = 60 E8 00 00 00 00 5D 81 ED B6 A4 45 00 8D BD B0 A4 45 00 81 EF 82 00 00 00
ep_only = true
[PEcrypt - by archphase]
signature = 55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00
E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10
A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9
ep_only = true
[PEEncrypt v4:0b (JunkCode)]
signature = 66 ?? ?? 00 66 83 ?? 00
ep_only = true
[PEiD-Bundle v1:00 - v1:01 -> BoB / BobSoft]
signature = 60 E8 ?? 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C
02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA
31 C9 41 8B 34 8A
ep_only = true
[PEiD-Bundle V1:00 -> BoB / BobSoft]
signature = 60 E8 21 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C
02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA
31 C9 41 8B 34 8A
ep_only = true
[PEiD-Bundle V1:01 -> BoB / BobSoft]
signature = 60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C
02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA
31 C9 41 8B 34 8A
ep_only = true
[PEiD-Bundle v1:02 - v1:04 -> BoB / BobSoft]
signature = 60 E8 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E
65 6C 33 32 2E 44
-167-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[PEiD-Bundle V1:02 -> BoB / BobSoft]
signature = 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E
65 6C 33 32 2E 44
ep_only = true
[PEiD-Bundle V1:02 DLL -> BoB / BobSoft]
signature = 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 41 00 08 00 39 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01
00 00 80 00 00 00
ep_only = true
[PEiD-Bundle v1:04 -> BoB / BobSoft]
signature = 60 E8 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E
65 6C 33 32 2E 44
ep_only = true
[Pelles C 2:90 EXE (X86 CRT-LIB)]
signature = 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ??
?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3
ep_only = false
[Pelles C 2:90; 3:00; 4:00 DLL (X86 CRT-LIB)]
signature = 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 BF 01 00 00 00 85 DB 75 10 83 3D ?? ?? ?? ??
00 75 07 31 C0 E9 ?? ?? ?? ?? 83 FB 01 74 05 83 FB 02 75 ?? 85 FF 74
ep_only = false
[Pelles C 3:00; 4:00; 4:50 EXE (X86 CRT-DLL)]
signature = 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ??
?? ?? 83 EC ?? 53 56 57 89 65 E8 C7 45 FC ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 BE ??
?? ?? ?? EB
ep_only = false
[Pelles C 3:00; 4:00; 4:50 EXE (X86 CRT-LIB)]
signature = 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ??
?? ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3
ep_only = false
[Pelles C 4:50 DLL (X86 CRT-LIB)]
signature = 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 85 DB 75 0D 83 3D ?? ?? ?? ?? 00 75 04 31 C0
EB 57 83 FB 01 74 05 83 FB 02 75
ep_only = false
[PELOCKnt 2:04]
signature = EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60
ep_only = true
[PEMangle]
signature = 60 9C BE ?? ?? ?? ?? 8B FE B9 ?? ?? ?? ?? BB 44 52 4F 4C AD 33 C3
ep_only = true
[PEncrypt 2:0 -> junkcode]
signature = EB 25 00 00 F7
50 72 6F 74 65 63 74 00 00
33 00 00 00 89 85 10 10 40
50 6A 04 51 56 FF 95 10 10
81 ED 77 10 40 00 8B D6 80
B5 02 10 40 00 83 C6 3C 66
02 10 40 00 89 85 08 10 40

BF
00
00
40
3E
AD
00

00
00
BF
00
00
03
AD

00
00
00
5E
74
85
03

00
E8
00
59
03
02
85

00
00
40
C6
46
10
02

00
00
00
06
EB
40
10

00
00
8B
00
F8
00
40

00
00
F7
46
46
8B
00

-168-

00
5D
03
E2
2B
70
50

00
81
7F
FA
F2
78
AD

00
ED
3C
E9
8B
03
03

12
2C
8B
AE
CE
B5
85

00
10
4F
00
33
02
02

E8
40
54
00
C0
10
10

00
00
51
00
66
40
40

56
8D
56
55
89
00
00

69
B5
8D
E8
85
83
89

72
14
85
00
06
C6
85

74
10
23
00
10
1C
0C

75
40
10
00
40
AD
10

61
00
40
00
00
03
40

6C
E8
00
5D
8B
85
00

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

5E 56 AD 03 85 02 10 40 00 8B F0 8B FA 51 FC F3 A6 59 74 0D 5E 83 C6 04 66 FF 85 06 10 40 00
EB E0 5E 0F B7 85 06 10 40 00 D1 E0
ep_only = true
[PEncrypt 2:0 -> junkcode]
signature = EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C
50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8
33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85
ep_only = true
[PEncrypt v1:0]
signature = 60 9C BE 00 10 40 00 8B FE B9 28 03 00 00 BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61
ep_only = true
[PEncrypt v3:0]
signature = E8 00 00 00 00 5D 81 ED 05 10 40 00 8D B5 24 10 40 00 8B FE B9 0F 00 00 00 BB ??
?? ?? ?? AD 33 C3 E2 FA
ep_only = true
[PEncrypt v3:1]
signature = E9 ?? ?? ?? 00 F0 0F C6
ep_only = true
[PEnguinCrypt v1:0]
signature = B8 93 ?? ?? 00 55 50 67 64 FF 36 00 00 67 64 89 26 00 00 BD 4B 48 43 42 B8 04 00
00 00 CC 3C 04 75 04 90 90 C3 90 67 64 8F 06 00 00 58 5D BB 00 00 40 00 33 C9 33 C0
ep_only = true
[PENightMare 2 Beta]
signature = 60 E9 ?? ?? ?? ?? EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A
ep_only = true
[PENightMare v1:3]
signature = 60 E8 00 00 00 00 5D B9 ?? ?? ?? ?? 80 31 15 41 81 F9
ep_only = true
[PENinja modified]
signature = 5D 8B C5 81 ED B2 2C 40 00 2B 85 94 3E 40 00 2D 71 02 00 00 89 85 98 3E 40 00 0F
B6 B5 9C 3E 40 00 8B FD
ep_only = true
[PENinja]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90 90
ep_only = true
[PEQuake 0:06 by fORGAT]
signature = E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00
00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64
ep_only = false
[PEQuake V0:06 -> forgat]
signature = E8 A5 00 00 00
ep_only = true
[PEQuake v0:06
signature = E8
00 00 00 00 00
00 00 00 6B 45
73 00 00 00 47
61 72 79 41 00

->
A5
00
72
65
??

forgot/us (h)]
00 00 00 2D ??
00 00 00 00 00
4E 65 4C 33 32
74 4D 6F 64 75
?? 00 00 56 69

??
00
2E
6C
72

??
00
64
65
74

00
00
4C
48
75

00
00
6C
61
61

00
00
00
6E
6C

00
00
00
64
41

-169-

00
00
00
6C
6C

00
??
47
65
6C

00
??
65
41
6F

00
??
74
00
63

3D
??
50
00
00

??
??
72
00
00

??
??
6F
4C
00

??
??
63
6F
00

2D
??
41
61
00

??
??
64
64
00

??
??
64
4C
??

??
??
72
69
??

00
??
65
62
??

00
00
73
72
??

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

?? ?? ?? ?? ??
55 31 8D B5 81
6A 00 FF 95 8E
24 24 8B 7C 24
C0 E8 5B 00 00
ep_only = true

??
00
00
28
00

??
00
00
FC
73

??
00
00
B2
23

04 August 2015 15:14

??
56
50
80
B3

??
50
8B
33
02

00
FF
9D
DB
41

00
55
7D
A4
B0

00
2D
00
B3
10

00
89
00
02
E8

00
85
00
E8
4F

00
8E
03
6D
00

00
00
DD
00
00

00
00
50
00
00

00
00
53
00
12

5D
6A
E8
73
C0

81
04
04
F6
73

ED
68
00
33
F7

05
00
00
C9
75

00
10
00
E8
3F

00
00
5A
64
AA

00
00
55
00
EB

8D
68
FF
00
D4

75
??
E2
00
E8

3D
??
60
73

56
00
8B
1C

FF
00
74
33

[PEQuake v0:06 by
signature = E8 A5
00 00 00 00 00 00
00 00 00 6B 45 72
73 00 00 00 47 65
61 72 79 41 00 ??
?? ?? 00 ?? ?? ??
55 31 8D B5 81 00
6A 00 FF 95 8E 00
24 24 8B 7C 24 28
ep_only = false

fORGAT]
00 00 00
00 00 00
4E 65 4C
74 4D 6F
?? 00 00
00 ?? ??
00 00 56
00 00 50
FC B2 80

2D
00
33
64
56
??
50
8B
33

??
00
32
75
69
00
FF
9D
DB

00
00
2E
6C
72
00
55
7D

00
00
64
65
74
00
2D
00

00
00
4C
48
75
00
89
00

00
00
6C
61
61
00
85
00

00
00
00
6E
6C
00
8E
03

00
00
00
64
41
00
00
DD

00
00
00
6C
6C
00
00
50

00
4A
47
65
6C
00
00
53

00
??
65
41
6F
5D
6A
E8

00
00
74
00
63
81
04
04

3D
00
50
00
00
ED
68
00

??
5B
72
00
00
05
00
00

00
??
6F
4C
00
00
10
00

00
00
63
6F
00
00
00
5A

2D
00
41
61
00
00
00
55

??
6E
64
64
00
8D
68
FF

00
??
64
4C
??
75
??
E2

00
00
72
69
??
3D
??
60

00
00
65
62
00
56
00
8B

00
00
73
72
??
FF
00
74

[PerlApp 6:0:2 ->

signature = 68 9C
45 FC 75 62 6A 00
0F 84 E9 00 00 00
00 E9 C9 00 00 00
ep_only = false

ActiveState]
E1 40 00 FF 15
8D 45 F8 FF 75
8B 45 F8 83 C0
68 8C E1 40 00

A4
0C
14
FF

D0
F6
50
75

40
45
FF
14

00 85 C0 59 74 0F 50 FF 15 1C D1 40 00 85 C0 59 89
14 01 50 8D 45 14 50 E8 9B 01 00 00 83 C4 10 85 C0
D6 85 C0 59 89 45 FC 75 0E FF 75 14 FF 15 78 D0 40
50

[PerlApp 6:0:2 ->

signature = 68 2C
D3 83 C4 0C 85 C0
EA 40 00 FF D3 83
57 68 08 EA 40 00
11 6A 0B 57 68 F0
ep_only = false

ActiveState]
EA 40 00 FF D3
75 12 8D 47 09
C4 0C 85 C0 75
FF D3 83 C4 0C
E9 40 00 FF D3

83
50
11
85
83

C4
FF
8D
C0
C4

0C
15
47
74
0C

85
1C
08
22
85

C0
D1
50
6A
C0

0F
40
FF
08
75

85
00
15
57
55

CD
59
1C
68

00
A3
D1
FC

00
B8
40
E9

00
07
00
40

6A
41
59
00

09
00
89
FF

57
EB
44
D3

68
55
24
83

20
6A
10
C4

EA
08
EB
0C

40
57
33
85

00
68
6A
C0

FF
14
09
74

[PESHiELD v0:1b MTE]

signature = E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
B9 1B 01 ?? ?? D1
ep_only = true
[PESHiELD v0:2 / v0:2b / v0:2b2]
signature = 60 E8 ?? ?? ?? ?? 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04
ep_only = true
[PESHiELD v0:251]
signature = 5D 83 ED 06 EB 02 EA 04 8D
ep_only = true
[PESHiELD v0:25]
signature = 60 E8 2B 00 00 00
ep_only = true
[PEShit]
signature = B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 83 F9 00 7E 06 80 30 ?? 40 E2 F5 E9 ?? ?? ?? FF
ep_only = true
[PESpin 0:1 -> Cyberbob
signature = EB 01 68 60
5C CB 46 00 0B E4 74 9E
F9 FF E3 C9 C2 08 00 A3
ep_only = false

(h)]
E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24
75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00
68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF

[PESpin 0:3 -> Cyberbob (h)]

-170-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24
B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00
F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF
ep_only = false
[PESpin 0:7 -> Cyberbob
signature = EB 01 68 60
83 D5 46 00 0B E4 74 9E
F9 FF E3 C9 C2 08 00 A3
ep_only = false

(h)]
E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24
75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00
68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF

[PESpin 1:0 -> Cyberbob

signature = EB 01 68 60
C8 DC 46 00 0B E4 74 9E
F9 FF E3 C9 C2 08 00 A3
ep_only = false

(h)]
E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24
75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00
68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF

[PESpin 1:1 -> Cyberbob

signature = EB 01 68 60
7D DE 46 00 0B E4 74 9E
F9 FF E3 C9 C2 08 00 A3
ep_only = false

(h)]
E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24
75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00
68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF

[PESPin 1:3 -> Cyberbob

signature = EB 01 68 60
AC DF 46 00 0B E4 74 9E
F9 FF E3 C9 C2 08 00 A3
ep_only = false

(h)]
E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24
75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00
68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF

[PESpin 1:304 -> Cyberbob (h)]

signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24
88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00
F9 FF E3 C9 C2 08
ep_only = false
[PESpin 1:3beta -> Cyberbob (h)]
signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24
71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00
F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF
ep_only = false
[PESpin 1:3x -> Cyberbob]
signature = EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24
88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00
F9 FF E3 C9 C2 08
ep_only = true
[PESpin v0:1 -> Cyberbob (h)]
signature = EB 01 68 60 E8 00
5C CB 46 00 0B E4 74 9E 75 01
F9 FF E3 C9 C2 08 00 A3 68 72
00 EA 5A 83 EA 0B FF E2 8B 95
01 03 CA 8B 59 10 03 DA 8B 1B
00 00 8D BD 75 29 40 00 4F 30
02 E2 FA E8 02 00 00 00 FF 15
00 00 68 E8 1A 00 00 00 8D 34
B4 0D C4 28 40 00 8B D6 B9 10
C1 1D 00 00 00 52 51 C1 E9 05
ep_only = true

00
C7
01
B3
89
1C
5A
28
00
23

00
81
FF
28
9D
39
8D
B8
00
D1

00
73
5D
40
D1
FE
85
??
00
FF

8B
04
33
00
28
CB
07
??
AC

1C
D7
C9
8B
40
E2
4F
??
84

24
7A
41
42
00
F9
56
??
C0

83
F7
E2
3C
53
68
00
2B
74

C3
2F
17
03
8F
2D
BB
C9
06

12
81
EB
C2
85
01
54
83
C0

81
73
07
89
C4
00
13
C9
4E

2B
19
EA
85
27
00
0B
15
FF

E8
77
EB
BD
40
59
00
0F
03

B1
00
01
28
00
8D
D1
A3
E2

06
43
EB
40
BB
BD
E3
C8
F5

00
B7
EB
00
??
AA
2B
0F
E8

FE
F6
0D
41
00
30
C3
83
00

4B
C3
FF
C1
00
40
FF
81
00

FD
6B
E8
E1
00
00
E0
00
00

82
B7
01
07
B9
C0
E8
00
00

2C
00
00
8B
A5
0C
01
00
59

24
00
00
0C
08
39
00
8D
81

[PESpin v0:3 (Eng) -> cyberbob]

signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24
-171-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

B7 CD 46 00 0B
F9 FF E3 C9 C2
00 EA 5A 83 EA
01 03 CA 8B 59
00 00 8D BD 7E
02 E2 FA E8 02
00 00 68 E8 1A
81 00 00 00 8D
ep_only = true

E4
08
0B
10
2D
00
00
B4

74
00
FF
03
40
00
00
0D

9E
A3
E2
DA
00
00
00
DC

75
68
8B
8B
4F
FF
8D
2C

04 August 2015 15:14

01
72
95
1B
30
15
34
40

C7
01
CB
89
1C
5A
28
00

81
FF
2C
9D
39
8D
B9

73
5D
40
E9
FE
85
08

04
33
00
2C
CB
1F
00

D7
C9
8B
40
E2
53
00

7A
41
42
00
F9
56
00

F7
E2
3C
53
68
00
B8

2F
17
03
8F
3C
BB
??

81
EB
C2
85
01
54
??

73
07
89
B6
00
13
??

19
EA
85
2B
00
0B
??

77
EB
D5
40
59
00
2B

00
01
2C
00
8D
D1
C9

43
EB
40
BB
BD
E3
83

B7
EB
00
??
B6
2B
C9

F6
0D
41
00
36
C3
15

C3
FF
C1
00
40
FF
0F

6B
E8
E1
00
00
E0
A3

B7
01
07
B9
C0
E8
C8

00
00
8B
75
0C
01
0F

00
00
0C
0A
39
00
83

[PESpin v0:3 (Eng) -> cyberbob]

signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24
B7 CD 46
ep_only = true
[PESpin v0:3 -> Cyberbob (h)]
signature = EB 01 68 60 E8 00
B7 CD 46 00 0B E4 74 9E 75 01
F9 FF E3 C9 C2 08 00 A3 68 72
00 EA 5A 83 EA 0B FF E2 8B 95
01 03 CA 8B 59 10 03 DA 8B 1B
00 00 8D BD 7E 2D 40 00 4F 30
02 E2 FA E8 02 00 00 00 FF 15
00 00 68 E8 1A 00 00 00 8D 34
81 00 00 00 8D B4 0D DC 2C 40
00 00 00
ep_only = true

00
C7
01
CB
89
1C
5A
28
00

00
81
FF
2C
9D
39
8D
B9
8B

00
73
5D
40
E9
FE
85
08
D6

8B
04
33
00
2C
CB
1F
00
B9

1C
D7
C9
8B
40
E2
53
00
10

24
7A
41
42
00
F9
56
00
00

83
F7
E2
3C
53
68
00
B8
00

C3
2F
17
03
8F
3C
BB
??
00

12
81
EB
C2
85
01
54
??
AC

81
73
07
89
B6
00
13
??
84

2B
19
EA
85
2B
00
0B
??
C0

E8
77
EB
D5
40
59
00
2B
74

B1
00
01
2C
00
8D
D1
C9
06

06
43
EB
40
BB
BD
E3
83
C0

00
B7
EB
00
??
B6
2B
C9
4E

FE
F6
0D
41
00
36
C3
15
FF

4B
C3
FF
C1
00
40
FF
0F
03

FD
6B
E8
E1
00
00
E0
A3
E2

82
B7
01
07
B9
C0
E8
C8
F5

2C
00
00
8B
75
0C
01
0F
E8

24
00
00
0C
0A
39
00
83
00

[PESpin v0:7 -> Cyberbob (h)]

signature = EB 01 68 60 E8 00
83 D5 46 00 0B E4 74 9E 75 01
F9 FF E3 C9 C2 08 00 A3 68 72
00 EA 5A 83 EA 0B FF E2 EB 04
39 40 00 EB 01 DB 41 C1 E1 07
3B 8B 59 10 03 DA 8B 1B 89 9D
8D BD 36 3A 40 00 4F EB 01 AB
00 E8 03 00 00 00 EB 04 FA EB
5A 8D 85 B3 5F 56 00 BB 54 13
28 B9 08 00 00 00 B8 ?? ?? ??
00 8B D6 B9 10 00 00 00 AC 84
ep_only = true

00
C7
01
9A
8B
A6
30
FB
0B
??
C0

00
81
FF
EB
0C
39
1C
68
00
2B
74

00
73
5D
04
01
40
39
83
D1
C9
06

8B
04
33
00
03
00
FE
04
E3
83
C0

1C
D7
C9
EB
CA
53
CB
24
2B
C9
4E

24
7A
41
FB
E8
8F
E2
0C
C3
15
FF

83
F7
E2
FF
03
85
F9
C3
FF
0F
03

C3
2F
17
8B
00
4A
EB
8D
E0
A3
E2

12
81
EB
95
00
38
01
C0
E8
C8
F5

81
73
07
88
00
40
C8
0C
01
0F
E8

2B
19
EA
39
EB
00
68
39
00
83
00

E8
77
EB
40
04
BB
CB
02
00
81
00

B1
00
01
00
9A
??
00
E2
00
00
00

06
43
EB
8B
EB
00
00
FA
68
00
00

00
B7
EB
42
FB
00
00
E8
E8
00

FE
F6
0D
3C
00
00
59
02
1A
8D

4B
C3
FF
03
83
B9
8D
00
00
B4

FD
6B
E8
C2
04
EC
BD
00
00
0D

82
B7
01
89
24
0A
56
00
00
99

2C
00
00
85
0C
00
44
FF
8D
39

24
00
00
92
C3
00
40
15
34
40

[PESpin v0:7 -> Cyberbob]

signature = EB 01 68 60 E8
83 D5 46 00 0B E4 74 9E 75
F9 FF E3 C9 C2 08 00 A3 68
00 EA 5A 83 EA 0B FF E2 EB
39 40 00 EB 01 DB 41 C1 E1
3B 8B 59 10 03 DA 8B 1B 89
8D BD 36 3A 40 00 4F EB 01
00 E8 03 00 00 00 EB 04 FA
5A 8D 85 B3 5F 56 00 BB 54
28 B9 08 00 00 00 B8 ?? ??
00 8B D6 B9 10 00 00 00 AC
ep_only = true

00
C7
01
9A
8B
A6
30
FB
0B
??
C0

00
81
FF
EB
0C
39
1C
68
00
2B
74

00
73
5D
04
01
40
39
83
D1
C9
06

8B
04
33
00
03
00
FE
04
E3
83
C0

1C
D7
C9
EB
CA
53
CB
24
2B
C9
4E

24
7A
41
FB
E8
8F
E2
0C
C3
15
FF

83
F7
E2
FF
03
85
F9
C3
FF
0F
03

C3
2F
17
8B
00
4A
EB
8D
E0
A3
E2

12
81
EB
95
00
38
01
C0
E8
C8
F5

81
73
07
88
00
40
C8
0C
01
0F
E8

2B
19
EA
39
EB
00
68
39
00
83
00

E8
77
EB
40
04
BB
CB
02
00
81

B1
00
01
00
9A
??
00
E2
00
00

06
43
EB
8B
EB
00
00
FA
68
00

00
B7
EB
42
FB
00
00
E8
E8
00

FE
F6
0D
3C
00
00
59
02
1A
8D

4B
C3
FF
03
83
B9
8D
00
00
B4

FD
6B
E8
C2
04
EC
BD
00
00
0D

82
B7
01
89
24
0A
56
00
00
99

2C
00
00
85
0C
00
44
FF
8D
39

24
00
00
92
C3
00
40
15
34
40

00
01
72
04
07
9D
AB
EB
13
??
84

[PESpin V0:71 -> cyberbob]

signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24
83 D5 46 00 0B E4 74 9E
ep_only = true
[PESpin v1:0 -> Cyberbob (h)]
-172-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

signature = EB
C8 DC 46 00 0B
F9 FF E3 C9 C2
00 EA 5A 83 EA
42 40 00 EB 02
ED 1F EB 07 F5
E8 03 00 00 00
8F 85 94 41 40
E2 F9 EB 01 C8
0C C3 8D C0 0C
C3 FF E0 E8 01
15 0F A3 C8 0F
ep_only = true

01
E4
08
0B
12
72
EB
00
68
39
00
83

68
74
00
FF
77
0E
04
BB
CB
02
00
81

60
9E
A3
E2
F9
F5
9A
??
00
E2
00
00

E8
75
68
EB
72
72
EB
00
00
FA
68

04 August 2015 15:14

00
01
72
04
08
F8
FB
00
00
E8
E8

00
C7
01
9A
73
68
00
00
59
02
1A

00
81
FF
EB
0E
EB
83
B9
8D
00
00

00
73
5D
04
F9
EC
04
8C
BD
00
00

8B
04
33
00
83
83
24
0B
40
00
00

1C
D7
C9
EB
04
04
0C
00
4E
FF
8D

24
7A
41
FB
24
24
C3
00
40
15
34

83
F7
E2
FF
17
07
3B
8D
00
5A
28

C3
2F
17
8B
C3
F5
8B
BD
E8
8D
B9

12
81
EB
95
E8
FF
59
80
03
85
08

81
73
07
D2
04
34
10
43
00
FD
00

2B
19
EA
42
00
24
03
40
00
68
00

E8
77
EB
40
00
C3
DA
00
00
56
00

B1
00
01
00
00
41
8B
4F
EB
00
B8

06
43
EB
8B
0F
C1
1B
EB
04
BB
??

00
B7
EB
42
F5
E1
89
01
FA
54
??

FE
F6
0D
3C
73
07
9D
AB
EB
13
??

4B
C3
FF
03
11
8B
F0
30
FB
0B
??

FD
6B
E8
C2
EB
0C
42
1C
68
00
2B

82
B7
01
89
06
01
40
39
83
D1
C9

2C
00
00
85
9A
03
00
FE
04
E3
83

24
00
00
DC
72
CA
53
CB
24
2B
C9

[PESpin v1:1 -> Cyberbob (h)]

signature = EB 01 68 60 E8 00
7D DE 46 00 0B E4 74 9E 75 01
F9 FF E3 C9 C2 08 00 A3 68 72
00 EA 5A 83 EA 0B FF E2 EB 04
4B 40 00 EB 02 12 77 F9 72 08
ED 1F EB 07 F5 72 0E F5 72 F8
E8 03 00 00 00 EB 04 9A EB FB
8F 85 D7 49 40 00 BB ?? 00 00
E3 EB F8 69 30 1C 39 FE CB 49
4D 23 ED F7 64 24 08 8D 84 28
01 C8 E8 01 00 00 00 68 58 FE
ep_only = true

00
C7
01
9A
73
68
00
00
9C
BD
48

00
81
FF
EB
0E
EB
83
B9
C1
2D
1F

00
73
5D
04
F9
EC
04
FE
2C
40
0F

8B
04
33
00
83
83
24
11
24
00
84

1C
D7
C9
EB
04
04
0C
00
06
89
94

24
7A
41
FB
24
24
C3
00
F7
44
02

83
F7
E2
FF
17
07
3B
8D
14
24
00

C3
2F
17
8B
C3
F5
8B
BD
24
08
00

12
81
EB
95
E8
FF
59
71
83
5A
75

81
73
07
C3
04
34
10
4C
24
58
01

2B
19
EA
4B
00
24
03
40
24
8D
9A

E8
77
EB
40
00
C3
DA
00
01
64
81

B1
00
01
00
00
41
8B
4F
50
24
70

06
43
EB
8B
0F
C1
1B
EB
52
04
03

00
B7
EB
42
F5
E1
89
07
B8
FF
E8

FE
F6
0D
3C
73
07
9D
FA
83
64
98

4B
C3
FF
03
11
8B
E1
EB
B2
24
68

FD
6B
E8
C2
EB
0C
4B
01
DC
FC
EA

82
B7
01
89
06
01
40
FF
12
FF
83

2C
00
00
85
9A
03
00
EB
05
EA
C0

24
00
00
CD
72
CA
53
04
44
EB
21 8

00
C7
01
9A
73
68
00
00
9C
BD
48
32

00
81
FF
EB
0E
EB
83
B9
C1
2D
1F
68

00
73
5D
04
F9
EC
04
FE
2C
40
0F
CB

8B
04
33
00
83
83
24
11
24
00
84
00

1C
D7
C9
EB
04
04
0C
00
06
89
94
00

24
7A
41
FB
24
24
C3
00
F7
44
02
00

83
F7
E2
FF
17
07
3B
8D
14
24
00
59

C3
2F
17
8B
C3
F5
8B
BD
24
08
00
8D

12
81
EB
95
E8
FF
59
71
83
5A
75
BD

81
73
07
C3
04
34
10
4C
24
58
01
A3

2B
19
EA
4B
00
24
03
40
24
8D
9A
5D

E8
77
EB
40
00
C3
DA
00
01
64
81
40

B1
00
01
00
00
41
8B
4F
50
24
70
00

06
43
EB
8B
0F
C1
1B
EB
52
04
03
E8

00
B7
EB
42
F5
E1
89
07
B8
FF
E8
03

FE
F6
0D
3C
73
07
9D
FA
83
64
98
00

4B
C3
FF
03
11
8B
E1
EB
B2
24
68
00

FD
6B
E8
C2
EB
0C
4B
01
DC
FC
EA
00

82
B7
01
89
06
01
40
FF
12
FF
83
EB

2C
00
00
85
9A
03
00
EB
05
EA
C0
04

24
00
00
CD
72
CA
53
04
44
EB
21
FA

[PESpin v1:1 -> Cyberbob (h)]

signature = EB 01 68 60 E8 00
7D DE 46 00 0B E4 74 9E 75 01
F9 FF E3 C9 C2 08 00 A3 68 72
00 EA 5A 83 EA 0B FF E2 EB 04
4B 40 00 EB 02 12 77 F9 72 08
ED 1F EB 07 F5 72 0E F5 72 F8
E8 03 00 00 00 EB 04 9A EB FB
8F 85 D7 49 40 00 BB ?? 00 00
E3 EB F8 69 30 1C 39 FE CB 49
4D 23 ED F7 64 24 08 8D 84 28
01 C8 E8 01 00 00 00 68 58 FE
80 40 FB EB A2 40 02 00 E0 91
EB FB 68 83 04 24 0C C3
ep_only = true

[PESpin V1:1 -> cyberbob]

signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24
7D DE 46 00 0B E4 74 9E
ep_only = true
[PESpin v1:1 by cyberbob]
signature = EB 01 68 60 E8
7D DE 46 00 0B E4 74 9E 75
F9 FF E3 C9 C2 08 00 A3 68
00 EA 5A 83 EA 0B FF E2 EB
4B 40 00 EB 02 12 77 F9 72
ED 1F EB 07 F5 72 0E F5 72
E8 03 00 00 00 EB 04 9A EB
8F 85 D7 49 40 00 BB ?? 00
E3 EB F8 69 30 1C 39 FE CB
ep_only = false

00
01
72
04
08
F8
FB
00
49

00
C7
01
9A
73
68
00
00
9C

00
81
FF
EB
0E
EB
83
B9

00
73
5D
04
F9
EC
04
FE

8B
04
33
00
83
83
24
11

1C
D7
C9
EB
04
04
0C
00

24
7A
41
FB
24
24
C3
00

83
F7
E2
FF
17
07
3B
8D

[PESPin v1:3 -> Cyberbob (h)]

-173-

C3
2F
17
8B
C3
F5
8B
BD

12
81
EB
95
E8
FF
59
71

81
73
07
C3
04
34
10
4C

2B
19
EA
4B
00
24
03
40

E8
77
EB
40
00
C3
DA
00

B1
00
01
00
00
41
8B
4F

06
43
EB
8B
0F
C1
1B
EB

00
B7
EB
42
F5
E1
89
07

FE
F6
0D
3C
73
07
9D
FA

4B
C3
FF
03
11
8B
E1
EB

FD
6B
E8
C2
EB
0C
4B
01

82
B7
01
89
06
01
40
FF

2C
00
00
85
9A
03
00
EB

24
00
00
CD
72
CA
53
04

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

signature = EB
AC DF 46 00 0B
F9 FF E3 C9 C2
00 EA 5A 83 EA
4F 40 00 EB 02
ED 1F EB 07 F5
E8 03 00 00 00
8F 85 21 4D 40
8D 5B 04 8B 1B
73 CE 2F B1 03
ep_only = true

01
E4
08
0B
12
72
EB
00
89
E0

68
74
00
FF
77
0E
04
EB
9D
F7

[PESpin v1:304
signature = EB
88 DF 46 00 0B
F9 FF E3 C9 C2
00 EA 5A 83 EA
4E 40 00 EB 02
ED 1F EB 07 F5
E8 03 00 00 00
8F 85 E1 4C 40
8D 5B 04 8B 1B
73 CE 2F B1 03
00 8D BD C6 4F
04 CD EB FB 2B
08 8D 84 28 20
00 00 68 58 FE
40 02 00 E0 91
24 0C C3 8D C0
F7 14 24 83 24
44 24 08 5A 58
ep_only = true

->
01
E4
08
0B
12
72
EB
00
89
E0
40
C1
2F
48
32
0C
24
8D

E8
75
68
EB
72
72
EB
FA
4F
81

04 August 2015 15:14

00
C7
01
9A
73
68
00
01
00
04

00
81
FF
EB
0E
EB
83
FF
E8
13

00
73
5D
04
F9
EC
04
EB
00
37

8B
04
33
00
83
83
24
04
00
CF

1C
D7
C9
EB
04
04
0C
E3
00
E1

24
7A
41
FB
24
24
C3
EB
00
FF

83
F7
E2
FF
17
07
3B
F8
58
64

C3
2F
17
8B
C3
F5
8B
69
01
24

12
81
EB
95
E8
FF
59
8B
68
FC

81
73
07
0D
04
34
10
59
05

2B
19
EA
4F
00
24
03
38
68

E8
77
EB
40
00
C3
DA
03
F7

B1
00
01
00
00
41
8B
DA
65

06
43
EB
8B
0F
C1
1B
8B
0F

00
B7
EB
42
F5
E1
89
3B
E2

FE
F6
0D
3C
73
07
9D
89
B8

4B
C3
FF
03
11
8B
2B
BD
77

FD
6B
E8
C2
EB
0C
4F
D0
CE

82
B7
01
89
06
01
40
4F
2F

2C
00
00
85
9A
03
00
40
B1

24
00
00
17
72
CA
53
00
35

Cyberbob
68 60 E8
74 9E 75
00 A3 68
FF E2 EB
77 F9 72
0E F5 72
04 9A EB
EB 07 FA
9D 95 4F
F7 D8 81
00 4F EB
2C 24 06
40 00 89
1F 0F 84
68 CB 00
39 02 49
01 50 52
64 24 04

(h)]
00 00
01 C7
72 01
04 9A
08 73
F8 68
FB 00
EB 01
40 00
2C 04
07 FA
F7 14
44 24
94 02
00 00
9C E8
B8 61
FF 64

00
81
FF
EB
0E
EB
83
FF
E8
13
EB
24
08
00
59
03
B2
24

00
73
5D
04
F9
EC
04
EB
00
37
01
83
5A
00
8D
00
DC
FC

8B
04
33
00
83
83
24
04
00
CF
FF
24
58
75
BD
00
12
9A

1C
D7
C9
EB
04
04
0C
E3
00
E1
EB
24
8D
01
7E
00
05

24
7A
41
FB
24
24
C3
EB
00
FF
04
01
64
9A
61
EB
44

83
F7
E2
FF
17
07
3B
F8
58
64
E3
50
24
81
40
04
4D

C3
2F
17
8B
C3
F5
8B
69
01
24
EB
52
04
70
00
8D
23

12
81
EB
95
E8
FF
59
8B
68
FC
F8
B8
FF
03
E8
EB
ED

81
73
07
CD
04
34
10
59
05
FF
69
79
64
E8
03
FB
F7

2B
19
EA
4E
00
24
03
38
68
25
30
B2
24
98
00
FF
64

E8
77
EB
40
00
C3
DA
03
D3
10
1C
DC
FC
68
00
83
24

B1
00
01
00
00
41
8B
DA
65
BB
39
12
FF
EA
00
04
08

06
43
EB
8B
0F
C1
1B
8B
0F
??
FE
05
EA
83
EB
24
8D

00
B7
EB
42
F5
E1
89
3B
E2
00
CB
44
EB
C0
04
0C
84

FE
F6
0D
3C
73
07
9D
89
B8
00
49
4D
EB
21
FA
C3
28

4B
C3
FF
03
11
8B
EB
BD
77
00
9C
23
01
80
EB
A3
B2

FD
6B
E8
C2
EB
0C
4E
90
CE
B9
EB
ED
C8
40
FB
C1
2F

82
B7
01
89
06
01
40
4F
2F
84
04
F7
E8
FB
68
2C
40

2C
00
00
85
9A
03
00
40
B1
12
01
64
01
EB
83
24
00

24
00
00
D7
72
CA
53
00
35
00
EB
24
00
A2
04
06
89

[PESpin v1:304 -> Cyberbob

signature = EB 01 68 60 E8
88 DF 46 00 0B E4 74 9E 75
F9 FF E3 C9 C2 08 00 A3 68
00 EA 5A 83 EA 0B FF E2 EB
4E 40 00 EB 02 12 77 F9 72
ED 1F EB 07 F5 72 0E F5 72
E8 03 00 00 00 EB 04 9A EB
8F 85 E1 4C 40 00 EB 07 FA
8D 5B 04 8B 1B 89 9D 95 4F
73 CE 2F B1 03 E0 F7 D8 81
00 8D BD C6 4F 40 00 4F EB
0E P_ ON LY = T RU E
ep_only = true

(h)]
00 00
01 C7
72 01
04 9A
08 73
F8 68
FB 00
EB 01
40 00
2C 04
07 FA

00
81
FF
EB
0E
EB
83
FF
E8
13
EB

00
73
5D
04
F9
EC
04
EB
00
37
01

8B
04
33
00
83
83
24
04
00
CF
FF

1C
D7
C9
EB
04
04
0C
E3
00
E1
EB

24
7A
41
FB
24
24
C3
EB
00
FF
04

83
F7
E2
FF
17
07
3B
F8
58
64
E3

C3
2F
17
8B
C3
F5
8B
69
01
24
EB

12
81
EB
95
E8
FF
59
8B
68
FC
F8

81
73
07
CD
04
34
10
59
05
FF
69

2B
19
EA
4E
00
24
03
38
68
25
30

E8
77
EB
40
00
C3
DA
03
D3
10
1C

B1
00
01
00
00
41
8B
DA
65
BB
39

06
43
EB
8B
0F
C1
1B
8B
0F
??
FE

00
B7
EB
42
F5
E1
89
3B
E2
00
CB

FE
F6
0D
3C
73
07
9D
89
B8
00
49

4B
C3
FF
03
11
8B
EB
BD
77
00
9C

FD
6B
E8
C2
EB
0C
4E
90
CE
B9
EB

82
B7
01
89
06
01
40
4F
2F
84
04

2C
00
00
85
9A
03
00
40
B1
12
01

24
00
00
D7
72
CA
53
00
35
00
EB

[PESpin v1:304
signature = EB
88 DF 46 00 0B
F9 FF E3 C9 C2
00 EA 5A 83 EA
4E 40 00 EB 02
ED 1F EB 07 F5
E8 03 00 00 00
8F 85 E1 4C 40
8D 5B 04 8B 1B
73 CE 2F B1 03
00 8D BD C6 4F
ep_only = true

(h)]
00 00
01 C7
72 01
04 9A
08 73
F8 68
FB 00
EB 01
40 00
2C 04
07 FA

00
81
FF
EB
0E
EB
83
FF
E8
13
EB

00
73
5D
04
F9
EC
04
EB
00
37
01

8B
04
33
00
83
83
24
04
00
CF
FF

1C
D7
C9
EB
04
04
0C
E3
00
E1
EB

24
7A
41
FB
24
24
C3
EB
00
FF
04

83
F7
E2
FF
17
07
3B
F8
58
64
E3

C3
2F
17
8B
C3
F5
8B
69
01
24
EB

12
81
EB
95
E8
FF
59
8B
68
FC
F8

81
73
07
CD
04
34
10
59
05
FF
69

2B
19
EA
4E
00
24
03
38
68
25
30

E8
77
EB
40
00
C3
DA
03
D3
10
1C

B1
00
01
00
00
41
8B
DA
65
BB
39

06
43
EB
8B
0F
C1
1B
8B
0F
??
FE

00
B7
EB
42
F5
E1
89
3B
E2
00
CB

FE
F6
0D
3C
73
07
9D
89
B8
00
49

4B
C3
FF
03
11
8B
EB
BD
77
00
9C

FD
6B
E8
C2
EB
0C
4E
90
CE
B9
EB

82
B7
01
89
06
01
40
4F
2F
84
04

2C
00
00
85
9A
03
00
40
B1
12
01

24
00
00
D7
72
CA
53
00
35
00
EB 0

->
01
E4
08
0B
12
72
EB
00
89
E0
40

60
9E
A3
E2
F9
F5
9A
07
D5
D8

Cyberbob
68 60 E8
74 9E 75
00 A3 68
FF E2 EB
77 F9 72
0E F5 72
04 9A EB
EB 07 FA
9D 95 4F
F7 D8 81
00 4F EB

00
01
72
04
08
F8
FB
EB
40
2C

-174-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

[PESpin v1:304
signature = EB
88 DF 46 00 0B
F9 FF E3 C9 C2
ep_only = true

->
01
E4
08

04 August 2015 15:14

Cyberbob]
68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24
74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00
00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF

[PESpin v1:3beta -> Cyberbob (h)]

signature = EB 01 68 60 E8 00 00 00
71 DF 46 00 0B E4 74 9E 75 01 C7 81
F9 FF E3 C9 C2 08 00 A3 68 72 01 FF
00 EA 5A 83 EA 0B FF E2 EB 04 9A EB
4E 40 00 EB 02 12 77 F9 72 08 73 0E
ED 1F EB 07 F5 72 0E F5 72 F8 68 EB
E8 03 00 00 00 EB 04 9A EB FB 00 83
8F 85 ?? 4C 40 00 EB 07 FA EB 01 FF
8D 5B 04 8B 1B 89 9D ?? 4F 40 00 E8
73 CE 2F B1 03 E0 F7 D8 81 2C 04 13
00 8D BD ?? 4F 40 00 4F EB 07 FA EB
ep_only = true

00
73
5D
04
F9
EC
04
EB
00
37
01

8B
04
33
00
83
83
24
04
00
CF
FF

1C
D7
C9
EB
04
04
0C
E3
00
E1
EB

24
7A
41
FB
24
24
C3
EB
00
FF
04

83
F7
E2
FF
17
07
3B
F8
58
64
E3

C3
2F
17
8B
C3
F5
8B
69
01
24
EB

12
81
EB
95
E8
FF
59
8B
68
FC
F8

81
73
07
??
04
34
10
59
05
FF
69

2B
19
EA
4E
00
24
03
38
68
25
30

E8
77
EB
40
00
C3
DA
03
BC
10
1C

B1
00
01
00
00
41
8B
DA
65
BB
39

06
43
EB
8B
0F
C1
1B
8B
0F
??
FE

00
B7
EB
42
F5
E1
89
3B
E2
00
CB

FE
F6
0D
3C
73
07
9D
89
B8
00
49

4B
C3
FF
03
11
8B
??
BD
77
00
9C

FD
6B
E8
C2
EB
0C
4E
??
CE
B9

82
B7
01
89
06
01
40
4F
2F
84

2C
00
00
85
9A
03
00
40
B1
12

24
00
00
??
72
CA
53
00
35
00

[PeStubOEP v1:x]
signature = 90 33 C9 33 D2 B8 ?? ?? ?? 00 B9 FF
ep_only = false
[PeStubOEP v1:x]
signature = ?? ?? B8 ?? ?? ?? 00 FF E0
ep_only = false
[PEStubOEP v1:x]
signature = 40 48 BE 00 ?? ?? 00 40 48 60 33 C0 B8 ?? ?? ?? 00 FF E0 C3 C3
ep_only = false
[PeStubOEP v1:x]
signature = 90 ?? 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0
ep_only = false
[PeStubOEP v1:x]
signature = E8 05 00 00 00 33 C0 40 48 C3 E8 05
ep_only = false
[Petite 1:2 ->
signature = 66
00 0F 00 11 00
A3 00 C3 00 E3
03 04 04 04 04
00 21 00 31 00
01 18 01 20 01
09 0A 0A 0B 0B
50 8B C8 8B D0
50 80 04 24
ep_only = true

(c)1998 Ian
9C 60 E8 CA
13 00 17 00
00 02 01 00
05 05 05 05
41 00 61 00
30 01 40 01
0C 0C 0D 0D
81 C1 ?? D2

Luck (h)]
00 00 00 03
1B 00 1F 00
00 00 00 00
00 70 70 01
81 00 C1 00
60 00 00 00
10 11 12 00
00 00 81 C2

[Petite 1:2 ->

signature = 66
00 0F 00 11 00
A3 00 C3 00 E3
ep_only = true

(c)1998 Ian
9C 60 E8 CA
13 00 17 00
00 02 01 00

Luck]
00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D
1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00
00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02

00
23
00
00
01
00
08
??

04
00
00
02
01
01
07
??

00
2B
00
00
81
01
09
00

05
00
00
03
01
02
06
00

00
33
00
00
01
02
0A
89

06
00
00
04
02
03
05
20

00
3B
00
00
01
03
0B
8B

07
00
01
05
03
04
04
E1

00
43
01
00
01
04
0C
50

08
00
01
07
04
05
03
81

00
53
01
00
01
05
0D
2C

[Petite 1:2]
signature = 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00
ep_only = true
-175-

09
00
02
09
06
06
02
24

00
63
02
00
01
06
0E
00

0A
00
02
0D
08
07
01
??

00
73
02
00
01
07
0F
??

0B
00
03
11
0C
08
58
??

00
83
03
00
01
08
2C
FF

0D
00
03
19
10
09
08
30

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Petite 1:3 ->

signature = ??
00 ?? ?? 53 50
00 0F 84 DA 14
08 8B 0A F3 A5
00 00 00 85 C0
A0 45 52 52 4F
26 8B D0 66 81
00 00 56 57 8B
5E C3
ep_only = true

(c)1998 Ian
?? ?? ?? ??
80 04 24 08
00 00 8B 44
83 C2 0C FC
74 2E 5F 5F
52 21 00 43
C2 6D 01 6A
7C 24 0C 8B

Luck (h)]
?? 9C 60 50
50 80 04 24
24 18 F6 42
EB D4 8B 7A
58 5A 8B 4A
6F 72 72 75
10 8B D8 66
74 24 10 8B

[Petite 1:3 ->

signature = ??
00 ?? ?? 53 50
00 0F 84 DA 14
ep_only = true

(c)1998 Ian
?? ?? ?? ??
80 04 24 08
00 00 8B 44

Luck]
?? 9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00
50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A
24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03

8D
42
03
08
0C
70
05
4C

88
50
80
03
C1
74
66
24

00
80
74
F8
F9
20
01
14

??
04
19
8B
02
44
50
C1

??
24
FD
5A
F3
61
52
F9

??
61
80
04
AB
74
6A
02

8D
50
72
85
8B
61
00
F3

90
80
03
DB
4A
21
8B
A5

??
04
80
74
0C
00
13
8B

??
24
8B
13
83
8B
FF
4C

00
9D
F0
52
E1
64
14
24

00
50
8B
53
03
24
1A
14

8B
80
F8
57
F3
24
6A
83

DC
04
03
03
AA
8B
FF
E1

8B
24
72
02
83
04
FF
03

E1
BB
04
50
C2
24
93
F3

68
83
03
E8
10
83
??
A4

00
3A
7A
7B
EB
C4
??
5F

[Petite 1:3]
signature = 66 9C 60 50 8D 88 00 F0 00 00 8D 90 04 16 00 00 8B DC 8B E1
ep_only = false
[Petite 1:4 ->
signature = ??
54 BC 00 00 50
04 24 61 50 80
19 FD 80 72 03
8B 5A 04 85 DB
02 33 C0 F3 AB
74 20 44 61 74
77 01 50 52 6A
02 F3 A5 8B 4C
ep_only = true

(c)1998-99 Ian
?? ?? ?? ?? 66
8B C3 8D 90 ??
04 24 9D 50 80
80 8B F0 8B F8
74 13 52 53 57
8B 4A 0C 83 E1
61 21 00 8B 64
00 03 1B FF 13
24 14 83 E1 03

Luck (h)]
9C 60 50 8B
16 00 00 68
04 24 BB 83
03 72 04 03
03 02 50 E8
03 F3 AA 83
24 24 8B 04
6A FF FF 53
F3 A4 5F 5E

[Petite 1:4 ->

signature = ??
54 BC 00 00 50
04 24 61 50 80
ep_only = true

(c)1998-99 Ian
?? ?? ?? ?? 66
8B C3 8D 90 ??
04 24 9D 50 80

Luck]
9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0
16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80
04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6

D8
00
3A
7A
79
C2
24
08
C3

03
00
00
08
00
10
83
56

00
??
0F
8B
00
EB
C4
57

68
??
84
0A
00
9E
26
8B

54
51
D8
F3
85
45
8B
7C

BC
50
14
A5
C0
52
D0
24

00
80
00
83
74
52
66
0C

00
04
00
C2
30
4F
81
8B

6A
24
8B
0C
5F
52
C2
74

00
08
44
FC
5F
21
7E
24

FF
50
24
EB
58
00
01
10

50
80
18
D4
5A
43
6A
8B

14
04
F6
8B
8B
6F
10
4C

8B
24
42
7A
4A
72
8B
24

CC
42
03
08
0C
72
D8
14

8D
50
80
03
C1
75
66
C1

A0
80
74
F8
F9
70
05
F9

[Petite 1:4]
signature = 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC
ep_only = false
[Petite 2:1]
signature = 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8
ep_only = false
[Petite 2:2 ->
signature = ??
50 68 00 00 ??
08 00 00 57 6A
C6 ?? ?? 00 00
F8 03 72 04 03
03 F8 52 8D 34
81 FB 00 00 01
80 81 FF FF 68
33 C9 83 FB 00
FF FF FF 72 F2
ep_only = true

(c)1998-99 Ian
?? ?? ?? ?? 68
?? 8B 3C 24 8B
?? 6A 06 56 6A
F3 A5 FF D3 58
7A 08 F3 A5 83
01 EB 17 58 58
00 73 0E 68 60
80 F9 FF FF B6
7E A4 E8 AA FF
C3

Luck (h)]
?? ?? ?? ??
30 66 81 C7
04 68 80 08
8D 90 B8 01
C2 0C FC EB
58 5A 74 C4
C0 FF FF 68
07 EB 0C 68
FF FF 72 17

64
80
00
00
E2
E9
60
00
A4

FF
07
00
00
83
1C
FC
83
30

35
8D
57
8B
C2
FF
FF
FF
5F

-176-

00
74
FF
0A
10
FF
FF
FF
FF

00
06
D3
0F
8B
FF
B6
68
4B

00
08
83
BA
5A
02
05
00
EB

00
89
EE
F1
F4
D2
EB
FB
ED

64
38
08
1F
85
75
22
FF
41

89
8B
59
73
DB
07
81
FF
E8

25
5E
F3
16
74
8A
FB
B6
9B

00
10
A5
8B
D8
16
00
08
FF

00
50
59
04
8B
83
00
6A
FF

00
56
66
24
04
EE
04
00
FF

00
6A
83
FD
24
FF
00
32
13

66
02
C7
8B
8B
12
73
D2
C9

9C
68
68
F0
7A
D2
0E
4B
E8

60
80
81
8B
F8
C3
68
A4
94

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

[Petite 2:2 ->

signature = ??
50 68 00 00 ??
08 00 00 57 6A
ep_only = true

(c)1998-99 Ian
?? ?? ?? ?? 68
?? 8B 3C 24 8B
?? 6A 06 56 6A

04 August 2015 15:14

Luck]
?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60
30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80
04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66

[PEtite v1:2]
signature = 9C 60 E8 CA ?? ?? ?? 03 ?? 04 ?? 05 ?? 06 ?? 07 ?? 08
ep_only = true
[PEtite v1:3]
signature = ?? ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? F0 ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 68 ??
?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42
ep_only = true
[Petite v1:4]
signature = B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 ?? ?? ?? ?? 6A 00
ep_only = true
[PEtite v1:4]
signature = 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 14 8B CC
ep_only = true
[PEtite v1:4]
signature = ?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC
ep_only = true
[PEtite v2:0]
signature = B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 18 8B CC 8D A0
54 BC ?? ?? 8B C3 8D 90 E0 15 ?? ?? 68
ep_only = true
[Petite v2:1 (1)]
signature = B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60
50
ep_only = true
[Petite v2:1 (2)]
signature = B8 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66
9C 60 50
ep_only = true
[PEtite v2:1]
signature = B8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66
9C 60 50
ep_only = true
[PEtite v2:2 -> www:un4seen:com/petite]
signature = B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60
50
ep_only = true
[Petite v2:2 -> www:un4seen:com/petite]
signature = B8 00 ?0 4? 00 6? 00 ?? ?? 0? ?? ?? ?? ?? ?? 00 00
ep_only = false
[Petite v2:2 -> www:un4seen:com/petite]
signature = B8 00 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00
ep_only = true
[Petite v?:? (after v1:4)]
signature = B8 ?? ?? ?? ?? 66 9C 60 50 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 83
-177-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[PEtite vx:x]
signature = B8 ?? ?? ?? ?? 66 9C 60 50
ep_only = true
[PeX 0:99 (Eng) -> bart/CrackPl]
signature = E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
ep_only = false
[PeX 0:99 -> bartCrackPl]
signature = E9 F5 ?? ?? ?? 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
C4
ep_only = true
[PeX v0:99 (Eng) -> bart/CrackPl]
signature = E9 F5 00 00 00 0D 0A C4
C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
50 65 58 20 28 63 29 20 62 79 20 62
6C 65 61 73 65 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20 20 20 20 20
C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4
C4 C4 C4 C4 0D 0A 60 E8 01 00 00
ep_only = true

C4
C4
C4
61
20
20
C4
C4

C4
C4
C4
72
20
20
C4
C4

C4
C4
C4
74
20
20
C4
C4

C4
C4
C4
5E
20
20
C4
C4

C4
C4
C4
43
20
0D
C4
C4

C4
C4
C4
72
20
0A
C4
C4

C4
C4
C4
61
20
C4
C4
C4

C4
C4
C4
63
20
C4
C4
C4

C4
C4
C4
6B
20
C4
C4
C4

C4
C4
C4
50
20
C4
C4
C4

C4
C4
C4
6C
20
C4
C4
C4

C4
C4
C4
20
20
C4
C4
C4

C4
C4
C4
62
20
C4
C4
C4

C4
C4
C4
65
20
C4
C4
C4

C4
C4
C4
74
20
C4
C4
C4

C4
C4
C4
61
20
C4
C4
C4

C4
C4
0D
20
20
C4
C4
C4

C4
C4
0A
72
20
C4
C4
C4

C4
C4
20
65
20
C4
C4
C4

[pex V0:99 -> params]

signature = E9 F5 00 00 00
ep_only = true
[PEX v0:99]
signature = 60 E8 01 ?? ?? ?? ?? 83 C4 04 E8 01 ?? ?? ?? ?? 5D 81
ep_only = true
[PEZip 1:0 by BaGIE]
signature = D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7
A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00
00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51
ep_only = false
[PEZip v1:0 by BaGIE]
signature = D9 D0 F8 74
A0 55 66 C1 C8 B0 5D 81
00 87 E8 E2 07 E3 05 17
83 F6 00 3D CB 60 47 92
BA 9F FA FF FF 52 57 77
7A 05 3D DF DA AC D1 05
7B 06 53 66 BB 74 EF 5B
55 6A 97 83 C4 04 5D E2
71 06 52 66 A9 6E E3 5A
ep_only = false

02
E6
5D
50
04
00
F8
E8
51

23
FF
47
40
78
00
8B
59
0F

DB
FF
E4
58
02
00
3C
53
B6

F5
FF
42
FC
84
00
24
55

F5
FF
41
E2
E4
73
83
51

50
F8
7F
EE
5F
05
C4
66

51
77
06
59
5A
71
04
83

52
07
50
F8
50
03
51
E9

53
52
66
7C
80
7E
0F
00

8D
76
83
08
EF
01
B6
59

44
03
EE
53
00
90
C9
5D

24
72
00
74
58
EB
66
5B

10
01
58
04
50
02
C1
F8

50
90
25
78
81
EB
C7
01

55
5A
FF
02
E0
05
30
FA

56
C1
FF
84
FF
E8
0B
22

57
E0
FF
C9
FF
F9
D2
C9

D9
60
FF
5B
FF
FF
53
7A

D0
90
51
66
FF
FF
66
02

22
BD
0F
0B
58
FF
83
8D

C9
1F
B6
ED
3C
83
FD
3F

C1
01
C9
F8
EF
C0
F6
79

F7
00
66
F5
FC
00
5B
08

[PGMPACK v0:13]
signature = FA 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8
?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3
ep_only = true
[PGMPACK v0:14]
signature = 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ??
-178-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

?? BB ?? ?? BA ?? ?? 8A C3 8B F3
ep_only = true
[PGPROT]
signature = E9 J1 J1 2E ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 0E 1F 8C C0 01 ?? ?? ?? 01 ??
?? ?? 26 ?? ?? ?? ?? 07 32 C0 33 FF B9 ?? ?? F2 AE
ep_only = true
[Phar Lap DOS Extender 1986-91]
signature = EB J3 8C D8 8E C0 B8 ?? ?? 8E D8 BB ?? ?? 8C C0 2B D8 81 ?? ?? ?? B4 4A CD 21
ep_only = true
[Phoenix Protector v1:0/v1:1 -> NTCore:com]
signature = 02 6F ?? ?? ?? 0A 0A 06 8D ?? ?? ?? 01 0B 16 0C 38 36 00 00 00 02 08 6F ?? ?? ??
0A 0D 09 06 08 59 61 D2 13 04 09 1E 63 08 61 D2 13 05 07 08 11 05 1E 62 11 04 60 D1 9D 08 17
58 0C 08 07 8E 69 38 0B 00 00 00 28 ?? ?? ?? 0A 2A 38 EC FF FF FF 3F C0 FF FF FF
ep_only = true
[Phonebook configuration file Version %v3:%v4]
signature = 50 68 6F 6E 65 62 6F 6F 6B ?? ?? ?? ?? ?? ?? ?? ?? ?? V3 ?? V4 ?? 63 6F
ep_only = false
[Phonebook configuration file Version %v3:%v4]
signature = 50 68 6F 6E 65 62 6F 6F 6B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 63 6F
ep_only = false
[Pi Cryptor 1:0 signature = 55 8B
68 36 1F 06 00 64
EC 31 C0 E8 4E F4
ep_only = true

by
EC
FF
FF

Scofield]
83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55
30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55
FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF

[Pi Cryptor 1:0 signature = 55 8B

68 36 1F 06 00 64
EC 31 C0 E8 4E F4
53 E8 CD FA FF FF
E8 E3 F1 FF FF 89
EA 72 01 00 00 8B
ep_only = true

by
EC
FF
FF
8B
C6
C6

Scofield]
83 C4 EC 53
30 64 89 20
FF 8B 45 EC
F8 81 EF AC
6A 00 68 28
E8 55 FE FF

56
6A
E8
26
31
FF

57
00
F6
00
06
89

31
68
F7
00
00
C6

C0
80
FF
6A
57
89

89
00
FF
00
56
F0

45
00
50
6A
53
09

EC
00
E8
00
E8
C0

B8
6A
CC
68
AE
74

40
03
FA
AC
FA
05

1E
6A
FF
26
FF
E8

06
00
FF
00
FF
A8

00
6A
8B
00
53
FB

E8
01
D8
53
E8
FF

48
68
83
E8
80
FF

FA
00
FB
DE
FA
31

FF
00
FF
FA
FF
C0

FF
00
74
FF
FF

33
80
4E
FF
89

C0
8D
6A
89
FA

55
55
00
F8
81

[PIRIT v1:5]
signature = B4 4D CD 21 E8 ?? ?? FD E8 ?? ?? B4 51 CD 21
ep_only = true
[PKLITE v1:00; v1:03]
signature = B8 ?? ?? BA ?? ?? 8C DB 03 D8 3B
ep_only = true
[PKLITE v1:00c (1)]
signature = 2E 8C 1E ?? ?? 8B 1E ?? ?? 8C DA 81 C2 ?? ?? 3B DA 72 ?? 81 EB ?? ?? 83 EB ?? FA
8E D3 BC ?? ?? FB FD BE ?? ?? 8B FE
ep_only = true
[PKLITE v1:00c (2)]
signature = BA ?? ?? A1 ?? ?? 2D ?? ?? 8C CB 81 C3 ?? ?? 3B C3 77 ?? 05 ?? ?? 3B C3 77 ?? B4
09 BA ?? ?? CD 21 CD 20 90
ep_only = true
[PKLITE v1:12; v1:15; v1:20 (1)]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 73 ?? 2D ?? ?? FA 8E D0 FB 2D ?? ?? 8E C0
50 B9 ?? ?? 33 FF 57 BE ?? ?? FC F3 A5 CB B4 09 BA ?? ?? CD 21 CD 20
-179-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[PKLITE v1:12; v1:15; v1:20 (2)]
signature = B8 ?? ?? BA ?? ?? 3B C4 73
ep_only = true
[PKLITE v1:14; v1:15; v1:20 (3)]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B ?? ?? ?? 72 ?? B4 09 BA ?? 01 CD 21 CD 20 4E 6F
ep_only = true
[PKLITE v1:14; v1:20]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 20
ep_only = true
[PKLITE v1:20 [extra]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 J3 8B FC 81 ?? ?? ?? 57 57 52 B9 ?? ??
BE ?? ?? 8B FE FD 49 74 ?? AD 92 03 C2
ep_only = true
[PKLITE v1:20 [extra]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 J3 8B FC 81 ?? ?? ?? 57 57 52 80
ep_only = true
[PKLITE v1:20 [extra]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 J3 2D ?? ?? FA 8E D0 BC ?? ?? FB 2D ??
?? 50 52 80
ep_only = true
[PKLITE v1:20]
signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 B4 4C CD 21
ep_only = true
[PKLITE v1:50 (1)]
signature = 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 ?? BA ?? ?? CD 21 B8 ?? ?? CD
21
ep_only = true
[PKLITE v1:50 (Device driver compression)]
signature = B4 09 BA 14 01 CD 21 B8 00 4C CD 21 F8 9C 50 53 51 52 56 57 55 1E 06 BB
ep_only = true
[PKLITE v2:00b
signature = 50
21 ?? ?? ?? ??
EA ?? ?? ?? ??
ep_only = true

[extra]]
B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
F3 A5 C3 59 2D ?? ?? 8E D0 51 2D ?? ?? 50 80

[PKLITE v2:00b]
signature = 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD
21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
59 2D ?? ?? 8E D0 51 2D ?? ?? 8E C0 50 B9
ep_only = true
[PKLITE v2:00c]
signature = 50 B8 ?? ?? BA ?? ?? 3B C4 73 ?? 8B C4 2D ?? ?? 25 ?? ?? 8B F8 B9 ?? ?? BE ?? ??
FC
ep_only = true
[PKLITE32 1:1 -> PKWARE Inc:]
signature = 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 00 00 00 00 E8 ?? ?? ?? ?? E9
ep_only = true

-180-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[PKLITE32 1:1]
signature = 50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31
ep_only = true
[PKLITE32 v1:1]
signature = 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 00 00 00 00 E8
ep_only = true
[PKLITE32 v1:1]
signature = 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 44 24 0C 50
ep_only = true
[PKLITE32 v1:1]
signature = 55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 00 00 00 5D C2 0C 00 8B 45 0C 57 56 53
8B 5D 10
ep_only = true
[PKLITE32 v1:1]
signature = 55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 ?? ?? ?? 5D C2 0C ?? 8B 45 0C 57 56 53
8B 5D 10
ep_only = false
[PKLITE32 v1:1]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? 50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31
ep_only = true
[Pksmart 1:0b]
signature = BA ?? ?? 8C C8 8B C8 03 C2 81 ?? ?? ?? 51 B9 ?? ?? 51 1E 8C D3
ep_only = true
[PKTINY v1:0 with TINYPROG v3:8]
signature = 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? E9 ?? ?? E8 ?? ?? 83
ep_only = true
[PKZIP-SFX v1:1 1989-90]
signature = FC 2E 8C 0E ?? ?? A1 ?? ?? 8C CB 81 C3 ?? ?? 3B C3 72 ?? 2D ?? ?? 2D ?? ?? FA BC
?? ?? 8E D0 FB
ep_only = true
[PLINK86 1984; 1985]
signature = FA 8C C7 8C D6 8B CC BA ?? ?? 8E C2 26
ep_only = true
[PluginToExe v1:00 -> BoB / BobSoft]
signature = E8 00 00 00 00 29 C0 5D 81
FF 95 B4 40 40 00 89 85 11 40 40 00 50
40 00 89 85 0D 40 40 00 8B 9D 09 40 40
68 44 69 45 50 FF B5 0D 40 40 00 6A 00
ep_only = true

ED
FF
00
81

D1
95
60
C3

40
C0
6A
??

40
40
00
??

00
40
6A
??

50
00
01
00

FF
8A
53
FF

95
08
81
D3

B8
80
C3
83

40
F9
??
C4

40
22
??
10

00
75
??
FF

89
07
00
95

85
50
FF
B0

09
FF
D3
40

40
95
61
40

40 00
C4 40
6A 00
00

[PluginToExe v1:01 -> BoB / BobSoft]

signature = E8 00 00 00 00 29 C0 5D 81
00 89 85 6D 40 40 00 FF 95 A1 41 40 00
07 50 FF 95 B9 41 40 00 89 85 75 40 40
41 40 00 89 85 69 40 40 00 89 C7 68 00
00 00 C7 47 20 00 08 00 00 C7 47 18 01
0C 8D 8D DB 40 40 00 89 4F 30 FF B5 69
8B 9D 6D 40 40 00 60 6A 00 6A 01 53 81
40 40 00 6A 00 81 C3 ?? ?? 00 00 FF D3
41 40 00 57 FF 95 AD 41 40 00 6A 00 FF
ep_only = true

ED
50
00
08
00
40
C3
83
95

C6
FF
EB
00
00
40
??
C4
9D

41
95
6C
00
00
00
??
10
41

40
B5
6A
6A
C7
FF
??
83
40

00
41
01
40
47
95
00
BD
00

50
40
8F
FF
34
95
FF
71

8F
00
85
95
04
41
D3
40

85
80
71
A9
10
40
61
40

71
38
40
41
88
00
6A
00

40
00
40
40
00
FF
00
00

40
74
00
00
8D
77
68
74

00
16
6A
89
8D
1C
44
10

50
8A
58
47
B9
8F
69
FF

FF
08
6A
1C
40
85
45
77

95
80
40
C7
40
75
50
1C

A5
F9
FF
07
00
40
FF
FF

41
22
95
58
89
40
B5
95

-181-

40
75
A9
00
4F
00
75
AD

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[PMODE/W v:1:12; 1:16; 1:21; 1:33 DOS extender]

signature = FC 16 07 BF ?? ?? 8B F7 57 B9 ?? ?? F3 A5 06 1E 07 1F 5F BE ?? ?? 06 0E A4
ep_only = true
[PocketPC ARM (h)]
signature = F0 41 2D E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A0 E1 ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? 00 00 50 E3 ?? 00 00 0A ?? ?? ?? ?? ?? ?? A0 ?? ?? ?? ?? ?? ?? ?? A0 ?? ?? ??
A0 E1 00 80 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A0 E1
ep_only = true
[PocketPC ARM]
signature = F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0
E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9 ?? ??
9F E5 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 9F E5 00 ?? ?? ?? ?? 00
ep_only = true
[PocketPC ARM]
signature = F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0
E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9
ep_only = true
[PocketPC MIB]
signature = E8
0C 00 00 00 00
40 00 14 00 BF
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? 00 ?? ??
?? ?? ?? ?? ??
00 ?? ?? ?? ??
?? ?? ?? ?? ??
ep_only = true

FF
18
8F
??
??
??
??
??
00

BD
00
08
??
??
00
??
??

27
A4
00
??
00
??
00
??

14
8F
E0
??
??
??
??
??

00
1C
03
??
00
??
??
??

BF
00
18
??
??
00
??
8C

AF
A5
00
??
??
??
??
??

18
8F
BD
00
??
??
??
??

00
20
27
??
??
??
??
??

A4
00
??
??
??
??
??
??

AF
A6
FF
??
??
??
??
??

1C
8F
BD
00
??
??
??
??

00
??
27
??
??
??
??
??

A5
??
18
??
??
00
??
??

AF
??
00
??
??
??
00
??

20
0C
??
??
??
??
??
??

00
24
AF
??
00
??
??
??

A6
00
??
??
??
??
??
??

AF
A7
00
??
??
??
??
??

24
8F
??
??
??
??
??
??

00
??
??
??
??
??
??
??

A7
??
??
??
??
??
??
00

AF
??
??
??
??
??
00
??

??
0C
??
??
??
??
01
??

??
25
??
??
??
??
3C
??

??
20
??
??
??
00
??
??

[PocketPC MIB]
signature = E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ??
0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20
40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF
ep_only = true
[PocketPC MIB]
signature = E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ??
0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20
40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF ?? 00
ep_only = true
[PocketPC SHA]
signature = 86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09
D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00
F6 68 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09
ep_only = true
[PocketPC SHA]
signature = 86
D0 B3 65 A3 66
F6 68 ?? ?? ??
D4 06 D5 0B 40
?? ?? ?? 00 ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? 00 ??

2F
93
00
09
??
??
??
??
??

96
67
??
00
??
??
??
??
??

2F
0B
??
10
??
??
??
??
??

A6
40
??
7F
??
??
??
??
??

2F
83
00
26
??
??
??
??
??

B6
64
??
4F
??
??
??
??
??

2F
03
??
0B
??
??
??
??
00

22
64
??
00
??
??
??
??

4F
04
00
09
??
??
??
??

43
D0
22
00
??
??
??
??

68
0B
4F
??
??
??
??
??

53
40
F0
??
??
??
??
??

-182-

6B
09
7F
??
7F
??
??
??

63
00
0A
00
??
??
??
??

6A
10
D0
??
??
??
??
??

73
7F
06
??
??
??
??
??

69
26
D4
??
??
??
??
??

F0
4F
06
00
??
??
??
??

7F
F6
D5
??
??
??
??
??

0B
6B
0B
??
??
??
??
??

D0
F6
40
??
??
??
??
??

0B
6A
09
00
??
??
??
??

40
F6
00
??
??
??
??
??

09
69
08
??
??
??
??
??

00
0B
D0
??
??
??
??
??

09
00
05
00
??
??
??
??

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[Pohernah 1:0:0 signature = 58 60
C0 05 83 F0 04 89
25 40 00 31 C0 3B
ep_only = true

by
E8
85
47

Kas]
00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B
92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A
10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28

[Pohernah 1:0:3 signature = 60 E8

BE 6A 27 40 00 EB
8B 8D 86 28 40 00
ep_only = true

by
00
02
30

Kas]
00 00 00 5D 81 ED 2A 27 40 00 31 C0 40 83 F0 06 40 3D 40 1F 00 00 75 07
EB EB 8B 85 9E 28 40 00 83 F8 01 75 17 31 C0 01 EE 3D 99 00 00 00 74 0C
0E 40 46 EB ED

[Pohernah Crypter
signature = 60 E8
28 40 00 01 E8 80
31 C0 51 31 C9 66
F8 02 75 06 81 C2
89 CE E8 27 00 00
EB 8A 8B 85 14 28
ep_only = true

V1:0:1 -> Kas * Sign:By:fly]

00 00 00 00 5D 81 ED F1 26 40
30 05 83 F9 00 74 71 81 7F 1C
B9 FA 00 66 83 F9 00 74 49 8B
00 02 00 00 51 8B 4F 10 83 F8
00 89 C1 5F B8 38 28 40 00 01
40 00 89 44 24 1C 61 FF E0

[Pohernah Crypter
signature = 60 E8
28 40 00 01 E8 80
31 C0 51 31 C9 66
ep_only = true

V1:0:1 -> Kas]

00 00 00 00 5D 81 ED F1 26 40 00 8B BD 18 28 40 00 8B 8D 20 28 40 00 B8 38
30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 1C 28 40 00
B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 1C 28 40 00 8B 85 24

[Pohernah Crypter
signature = 60 E8
28 40 00 01 E8 80
31 C0 51 31 C9 66
F8 02 75 06 81 C2
89 CE E8 27 00 00
EB 8A 8B 85 01 28
ep_only = true

V1:0:2 -> Kas * Sign:By:fly]

00 00 00 00 5D 81 ED DE 26 40
30 05 83 F9 00 74 71 81 7F 1C
B9 F7 00 66 83 F9 00 74 49 8B
00 02 00 00 51 8B 4F 10 83 F8
00 89 C1 5F B8 25 28 40 00 01
40 00 89 44 24 1C 61 FF E0

[Pohernah Crypter
signature = 60 E8
28 40 00 01 E8 80
31 C0 51 31 C9 66
ep_only = true

V1:0:2 -> Kas]

00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25
30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00
B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11

[PolyBox C -> Anskya]

signature = 55 8B EC 83
FF 30 64 89 20 EB 08 FC
?? ?? ?? ?? 85 DB 0F 84
01 00 00 53 A1 1C 71 00
85 DB 0F 84 3D 01 00 00
C4 04 A1 70 80 00 10 8B
D6 E8 F8 FD FF FF
ep_only = true
[PolyBox D -> Anskya]
signature = 55 8B EC 33
FF 00 B8 B8 46 40 00 BA
94 46 40 00 E8 71 FB FF
46 40 00 3B 05 B4 46 40
FF FF 8B 45 F4 BA 9C 2C
ep_only = false

00
AB
57
02
E8

00
AB
57
02
E8

8B
00
0C
75
E8

8B
00
0C
75
E8

BD
00
03
06
24

BD
00
03
06
24

18
00
95
81
00

05
00
95
81
00

28
75
1C
E9
00

28
75
09
E9
00

40
62
28
00
00

40
62
28
00
00

00
8B
40
02
59

00
8B
40
02
59

8B
57
00
00
49

8B
57
00
00
49

8D
0C
8B
00
EB

8D
0C
8B
00
EB

20
03
85
57
B1

0D
03
85
57
B1

28
95
24
BF
59

28
95
11
BF
59

40
1C
28
C8
83

40
09
28
C8
83

00
28
40
00
C7

00
28
40
00
C7

B8
40
00
00
28

B8
40
00
00
28

38
00
83
00
49

25
00
83
00
49

C4
FC
77
10
56
CE

F0
FC
01
50
B8
8B

53
FC
00
E8
70
D3

56
FC
00
E0
80
E8

B8
FC
53
E1
00
E1

E4
27
A1
FF
10
E1

41
54
1C
FF
B9
FF

00
6A
71
85
01
FF

10
0A
00
C0
00
6A

E8
68
10
0F
00
00

3A
20
50
84
00
6A

E1
44
E8
4D
8B
00

FF
00
1E
01
15
A1

FF
10
E2
00
98
70

33
A1
FF
00
41
80

C0
1C
FF
50
00
00

55
71
8B
E8
10
10

68
00
F0
DA
E8
B9

11
10
85
E1
9E
30

44
50
F6
FF
DE
44

00
E8
0F
FF
FF
00

10
CC
84
8B
FF
10

64
E1
61
D8
83
8B

C9
24
FF
00
40

51
00
84
0F
00

51
00
C0
85
E8

51
00
0F
51
F1

51
E8
84
01
ED

51
8C
6E
00
FF

53
F3
01
00
FF

33
FF
00
8D

C0
FF
00
45

55
6A
8B
F4

68
24
1D
BA

84
BA
D0
B8

2C
B8
46
46

40
46
40
40

00
40
00
00

64
00
8B
B9

FF
8B
C3
10

30
0D
83
00

64
B0
C0
00

89
46
24
00

20
40
03
E8

C6
00
05
A2

45
A1
D8
EC

-183-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[PolyCrypt PE - 2:1:4b/2:1:5 -> JLab Software Creations (h-oep)]

signature = 91 8B F4 AD FE C9 80 34 08 ?? E2 FA C3 60 E8 ED FF FF FF EB
ep_only = false
[PolyCrypt PE - 2:1:4b/2:1:5 -> JLab Software Creations (h-signed)]
signature = 50 6F 6C 79 43 72 79 70 74 20 50 45 20 28 63 29 20 32 30 30 34 2D 32 30 30 35 2C
20 4A 4C 61 62 53 6F 66 74 77 61 72 65 2E 00 50 00 43 00 50 00 45
ep_only = false
[PolyCryptor by SMT Version %v3:%v4]
signature = EB ?? 28 50 6F 6C 79 53 63 72 79 70 74 20 ?? ?? ?? 20 62 79 20 53 4D 54 29
ep_only = true
[PolyCryptor by SMT Version %v3:%v4]
signature = EB ?? 28 50 6F 6C 79 53 63 72 79 70 74 20 V3 ?? V4 20 62 79 20 53 4D 54 29
ep_only = true
[PolyEnE 0:01+ by Lennart Hedlund]
signature = 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 00 00 E0
ep_only = false
[PolyEnE V0:01+ -> Lennart Hedlund]
signature = 50 6F 6C 79 45 6E 45 00 4D 65 73 73 61 67 65 42 6F 78 41 00 55 53 45 52 33 32 2E
64 6C 6C
ep_only = false
[PoPa 0:01 (Packer on Pascal)
signature = 55 8B EC 83 C4 EC
68 BE 40 00 10 ?? ?? ?? ?? 89
EC 33 C0 E8 62 E7 FF FF 8B 45
93 40 00 10 64 FF 32 64 89 22
66 00 10 50 E8 9B F6 FF FF 83
6A 10 68 68 66 00 10 A1 64 66
ep_only = true

->
53
20
EC
83
E8
00

bagie]
56 57 33
6A 00 68
E8 32 F2
3D 64 66
10 50 A1
10 50 E8

C0
80
FF
00
64
8B

89
00
FF
10
66
F6

45
00
50
FF
00
FF

EC
00
E8
0F
10
FF

B8
6A
B4
84
50

A4
03
F6
3A
E8

3E
6A
FF
01
BC

00
00
FF
00
F6

10
6A
A3
00
FF

E8
01
64
6A
FF

30
68
66
00
6A

F6
00
00
6A
00

FF
00
10
00
68

FF
00
33
6A
80

33
80
D2
00
66

C0
8D
55
A1
00

55
55
68
64
10

[PowerBASIC/CC 3:0x]
signature = 55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? ?? 00 04 00 0F 85
ep_only = true
[PowerBASIC/CC 4:0]
signature = 55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 68 05 00
00 E9 6E 03
ep_only = true
[PowerBASIC/Win 7:0x]
signature = 55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 0F 85 DB 00 00 00
ep_only = true
[PowerBASIC/Win 8:00]
signature = 55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 14 04 00
00 E9 19 02
ep_only = true
[PPC-PROTECT 1:1X -> Alexey Gorchakov]
signature = FF 5F 2D E9 20 00 9F E5 00 00 90 E5 18 00 8F E5 18 00 9F E5 00 00 90 E5 10 00 8F
E5 01 00 A0 E3 00 00 00 EB 02 00 00 EA 04 F0 1F E5
ep_only = true
[Prepared by SLR (OPTLINK)]
signature = 87 C0 55 56 57 52 51 53 50 9C FC 8C DA 83 ?? ?? 16 07 0E 1F
ep_only = true
-184-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[PrincessSandy 1:0 eMiNENCE Process

signature = 68 27 11 40 00 E8 3C 01
0F B7 43 14 0F B7 4B 06 8D 7C 18 18
8B 5F 0C 03 1D 00 20 40 00 89 1D 04
ep_only = false

Patcher Patch]
00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8
81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00
20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08

[PrincessSandy v1:0 eMiNENCE Process Patcher

signature = 68 27 11 40 00 E8 3C 01 00 00 6A
0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E
8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00
00 6A 00 6A 20 6A 00 6A 00 6A 00 57 6A 00 E8
20 40 00 8B 07 8D 3C 07 83 C7 04 89 3D 04 20
57 60 6A 00 51 68 5C 20 40 00 53 FF 35 4C 20
5C 20 40 00 F3 A6 74 03 61 EB D2 60 6A 00 50
20 61 83 3C 07 00 74 2D 03 F8 EB A8 B8 5E 21
EB 05 B8 CF 21 40 00 6A 00 68 56
ep_only = false
[Private EXE Protector 1:8
signature = A4 B3 02 E8 6D
23 B3 02 41 B0 10 E8 4F 00
00 00 00 EB 28 AC D1 E8 74
0A 80 FC 05 73 06 83 F8 7F
05 8A 16 46 10 D2 C3 31 C9
ep_only = false

->
00
00
4D
77
41

SetiSoft
00 00 73
00 10 C0
11 C9 EB
02 41 41
E8 EE FF

(h)]
F6 31
73 F7
1C 91
95 89
FF FF

Patch]
00 E8 41
4C 4F 41
8B FB 83
CE 00 00
40 00 8B
40 00 E8
57 53 FF
40 00 EB

01
74
C7
00
0F
93
35
13

00
0B
04
85
83
00
4C
B8

00
83
68
C0
C7
00
20
7C

A3
C7
4C
74
04
00
40
21

00
28
20
78
8B
85
00
40

20
49
40
BD
1F
C0
E8
00

40
75
00
50
83
61
7A
EB

00
F2
68
C3
C7
74
00
0C

8B
E9
08
00
04
E1
00
B8

58
A7
20
00
4D
8B
00
9E

3C
00
40
8B
85
C1
85
21

03
00
00
3D
ED
60
C0
40

D8
00
6A
04
74
BE
74
00

C9
75
48
E8
11

00
EB
08
56
E7

00
D4
AC
89
FF

00
E8
E8
FE
FF

73
4D
2C
29
FF

1C
00
00
C6
72

31
00
00
F3
F2

C0
00
00
A4
C3

E8
29
3D
5E
31

5B
D9
00
EB
FF

00
75
7D
8E
31

00
10
00
00
F6

00
E8
00
D2
C3

73
42
73
75

8B
00
C0
44
16
03
16
00

7C
00
8D
24
83
D2
83
00

24
43
A4
0C
C6
75
C6
03

24
8D
24
88
04
08
04
D2

66
A4
00
07
F9
8B
F9
75

81
24
00
47
13
16
13
08

3E
00
00
EB
D2
83
D2
8B

4A
00
00
C6
0F
C6
73
16

43
00
05
03
83
04
42
83

0F
00
00
D2
DC
F9
BD
C6

85
8B
00
75
00
13
00
04

A5
FF
00
08
00
D2
01
F9

02
03
00
8B
00
13
00
13

E8
3F
C1
B3
C9

64
AA
E0
01
E8

[Private EXE Protector 1:8]

signature = BB DC EE 0D 76 D9 D0 8D 16 85 D8 90 D9 D0
ep_only = false
[Private EXE Protector 1:9:7 -> SetiSoft (h)]
signature = 55 8B EC 83 C4 F4 FC 53 57 56 8B 74
00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14
D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24
03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75
16 83 C6 04 F9 13 D2 0F 82 6E 01 00 00 03 D2 75
B9 04 00 00 00 33 C0 8D A4 24 00 00 00 00 8D 64
C0 49 75 EF 48 74 B1 0F 89 EF 01 00 00 03 D2 75
00 B9 08 00 00 00 33 C0 8D A4 24 00 00 00 00 05
D2 13 C0 49 75 EF 88 07 47 4D 75 D6
ep_only = false

24
08
10
EF
08
24
08
00

20
00
33
02
8B
00
8B
00

[Private EXE Protector 1:9:7 -> SetiSoft (h)]

signature = 55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02
00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03
D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05
ep_only = false
[Private Exe Protector 1:x -> setisoft]
signature = B8 ?? ?? ?? ?? B9 ?? 90 01 ?? BE ?? 10 40 ?? 68 50 91 41 ?? 68 01 ?? ?? ?? C3
ep_only = true
[Private EXE Protector 2:0 -> SetiSoft]
signature = 89 ?? ?? 38 00 00 00 8B ?? 00 00 00 00 81 ?? ?? ?? ?? ?? 89 ?? 00 00 00 00 81 ??
04 00 00 00 81 ?? 04 00 00 00 81 ?? 00 00 00 00 0F 85 D6 FF FF FF
ep_only = true
[Private exe Protector 2:15 -> SetiSoft Team]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00
ep_only = true
-185-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Private exe Protector V1:8X-V1:9X -> SetiSoft Team]

signature = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33
32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73
ep_only = false
[Private exe Protector V2:0 -> SetiSoft Team > Sign by fly]
signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00
00
ep_only = false
[Private exe Protector V2:30-V2:4X -> SetiSoft Team *
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ??
?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00
00 00 00 00 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00
ep_only = false

Sign:By:fly]
?? ?? ?? ?? ??
00 00 00 00 00
00 00 00 00 00
?? ?? ?? ?? ??
00 00 00 00 00

[Private exe Protector V2:5X-V2:6X -> SetiSoft Team *

signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ??
?? 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20
?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00
00 00 00 00 00 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00
ep_only = false

Sign:By:fly
?? ?? ?? ??
00 00 E0 ??
00 00 00 00
00 00 00 00
?? ?? ?? ??
?? ?? ?? ??
00 00 00 00

??
00
00
??
00

??
00
00
??
00

??
00
00
??
00

??
00
00
??
00

??
04
00
??
00

??
00
00
??

??
??
00
??

??
??
00
??

* 20080116]
?? ?? 00 10
?? ?? ?? ??
00 00 00 00
00 00 00 00
?? ?? ?? ??
?? ?? ?? ??
40 00 00 C0

00
??
00
00
??
??
00

00
??
00
00
??
??
00

??
??
04
00
??
??
00

??
??
00
00
??
??
00

??
??
??
00
??
??
00

01
00
37
00
10
28

00
00
D8
0A
37
8B

E8
10
8B
6A
00
0D

2E
6A
0D
07
10
30

04
64
7C
6A
6A
37

00
E8
37
00
00
00

[Private EXE v2:0a]

signature = 53 E8 ?? ?? ?? ?? 5B 8B C3 2D
ep_only = false
[Private EXE v2:0a]
signature = 53 E8 00 00 00 00 5B 8B C3 2D
ep_only = true
[Private Personal
signature = E8 17
00 E8 41 04 00 00
4E 04 00 00 E8 1F
00 10 2B C8 83 FB
E8 D3 03 00 00 A3
E8 EA 03 00 00 A3
10 8B 3D 28 37 00
ep_only = true

Packer (PPP) 1:0:2 -> ConquestOfTroy:com]

00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10
A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30
04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B
64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8
20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24
30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00
10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9

[Private Personal
signature = E8 17
00 E8 41 04 00 00
4E 04 00 00 E8 1F
ep_only = true

Packer (PPP) 1:0:2 -> ConquestOfTroy:com]

00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00
A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8
04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8

[Private Personal
signature = E8 19
04 00 00 E8 41 04
64 E8 4E 04 00 00
7C 37 00 10 2B C8
6A 00 E8 D3 03 00
6A 00 E8 EA 03 00

Packer (PPP) 1:0:3 -> ConquestOfTroy:com]

00 00 00 90 90 E8 68 00 00 00 FF 35 2C 37
00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00
E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00
83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A
00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00
00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2
-186-

E8
04
1D
D9
37
00

00
E8
10
00
A3
03

ED
00
78
03
00
A3

10
30
8B
E8
24
00

E8
04
1D
D9
37
00

00
A3
00
00
FF
37

ED
00
78
03
00
A3

00
78
10
C3
35
00

01
00
37
00
10
28

6A
37
2B
6A
20
10

00
A3
00
00
FF
37

00
78
10
C3
35
00

6A
37
2B
6A
20
10

00
00
D8
0A
37
8B

E8
10
8B
6A
00
0D

2E
6A
0D
07
10
30

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9
ep_only = true
[PrivateEXE v2:0a]
signature = 53 E8 ?? ?? ?? ?? 5B 8B C3 2D ?? ?? ?? ?? 50 81 ?? ?? ?? ?? ?? 8B
ep_only = true
[PrivateEXE v2:0a]
signature = 06 60 C8 ?? ?? ?? 0E 68 ?? ?? 9A ?? ?? ?? ?? 3D ?? ?? 0F ?? ?? ?? 50 50 0E 68 ??
?? 9A ?? ?? ?? ?? 0E
ep_only = true
[PRO-MIDI Music file]
signature = 52 49 46 46 ?? ?? ?? ?? 52 4D 49 44
ep_only = false
[PRO-PACK v2:08; emphasis on packed size; locked]
signature = 83 EC ?? 8B EC BE ?? ?? FC E8 ?? ?? 05 ?? ?? 8B C8 E8 ?? ?? 8B
ep_only = true
[PRO-PACK v2:08]
signature = 8C D3 8E C3 8C CA 8E DA 8B 0E ?? ?? 8B F1 83 ?? ?? 8B FE D1 ?? FD F3 A5 53
ep_only = true
[ProActivate V1:0X -> TurboPower
signature = 55 8B EC B9 0E 00 00
90 90 33 C0 55 68 ?? ?? ?? ?? 64
?? ?? ?? ?? 0D 00 00 00 E8 85 E2
43 52 43 33 75 6E 81 3D ?? ?? ??
3D ?? ?? ?? ?? 43 52 43 33 75 4A
7E 40 75 32 81 3D ?? ?? ?? ?? 43
ep_only = true

Software
00 6A 00
FF 30 64
FF FF 81
?? 32 40
81 3D ??
52 43 33

Company > Sign

6A 00 49 75 F9
89 20 A1 ?? ??
3D ?? ?? ?? ??
7E 7E 75 62 81
?? ?? ?? 32 40

by
51
??
21
3D
7E

fly]
53 56
?? 83
7E 7E
?? ??
7E 75

[ProActivate V1:0X -> TurboPower

signature = 55 8B EC B9 0E 00 00
90 90 33 C0 55 68 ?? ?? ?? ?? 64
?? ?? ?? ?? 0D 00 00 00 E8 85 E2
ep_only = true

Software
00 6A 00
FF 30 64
FF FF 81

Company]
6A 00 49 75 F9 51 53 56 57 B8 ?? ?? ?? ?? 90 90 90
89 20 A1 ?? ?? ?? ?? 83 C0 05 A3 ?? ?? ?? ?? C7 05
3D ?? ?? ?? ?? 21 7E 7E 40 75 7A 81 3D

57
C0
40
??
3E

B8
05
75
??
81

??
A3
7A
21
3D

??
??
81
7E
??

??
??
3D
7E
??

??
??
??
40
??

90
??
??
75
??

90
C7
??
56
21

90
05
??
81
7E

[Program Protector XP v1:0]

signature = E8 ?? ?? ?? ?? 58 83 D8 05 89 C3 81 C3 ?? ?? ?? ?? 8B 43 64 50
ep_only = true
[Protect Shareware 1:1 -> eCompserv
signature = 53 00 74 00 72 00 69 00
00 00 00 ?? 01 00 00 01 00 30 00 34
01 00 43 00 6F 00 6D 00 70 00 61 00
ep_only = false
[Protect Shareware V1:1
signature = 53 00 74 00
00 00 00 ?? 01 00 00 01
01 00 43 00 6F 00 6D 00
00 77 00
ep_only = false

->
72
00
70

CMS]
6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F
00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00
6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00

eCompserv CMS]
00 69 00 6E 00 67 00 46 00 69 00 6C 00 65 00 49 00 6E 00 66 00 6F
30 00 34 00 30 00 39 00 30 00 34 00 42 00 30 00 00 00 34 00 ?? 00
00 61 00 6E 00 79 00 4E 00 61 00 6D 00 65 00 00 00 00 00 4A 00 76

[PROTECT> EXE/COM v4:0]

signature = E9 J1 J1 E8 ?? ?? 5D 81 ED ?? ?? 33 C0 8E D8 8B F0 BF ?? ?? B9 ?? ?? FC F3 A5
ep_only = true
[PROTECT> EXE/COM v5:0]
signature = 1E 0E 0E 1F 07
-187-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[PROTECT> EXE/COM v6:0]
signature = 1E B4 30 CD 21 3C 02 73 ?? CD 20 BE ?? ?? E8
ep_only = true
[Protection Plus vx:x]
signature = 50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C
?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ??
?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85 28 ?? ?? ??
50 6A
ep_only = true
[Protection Plus vx:x]
signature = 50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C
?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ??
?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85
ep_only = true
[Protector v1:1:11 (DDeM -> PE Engine v0:9; DDeM -> CI v0:9:2)]
signature = 53 51 56 E8 00 00 00 00 5B 81 EB 08 10 00 00 8D B3 34 10 00 00 B9 F3 03 00 00 BA
63 17 2A EE 31 16 83 C6 04
ep_only = true
[PS-AdobeFont v:1:0]
signature = 80 01 ?? ?? 00 00 25 21 50 53 2D 41 64 6F 62 65 46 6F 6E 74 2D 31 2E 30 3A
ep_only = false
[pscrambler 1:2 -> by p0ke]
signature = 55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 ?? ?? ?? ?? 10 E8 2D F3 FF FF
33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6
FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC
ep_only = true
[PseudoSigner 0:1 -> Anorganix]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90
ep_only = true
[PseudoSigner 0:1 [32Lite 0:03] -> Anorganix]
signature = 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ?? ?? ?? ?? E9
ep_only = true
[PseudoSigner 0:1
signature = 60 90
90 90 90 90 90 90
00 00 90 90 90 04
ep_only = true

[ACProtect 1:09]]
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90

[PseudoSigner 0:1 [Armadillo 3:00] -> Anorganix]

signature = 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2
EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9
ep_only = true
[PseudoSigner 0:1 [ASPack 2:xx Heuristic]]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 A8
03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00
00 51 50 FF 95
ep_only = true
[PseudoSigner 0:1 [ASProtect] -> Anorganix]
signature = 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9
ep_only = true
-188-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[PseudoSigner 0:1
signature = 55 8B
90 90 90 90 90 90
90 90 90 90 90 90
ep_only = true

[Borland
EC 83 C4
90 90 90
90 90 90

Delphi 3:0]]
90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90

[PseudoSigner 0:1
signature = 55 8B
90 90 90 90 90 90
90 90 90 EB 04 00
ep_only = true

[Borland
EC 90 90
90 90 90
00 00 01

Delphi 5:0 KOL/MCK]]

90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90
90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90

[PseudoSigner 0:1
signature = 90 90
8B D8 33 C0 A3 09
33 C0 A3 09 09 09
ep_only = true

[Borland
90 90 68
09 09 00
00 33 C0

Delphi 6:0 - 7:0]]

?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53
6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00
A3 09 09 09 00 E8

[PseudoSigner 0:1 [CD-Cops II] -> Anorganix]

signature = 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 E9
ep_only = true
[PseudoSigner 0:1 [Code-Lock] -> Anorganix]
signature = 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C
47 4B E9
ep_only = true
[PseudoSigner 0:1 [CodeSafe 2:0] -> Anorganix]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10
53 56 57 E8 C4 01 00 85 E9
ep_only = true
[PseudoSigner 0:1 [Crunch/PE Heuristic] -> Anorganix]
signature = 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9
ep_only = true
[PseudoSigner 0:1 [DEF 1:0] -> Anorganix]
signature = BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90
90 90 90 90 90 90 83 C1 01 E9
ep_only = true
[PseudoSigner 0:1 [DxPack 1:0] -> Anorganix]
signature = 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90
83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9
ep_only = true
[PseudoSigner 0:1 [ExeSmasher] -> Anorganix]
signature = 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90
90 90 90 90 90 90 90 90 90 90 90 FE 0B E9
ep_only = true
[PseudoSigner 0:1
signature = 90 90
D0 01 40 00 BF 00
B2 80 A4 6A 02 5B
ep_only = true

[FSG 1:0] -> Anorganix]

90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB
10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC
E9

[PseudoSigner 0:1 [FSG 1:31] -> Anorganix]

signature = BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9
ep_only = true

-189-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[PseudoSigner 0:1 [Gleam 1:00] -> Anorganix]

signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C
53 56 57 E8 24 02 00 FF E9
ep_only = true
[PseudoSigner 0:1 [JDPack 1:x / JDProtect 0:9] -> Anorganix]
signature = 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90
89 95 90 90 90 90 83 BD 45 00 01 00 01 E9
ep_only = true
[PseudoSigner 0:1 [LCC Win32 1:x] -> Anorganix]
signature = 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 E9
ep_only = true
[PseudoSigner 0:1 [LCC Win32 DLL] -> Anorganix]
signature = 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1
?? ?? ?? ?? E9
ep_only = true
[PseudoSigner 0:1 [Lockless Intro Pack] -> Anorganix]
signature = 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF
01 EC AD E9
ep_only = true
[PseudoSigner 0:1 [LTC 1:3] -> Anorganix]
signature = 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9
ep_only = true
[PseudoSigner 0:1
signature = 90 90
EC 44 56 FF 15 24
01 46 3C 22 75 F4
ep_only = true

[Macromedia
90 90 68 ??
81 49 00 8B
80 3E 22 75

Flash
?? ??
F0 8A
0F 46

Projector 6:0] -> Anorganix]

?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83
06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46
EB 0C E9

[PseudoSigner 0:1 [MEW 11 SE 1:0] -> Anorganix]

signature = E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 E9
ep_only = true
[PseudoSigner 0:1 [Microsoft Visual Basic 5:0 - 6:0] -> Anorganix]
signature = 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9
ep_only = true
[PseudoSigner 0:1 [Microsoft Visual Basic 6:0 DLL]]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 5A
68 90 90 90 90 68 90 90 90 90 52 E9 90 90 FF
ep_only = true
[PseudoSigner 0:1 [Microsoft Visual C++ 5:0+ (MFC)] -> Anorganix]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 E9
ep_only = true
[PseudoSigner 0:1
signature = 55 8B
90 90 90 00 01 90
90 90 90 90 90 90
ep_only = true

[Microsoft Visual
EC 51 90 90 90 01
90 90 90 90 90 90
90 90 90 90 90 90

C++ 6:0 (Debug

01 90 90 90 90
90 90 90 90 90
90 90 90 90 90

Version)]]
68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90 90 90 90 90 90 90
90 90 90 00 01 90 90 90 90 90

[PseudoSigner 0:1 [Microsoft Visual C++ 6:20]]

signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55
8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B
ep_only = true

-190-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[PseudoSigner 0:1 [Microsoft Visual C++ 7:0 DLL] -> Anorganix]

signature = 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F
84 ?? ?? ?? ?? E9
ep_only = true
[PseudoSigner 0:1 [MinGW GCC 2:x] -> Anorganix]
signature = 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 E9
ep_only = true
[PseudoSigner 0:1
signature = 90 90
EB 08 E8 90 00 00
90 90 90 90 90 90
ep_only = true

[Morphine 1:2]]
90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90
00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90

[PseudoSigner 0:1
signature = E9 A6
90 90 90 90 90 90
90 90 90 90 90 90
ep_only = true

[Neolite
00 00 00
90 90 90
90 90 90

2:0]]
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90

[PseudoSigner 0:1 [NorthStar PE Shrinker 1:3] -> Anorganix]

signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9
ep_only = true
[PseudoSigner 0:1
signature = 60 E8
90 E8 EB 08 EB 02
90 90 90 90 90 90
ep_only = true

[Pack
01 01
CD 20
90 90

Master 1:0 (PEX Clone)]]

00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90
FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90

[PseudoSigner 0:1 [PE Intro 1:0] -> Anorganix]

signature = 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48
FF ED 0A E9
ep_only = true
[PseudoSigner 0:1 [PE Pack 0:99] -> Anorganix]
signature = 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A E9
ep_only = true
[PseudoSigner 0:1 [PE Protect 0:9] -> Anorganix]
signature = 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 E9
ep_only = true
[PseudoSigner 0:1 [PECompact 1:4+]]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 EB
06 68 90 90 90 90 C3 9C 60 E8 02 90 90 90 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81
ep_only = true
[PseudoSigner 0:1 [PENightMare 2 Beta] -> Anorganix]
signature = 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A E9
ep_only = true
[PseudoSigner 0:1 [PENinja 1:31] -> Anorganix]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90 90 E9
ep_only = true
[PseudoSigner 0:1 [PESHiELD 0:25] -> Anorganix]
signature = 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9
ep_only = true
-191-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[PseudoSigner 0:1 [PEtite 2:x (level 0)]]

signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 B8
00 90 90 00 6A 00 68 90 90 90 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8
03 00 68
ep_only = true
[PseudoSigner 0:1 [PEX 0:99] -> Anorganix]
signature = 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 E9
ep_only = true
[PseudoSigner 0:1 [REALBasic] -> Anorganix]
signature = 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9
ep_only = true
[PseudoSigner 0:1
signature = 0B C0
00 B8 68 24 1A 40
50 45 20 5D 3D 2D
ep_only = true

[Stelth
0B C0 0B
89 02 83
90 00 00

PE 1:01]]
C0 0B C0 0B C0 0B C0 0B C0 0B C0 BA ?? ?? ?? ?? FF E2 BA E0 10 40
C2 03 B8 40 00 E8 EE 89 02 83 C2 FD FF E2 2D 3D 5B 20 48 69 64 65
00

[PseudoSigner 0:1 [UPX 0:6] -> Anorganix]

signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9
ep_only = true
[PseudoSigner 0:1 [VBOX 4:3 MTE] -> Anorganix]
signature = 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 E9
ep_only = true
[PseudoSigner 0:1 [Video-Lan-Client] -> Anorganix]
signature = 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00
01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 E9
ep_only = true
[PseudoSigner 0:1 [VOB ProtectCD 5] -> Anorganix]
signature = 36 3E 26 8A C0 60 E8 00 00 00 00 E9
ep_only = true
[PseudoSigner 0:1 [WATCOM C/C++ EXE] -> Anorganix]
signature = E9 00 00 00 00 90 90 90 90 57 41 E9
ep_only = true
[PseudoSigner 0:1 [XCR 0:11] -> Anorganix]
signature = 60 8B F0 33 DB 83 C3 01 83 C0 01 E9
ep_only = true
[PseudoSigner 0:1 [Yoda's Protector 1:02] -> Anorganix]
signature = E8 03 00 00 00 EB 01 90 90 E9
ep_only = true
[PseudoSigner 0:2 [:BJFNT 1:1b]]
signature = EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 90
ep_only = true
[PseudoSigner 0:2 [:BJFNT 1:2]]
signature = EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00
ep_only = true
[PseudoSigner 0:2 [32Lite 0:03] -> Anorganix]
signature = 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68
ep_only = true

-192-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[PseudoSigner 0:2 [Armadillo 3:00]]

signature = 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2
EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85
ep_only = true
[PseudoSigner 0:2 [ASProtect]]
signature = 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD
ep_only = true
[PseudoSigner 0:2 [Borland C++ 1999] -> Anorganix]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 ?? ?? ?? ?? A3
ep_only = true
[PseudoSigner 0:2 [Borland C++ DLL (Method 2)]]
signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90
ep_only = true
[PseudoSigner 0:2 [Borland Delphi DLL]]
signature = 55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00
ep_only = true
[PseudoSigner 0:2 [Borland Delphi Setup Module]]
signature = 55 8B EC 83 C4 90 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 00 00 00 00
ep_only = true
[PseudoSigner 0:2 [CD-Cops II]]
signature = 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01
ep_only = true
[PseudoSigner 0:2 [Code-Lock]]
signature = 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C
47 4B
ep_only = true
[PseudoSigner 0:2 [CodeSafe 2:0]]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10
53 56 57 E8 C4 01 00 85
ep_only = true
[PseudoSigner 0:2 [Crunch/PE Heuristic]]
signature = 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00
ep_only = true
[PseudoSigner 0:2 [DEF 1:0]]
signature = BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90
90 90 90 90 90 90 83 C1 01
ep_only = true
[PseudoSigner 0:2 [DxPack 1:0]]
signature = 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90
83 BD 90 90 90 90 90 0F 84 00 00 00 00
ep_only = true
[PseudoSigner 0:2 [ExeSmasher]]
signature = 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90
90 90 90 90 90 90 90 90 90 90 90 FE 0B
ep_only = true
[PseudoSigner 0:2 [FSG 1:0]]
signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB
D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC
B2 80 A4 6A 02 5B
-193-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[PseudoSigner 0:2 [FSG 1:31]]
signature = BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80
ep_only = true
[PseudoSigner 0:2 [Gleam 1:00]]
signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C
53 56 57 E8 24 02 00 FF
ep_only = true
[PseudoSigner 0:2 [JDPack 1:x / JDProtect 0:9]]
signature = 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90
89 95 90 90 90 90 83 BD 45 00 01 00 01
ep_only = true
[PseudoSigner 0:2 [LCC Win32 1:x]]
signature = 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50
ep_only = true
[PseudoSigner 0:2 [LCC Win32 DLL] -> Anorganix]
signature = 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1
ep_only = true
[PseudoSigner 0:2 [Lockless Intro Pack]]
signature = 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF
01 EC AD
ep_only = true
[PseudoSigner 0:2
signature = 90 90
EC 44 56 FF 15 24
01 46 3C 22 75 F4
ep_only = true

[Macromedia
90 90 68 ??
81 49 00 8B
80 3E 22 75

Flash
?? ??
F0 8A
0F 46

Projector 6:0]]
?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83
06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46
EB 0C

[PseudoSigner 0:2 [MEW 11 SE 1:0]]

signature = E9 09 00 00 00 00 00 00 02 00 00 00 0C 90
ep_only = true
[PseudoSigner 0:2 [Microsoft Visual Basic 5:0 - 6:0]]
signature = 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00
ep_only = true
[PseudoSigner 0:2 [Microsoft Visual C++ 7:0 DLL] -> Anorganix]
signature = 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F
84
ep_only = true
[PseudoSigner 0:2 [MinGW GCC 2:x]]
signature = 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45
ep_only = true
[PseudoSigner 0:2 [NorthStar PE Shrinker 1:3]]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00
ep_only = true
[PseudoSigner 0:2 [PE Intro 1:0]]
signature = 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48
FF ED 0A
ep_only = true
[PseudoSigner 0:2 [PE Pack 0:99]]
-194-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A
ep_only = true
[PseudoSigner 0:2 [PE Protect 0:9]]
signature = 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3
ep_only = true
[PseudoSigner 0:2 [PENightMare 2 Beta]]
signature = 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A
ep_only = true
[PseudoSigner 0:2 [PESHiELD 0:25]]
signature = 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC
ep_only = true
[PseudoSigner 0:2 [PEX 0:99]]
signature = 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01
ep_only = true
[PseudoSigner 0:2 [REALBasic]]
signature = 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01
ep_only = true
[PseudoSigner 0:2 [UPX 0:6]]
signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00
ep_only = true
[PseudoSigner 0:2 [Video-Lan-Client]]
signature = 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00
01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01
ep_only = true
[PseudoSigner 0:2 [VOB ProtectCD 5]]
signature = 36 3E 26 8A C0 60 E8 00 00 00 00
ep_only = true
[PseudoSigner 0:2 [Watcom C/C++ DLL]]
signature = 53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1
ep_only = true
[PseudoSigner 0:2 [WATCOM C/C++ EXE]]
signature = E9 00 00 00 00 90 90 90 90 57 41
ep_only = true
[PseudoSigner 0:2 [ZCode 1:01]]
signature = E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00
00 64 FF 35 00 00 00 00
ep_only = true
[PUNiSHER 1:5 (DEMO)
signature = EB 04 83
64 6B 88 18 5D E8 00
9C C2 41 00 EB 04 64
ep_only = false
[PUNiSHER v1:5
signature = EB
64 6B 88 18 5D
9C C2 41 00 EB
6B 88 18 89 85
C2 50 00 EB D3

->
A4
00
6B

FEUERRADER/AHTeam]
BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04
00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85
88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04

(DEMO) -> FEUERRADER/AHTeam]

04 83 A4 BC CE 60 EB 04 80 BC
E8 00 00 00 00 EB 04 64 6B 88
04 64 6B 88 18 29 04 24 EB 04
9C C2 41 00 EB 04 64 6B 88 18
5B F3 68 89 5C 24 48 5C 24 58

04
18
64
58
FF

11
81
6B
68
8D

-195-

E8
2C
88
9F
5C

00
24
18
6F
24

00
86
EB
56
58

00
00
04
B6
5B

00
00
64
50
83

81
00
6B
E8
C3

2C
EB
88
5D
4C

24
04
18
00
75

CA
64
8B
00
F4

C2
6B
04
00
5A

41
88
24
EB
8D

00
18
EB
FF
71

EB
8B
04
71
78

04
85
64
78
75

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

09 81 F3 EB FF
C6 75 1B 81 F3
EB FF C0 83 E8
EE EB FA EB 83
ep_only = true

52
EB
FD
C0

BA
87
EB
14

01
1C
FF
EB

00
24
30
FF

04 August 2015 15:14

83
8B
E8
70

EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF
8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0
C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71
ED

[PUNiSHER V1:5 -> FEUERRADER]

signature = 3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52
4E 45 4C 33 32
ep_only = false
[PUNiSHER V1:5 Demo -> FEUERRADER]
signature = EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00
ep_only = true
[PuNkMoD 1:x -> PuNkDuDe]
signature = 94 B9 ?? ?? 00 00 BC ?? ?? ?? ?? 80 34 0C
ep_only = true
[QinYingShieldLicense V1:0X-V1:21 -> Lei Peng *
signature = E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C
33 EF 31 CD F5 B0 CB B5 B0 A3 A1 A3 A1 B9 FE B9
B2 BB D6 AA B5 C0 D5 E2 C0 EF B5 C4 D6 B8 C1 EE
00 00 00 00 00 00
ep_only = true

Sign:By:fly
50 C2 04 00
FE B9 FE B9
CA C7 CA B2

* 20080122]
55 8B EC 56 57 53 34 99 47 49 34
FE BF C9 CF A7 D1 BD A3 AC C4 E3
C3 B4 A3 A1 B9 FE B9 FE B9 FE 00

[R>SC's Process Patcher

signature = E8 E1 01 00
EB ED 80 38 00 74 1B EB
22 74 00 8B F8 B8 04 60
ep_only = false

1:4]
00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40
19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38
40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92

[R>SC's Process Patcher

signature = 68 00 20 40
EE 8B F8 B8 04 60 40 00
50 E8 9F 01 00 00 85 C0
ep_only = false

1:5:1]
00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB
68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57
0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83

[R>SC's Process Patcher

signature = E8 E1 01 00
EB ED 80 38 00 74 1B EB
22 74 00 8B F8 B8 04 60
A2 20 40 00 6A 00 6A 00
B8 00 60 40 00 8B 00 A3
04 85 FF 0F 84 83 00 00
C7 05 EA 21 40 00 00 00
84 C1 00 00 00 60 6A 00
20 40 00 8B CB F3 A6 61
ep_only = false

v1:4]
00 80
19 40
40 00
6A 04
1C 22
00 81
00 00
53 68
75 C2

[R>SC's Process Patcher

signature = 68 00 20 40
EE 8B F8 B8 04 60 40 00
50 E8 9F 01 00 00 85 C0
FC 00 0F 84 8F 00 00 00
1E 8B CF 8D 7E 02 C7 05
24 21 40 00 58 0F 84 D8
00 61 60 FC BE 2C 21 40
C4 20 40 00 E8 FB 00 00
20 40 00 E8 CB 00 00 00
ep_only = false

v1:5:1]
00 E8 C3
68 C4 20
0F 84 39
8B 3E 83
24 21 40
00 00 00
00 8B CB
00 85 C0
61 C7 05

38
80
68
6A
40
FF
83
EA
03

22
78
00
00
00
72
05
20

75
FF
20
6A
BE
21
EA
40

13
20
40
00
40
73
21
00

80
75
00
6A
60
63
40
51

38
F9
C7
00
40
0F
00
FF

00
80
05
57
00
84
01
35

74
38
A2
50
83
DD
50
92

2E
00
20
E8
7E
00
A1
20

80
74
40
7C
FC
00
1C
40

38
0D
00
01
00
00
22
00

20
EB
44
00
0F
33
40
E8

75
0B
00
00
84
DB
00
EB

06
40
00
85
F6
66
39
00

80
80
00
C0
00
8B
05
00

78
38
68
0F
00
1E
EA
00

FF
00
92
84
00
8B
21
61

22
74
20
2A
8B
CF
40
60

74
05
40
01
3E
8D
00
FC

18
80
00
00
83
7E
58
BE

40
38
68
00
C6
02
0F
EA

01
40
01
C6
00
60
F3
0F

00
00
00
04
00
6A
A6
84

00
68
00
85
00
00
61
A2

80
D4
BE
FF
00
53
75
00

38
20
00
0F
00
68
C2
00

00
40
60
84
83
2C
03
00

74
00
40
E5
05
21
FB
61

0D
6A
00
00
24
40
60
03

66
00
8B
00
21
00
E8
FB

81
6A
06
00
40
51
3E
8B

78
00
A3
81
00
FF
00
F7

FE
6A
28
FF
01
35
00
E9

22
04
21
72
50
C4
00
71

20
6A
40
21
A1
20
6A
FF

75
00
00
73
28
40
00
FF

02
6A
83
63
21
00
53
FF

EB
00
C6
74
40
E8
57
60

03
6A
40
7A
00
0A
51
FF

40
00
83
0F
39
01
FF
35

EB
57
7E
B7
05
00
35
C8

-196-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[R-CRYPT v0:91]
signature = E9 J1 J1 68 ?? ?? 60 BF ?? ?? B9 ?? ?? B0 ?? 2E ?? ?? FE C0 47 E2 ?? 61 C7 ?? ??
?? ?? ?? C6 ?? ?? ?? ?? C3
ep_only = true
[RAR Configuration file]
signature = 52 41 52 20 43 4F 4E 46 49 47
ep_only = false
[RAR SFX]
signature = E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 00 00 00 00 90
ep_only = true
[RAR-SFX Archive (1)]
signature = 4D 5A ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? 52 53 46 58
ep_only = false
[RatPacker (Glue) stub]
signature = 40 20 FF 00 00 00 00 00 00 00 ?? BE 00 60 40 00 8D BE 00 B0 FF FF
ep_only = true
[RatPacker (Glue) stub]
signature = 40 20 FF ?? ?? ?? ?? ?? ?? ?? ?? BE ?? 60 40 ?? 8D BE ?? B0 FF FF
ep_only = false
[RAZOR 1911 encruptor]
signature = E8 ?? ?? BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC
ep_only = true
[RCC II/286 v1:02]
signature = FA BD J2 J2 93 C8 ?? ?? ?? 54 62 E9
ep_only = true
[RCC II/286 v1:14 (mild)]
signature = FA BD J2 J2 BE ?? ?? 9C 46 30 ?? ?? ?? 99
ep_only = true
[RCC II/386 v0:51]
signature = FA BC J2 J2 FE ?? ?? 0E 1F 3E ?? ?? ?? ?? ?? 3E ?? ?? ?? ?? ?? B8 ?? ?? CD 21 06
53 B8 ?? ?? CD 21 06 53 8B D5 8C C8 8E D8 B8 ?? ?? CD 21 8B D5 B8 ?? ?? CD 21 CD 01 9C
ep_only = true
[RCryptor 1:5 by Vaska (UsAr sign (individual version) 21:03:2007 22<15)]
signature = 83 2C 24 4F 68 40 A1 14 13 FF 54 24 04 83 44 24 04 4F B8 00 10 14 13 3D 24 C0 14
13 74 06 80 30 2B 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 19 40 EB F3 E8 00 00 00
00 C3
ep_only = true
[RCryptor 1:6 by Vaska (Damrai sign 20:03:2007 20<41)]
signature = 33 D0 68 40 A1 14 13 FF D2 B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 BB 40 EB F3
33 C0 C3
ep_only = true
[RCryptor 1:6c by Vaska (UsAr sign 21:03:2007 22<25)]
signature = 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 40 A1 14 13 B8 00 10 14 13 3D
24 C0 14 13 74 06 80 30 F2 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 E8 40 EB F3 C3
ep_only = true
[RCryptor 1:6d by Vaska (UsAr sign 21:03:2007 22<22)]
signature = 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 40 A1 14 13 B8 00 10 14 13 90
3D 24 C0 14 13 74 06 80 30 F6 40 EB F3 B8 8C 20 18 13 90 3D B9 27 18 13 74 06 80 30 89 40 EB
-197-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

F3 C3
ep_only = true
[RCryptor 2:0 -> Vaska]
signature = F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF
ep_only = true
[RCryptor by Vaska unknown ver (sign from pinch 21:03:2006 23<05)]
signature = 90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 00 10 14 13 B8 00 10
14 13 3D 00 64 14 13 74 06 80 30 BC 40 EB F3 E8 00 00 00 00 C3
ep_only = true
[RCryptor v1:1 -> Vaska]
signature = 8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30
?? 40 EB F3
ep_only = false
[RCryptor v1:3 / v1:4 -> Vaska]
signature = 55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50 B8 ?? ?? ?? ?? 3D ??
?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true
[RCryptor v1:3b -> Vaska]
signature = 61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ??
40 EB F3
ep_only = true
[RCryptor v1:5 (Private) -> Vaska]
signature = 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ??
?? 74 06 80 30 ?? 40 EB F3
ep_only = true
[RCryptor V1:5 -> Vaska > Sign by fly]
signature = 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ??
?? 74 06 80 30 ?? ?? EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true
[RCryptor v1:6 -> Vaska]
signature = 33 D0 68 ?? ?? ?? ?? FF D2 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true
[RCryptor v1:6b / v1:6c -> Vaska]
signature = 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D
?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true
[RCryptor V1:6c -> Vaska > Sign by fly]
signature = 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D
?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true
[RCryptor V1:6d -> Vaska > Sign by fly]
signature = 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90
3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB
F3
ep_only = true
[RCryptor v1:6d -> Vaska]
signature = 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90
3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true

-198-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[RCryptor v1:6x -> Vaska]

signature = 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? C3
ep_only = true
[RCryptor v1:?? -> Vaska]
signature = 90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 ?? ?? ?? ?? B8 ?? ??
?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true
[RE-Crypt 0:7x
signature = 60
60 E8 00 00 00
7D 38 81 E7 00
ep_only = true

->
E8
00
FF

Crudd
00 00
5D 55
FF FF

[RET]]
00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61
81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B
81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B

[RE-Crypt v0:7x -> Crudd [RET]

signature = 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61
60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B
7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58
89 17 83 C7 04 83 C1 FC EB EC
ep_only = true
[RE-Crypt v0:7x -> Crudd [RET]
signature = 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34
89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B
17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC 8B
ep_only = true
[REALbasic]
signature = 55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00
ep_only = true
[REC v0:32]
signature = 06 1E 52 B8 ?? ?? 1E CD 21 86 E0 3D
ep_only = true
[REC v0:34 [3]
signature = 06 1E B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB
ep_only = true
[REC; C0ded by ROSE]
signature = 06 1E 0E 0E 07 1F B4 30 CD 21 86 E0 3D 00 03 73 ?? CD 20 EB
ep_only = true
[REC:Small v1:01]
signature = 8C D8 1E E8 J1 J1 5D 83 ?? ?? 81 ?? ?? ?? B9 ?? ?? 40 8E D8 2B DB B2 55
ep_only = true
[REC:Small v1:02]
signature = 8C D8 1E E8 ?? ?? 83 ?? ?? 5D B9 ?? ?? 81 ?? ?? ?? 40 8E D8 2B DB B2 ?? ?? ?? FE
C2 43 83
ep_only = true
[Reflexive Arcade
signature = 55 8B
00 00 83 EC 58 53
FF 00 00 00 89 0D
56 E8 58 43 00 00
42 00 A3 44 FE 42
FF 89 75 D0 8D 45
D4 EB 03 6A 0A 58
FF FF 8B 45 EC 8B

Wrapper]
EC 6A FF
56 57 89
38 E8 42
59 85 C0
00 E8 E1
A4 50 FF
50 FF 75
08 8B 09

68
65
00
75
3E
15
9C
89

98
E8
C1
08
00
14
56
4D

68
FF
E1
6A
00
51
56
98

42
15
08
1C
A3
42
FF
50

00
F8
03
E8
78
00
15
51

68
50
CA
B0
E8
E8
10
E8

14
42
89
00
42
5D
51
9B

FA
00
0D
00
00
3B
42
39

-199-

41
33
34
00
E8
00
00
00

00
D2
E8
59
8A
00
50
00

64
8A
42
89
3C
89
E8
59

A1
D4
00
75
00
45
0D
59

00
89
C1
FC
00
9C
6E
C3

00
15
E8
E8
E8
F6
FE
8B

00
3C
10
23
CC
45
FF
65

00
E8
A3
40
3B
D0
89
E8

50
42
30
00
00
01
45
FF

64
00
E8
00
00
74
A0
75

89
8B
42
FF
E8
06
50
98

25
C8
00
15
3E
0F
E8
E8

00
81
33
18
F5
B7
2C
1E

00
E1
F6
51
FF
45
F5
F5

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

FF FF 83 3D 80 E8 42 00 01 75 05 E8 F3 43 00 00 FF 74 24 04 E8 23 44 00 00 68 FF 00 00 00 FF
15 B0 B8 42 00 59 59 C3 83 3D 80 E8 42 00 01 75 05 E8 CE 43 00 00 FF 74 24 04 E8 FE 43 00 00
59 68 FF
ep_only = true
[Reflexive Arcade
signature = 55 8B
00 00 83 EC 58 53
FF 00 00 00 89 0D
ep_only = true

Wrapper]
EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00
56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1
38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8

[Reg2Exe 2:20/2:21 signature = 6A 00 E8

00 E8 0F 00 00 00 50
68 B0 44 40 00 E8 3A
ep_only = true

by
7D
E8
12

Jan Vorel]
12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40
69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00
00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00

[Reg2Exe 2:22/2:23 signature = 6A 00 E8

00 E8 07 00 00 00 50
00 00 83 C4 0C 8B 44
ep_only = true

by
2F
E8
24

Jan Vorel]
1E 00 00 A3 C4 35 40 00 E8 2B 1E 00 00 6A 0A 50 6A 00 FF 35 C4 35 40
1B 1E 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 C8 35 40 00 E8 76 16
04 A3 CC 35 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00

[Reg2Exe 2:24 - by Jan Vorel]

signature = 6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40
00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19
00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00
ep_only = true
[Reg2Exe 2:25 - by Jan Vorel]
signature = 68 68 00 00 00 68 00 00 00 00 68 70 7D 40 00 E8 AE 20 00 00 83 C4 0C 68 00 00 00
00 E8 AF 52 00 00 A3 74 7D 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 9C 52 00 00
A3 70 7D 40 00 E8 24 50 00 00 E8 E2 48 00 00 E8 44 34 00 00 E8 54 28 00 00 E8 98
ep_only = true
[ResCrypt v1:02]
signature = 55 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? BE ?? ?? ?? ?? <3 F5 8B DE BA 01 ?? ?? ??
33 C9 66 8B 4E 0C 66 03 4E 0E 85 C9 74 54 83 C6 10 8B 06 83 FA 01 75 1B 25 ?? ?? ?? 7F 83 F8
03 74 0C 83 F8 0E 74 07 83 F8 10 74 02 EB 05 83 C6 08 EB 2D 8B 46 04 83 C6 08 A9
ep_only = false
[ResCrypt v1:02]
signature = 55 E8
33 C9 66 8B 4E 0C
03 74 0C 83 F8 0E
74 0E 51 56 25 ??
E2 F9 59 E2 AF 4A
ep_only = false

??
66
74
??
74

??
03
07
??
04

??
4E
83
7F
5E

??
0E
F8
03
59

5D
85
10
C3
EB

81
C9
74
8B
F7

ED
74
02
F0
8D

06
54
EB
42
85

??
83
05
EB
??

??
C6
83
B2
??

??
10
C6
51
??

BE
8B
08
03
??

??
06
EB
C3
5D

??
83
2D
8B
FF

??
FA
8B
38
E

??
01
46
03

?3
75
04
FD

F5
1B
83
8B

8B
25
C6
48

DE
??
08
04

BA
??
A9
D2

01
??
??
0F

??
7F
??
30

??
83
??
0F

??
F8
80
47

[ResCrypt v1:02] // Hint =

signature = 55 E8 ?? ?? ??
33 C9 66 8B 4E 0C 66 03 4E
03 74 0C 83 F8 0E 74 07 83
74 0E 51 56 25 ?? ?? ?? 7F
E2 F9 59 E2 AF 4A 74 04 5E
ep_only = false

$0
??
0E
F8
03
59

5D
85
10
C3
EB

81
C9
74
8B
F7

ED
74
02
F0
8D

06
54
EB
42
85

??
83
05
EB
??

??
C6
83
B2
??

??
10
C6
51
??

BE
8B
08
03
??

??
06
EB
C3
5D

??
83
2D
8B
FF

??
FA
8B
38
E

??
01
46
03

<3
75
04
FD

F5
1B
83
8B

8B
25
C6
48

DE
??
08
04

BA
??
A9
D2

01
??
??
0F

??
7F
??
30

??
83
??
0F

??
F8
80
47

[ReversingLabsProtector 0:7:4 beta -> Ap0x]

signature = 68 00 00 41 00 E8 01 00 00 00 C3 C3
ep_only = true
[RJcrush v1:00]
-200-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 06 FC 8C C8 BA ?? ?? 03 D0 52 BA ?? ?? 52 BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E
C0 33 F6 33 FF B9
ep_only = true
[RJoiner 1:2 by Vaska (25:03:2007 16<58)]
signature = 55 8B EC 81 EC 0C 02 00 00 8D 85 F4 FD FF FF 56 50 68 04 01 00 00 FF 15 14 10 40
00 90 8D 85 F4 FD FF FF 50 FF 15 10 10 40 00 90 BE 00 20 40 00 90 83 3E FF 0F 84 84 00 00 00
53 57 33 FF 8D 46
ep_only = true
[RJoiner 1:2a -> Vaska]
signature = 55 8B EC 81 EC 0C 01 00 00 8D 85 F4 FE FF FF 56 50 68 04 01 00 00 FF 15 0C 10 40
00 94 90 94 8D 85 F4 FE FF FF 50 FF 15 08 10 40 00 94 90 94 BE 00 20 40 00 94 90 94 83 3E FF
74 7D 53 57 33 DB 8D 7E 04 94 90 94 53 68 80 00 00 00 6A 02 53 6A 01 68 00 00 00
ep_only = true
[RJoiner 1:2a -> Vaska]
signature = 55 8B EC 81
00 94 90 94 8D 85 F4 FE
74 7D 53 57 33 DB 8D 7E
04 10 40 00 89 45 F8 94
75 F8 FF 15 00 10 40 00
50 53 57 68 20 10 40 00
89 5F 5B 33 C0 5E C9 C2
ep_only = true

EC
FF
04
90
94
53
10

0C
FF
94
94
90
FF
00

01
50
90
8B
94
15
CC

00
FF
94
06
FF
18
CC

00
15
53
8D
75
10
24

8D
08
68
74
F8
40
11

85
10
80
06
FF
00

F4
40
00
04
15
94

FE
00
00
94
10
90

FF
94
00
90
10
94

FF
90
6A
94
40
8B

56
94
02
8D
00
06

50
BE
53
45
94
8D

68
00
6A
FC
90
74

04
20
01
53
94
06

01
40
68
50
8D
04

00
00
00
8D
85
94

00
94
00
46
F4
90

FF
90
00
04
FE
94

15
94
C0
FF
FF
83

0C
83
57
36
FF
3E

10
3E
FF
50
6A
FF

40
FF
15
FF
0A
75

[RJoiner by Vaska (Sign from pinch 25:03:2007 17<00)]

signature = E8 03 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 6C 10 40 00 FF 25 70 10 40 00 FF 25 74
10 40 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10
40 00 FF 25 8C 10
ep_only = true
[RLP 0:7:3beta ->
signature = 60 8B
40 00 2B C3 03 C5
00 00 0F B9 FF 4B
ep_only = false

ap0x (h)]
DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30
33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30
89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56

[RLP V0:7:3:beta -> ap0x > Sign by fly]

signature = 2E 72 6C 70 00 00 00 00 00 50 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00
00 00 00 00 00 00 00 00 00 20 00 00 E0
ep_only = false
[RLP v0:7:3beta -> ap0x
signature = 60 8B DD E8
40 00 2B C3 03 C5 33 D2
00 00 0F B9 FF 4B 89 52
F3 05 40 81 68 4B 93 71
88 06 07 30 F5 EA 2A 35
C3 DE 36 A9 7E 5A 51 A6
F7 28 5C 26 89 5C 94 89
8F A0 0B A8 3A C1 C7 B5
ep_only = false

(h)]
00 00
8A 10
5C 4C
40 BB
F0 4B
BC 63
5A F8
3E D9

00
40
BD
87
8A
A8
1C
70

00
B9
77
3C
C3
66
0B

5D
??
C2
40
07
CB
74

95
??
0C
40
C1
30
7E

32
00
CE
8B
C6
58
33

C0
00
88
88
02
20
4E

95
8B
4E
06
C4
8C
9B

89
F9
2D
75
34
CC
29

9D
30
E8
70
C0
85
56

80
10
00
40
74
53
F2

00
8A
00
40
74
9F
2B

00
10
00
8B
32
C1
84

00
40
5D
BB
02
E4
42

B8
49
0D
B3
C4
10
8A

42
75
DB
43
45
80
95

31
F8
5E
C4
0B
11
16

40
64
56
8F
3C
20
76

00
EF
41
93
96
1E
64

BB
86
87
2B
BE
48
08

41
3D
FC
F3
0A
D2
7B

30
30
0F
4A
82
E8
70

[RLPack -> Ap0x]

signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8D B5 CB 22 00
00 8D 9D F0 02 00 00 33 FF E8 ?? ?? ?? ?? EB 03 ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ??
6A 00 FF 95 9B 0A
ep_only = true
[RLPack -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8
-201-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 ?? ?? ?? ?? EB
14 60 FF B5 3A 0A
ep_only = true
[RLPack -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8
?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 CD 09 00 00 89 85 ?? ?? ?? ?? EB
14 60 FF B5 14 0A
ep_only = true
[RLPack 1:0 beta -> ap0x (h)]
signature = 60 E8 00 00 00 00
FF EB 0F FF 74 37 04 FF 34 37
68 00 10 00 00 68 ?? ?? ?? ??
56 FF D3 83 C4 08 8B B5 48 02
02 00 00 EB 7A 56 FF 95 F1 01
00 00 00 80 74 14 35 00 00 00
00 FF B5 40 02 00 00 FF 95 F5
FA 40 89 85 44 02 00 00 80 38
02 00 00 80 3E 01 75 81 68 00
68 ?? ?? ?? ?? C3 60 8B 74 24
ep_only = true

8D
FF
6A
00
00
80
01
00
40
24

64
D3
00
00
00
50
00
75
00
8B

24
83
FF
8B
89
8B
00
AC
00
7C

04
C4
95
C6
85
85
89
EB
68

8B
08
F9
EB
40
44
07
01
??

6C
83
01
01
02
02
83
46
??

24
C7
00
40
00
00
C7
80
??

FC
08
00
80
00
00
04
3E
??

8D
83
89
38
8B
C7
8B
00
FF

B5
3C
85
01
C6
00
85
75
B5

4C
37
48
75
EB
20
44
FA
48

02
00
02
FA
4F
20
02
46
02

00
75
00
40
8B
20
00
40
00

00
EB
00
8B
85
00
00
8B
00

8D
8D
5B
38
44
EB
EB
38
FF

9D
74
FF
83
02
06
01
83
95

13
37
B5
C0
00
FF
40
C0
FD

01
04
48
04
00
B5
80
04
01

00
53
02
89
8B
44
38
89
00

00
6A
00
85
00
02
00
85
00

33
40
00
44
A9
00
75
44
61

[RLPack 1:0 beta -> ap0x]

signature = 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33
FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40
68 00 10 00 00 68
ep_only = true
[RLPack 1:0 beta -> ap0x]
signature = 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33
FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40
68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5
ep_only = true
[RLPack 1:1 BasicEdition -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB
0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00
10 00 00 68
ep_only = true
[RLPack 1:16 (aPLib compression)
signature = 60 E8 00 00 00 00 8B
45 01 00 00 EB 0F FF 74 37 04 FF
53 6A 40 68 00 10 00 00 68 ?? ??
03 00 00 56 FF D3 83 C4 08 8B B5
00 00 83 C0 04 89 85 4B 03 00 00
89 85 47 03 00 00 8B C6 EB 5B 8B
8B 85 4B 03 00 00 C7 00 20 20 20
00 85 C0 74 6B 89 07 83 C7 04 8B
ep_only = false

->
2C
34
??
4F
E9
85
00

ap0x (h)]
24 83 C4 04
37 FF D3 83
?? 6A 00 FF
03 00 00 8B
93 00 00 00
4B 03 00 00
EB 06 FF B5

[RLPack 1:16 (LZMA compression) -> ap0x (h)]

signature = 60 E8 00 00 00 00 8B 2C 24 83 C4
83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C
14 60 FF B5 3A 0A 00 00 FF 34 37 FF 74 37 04
53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00
3A 0A 00 00 56 FF B5 56 0A 00 00 FF D3 61 8B
8B 38 E8 E7 00 00 00 83 C0 04 89 85 52 0A 00
0A 00 00 85 C0 0F 84 C2
ep_only = false

04
00
FF
FF
B5
00

8D
C4
95
C6
56
8B
4B

B5
08
E8
EB
FF
00
03

53
83
02
01
95
A9
00

03
C7
00
40
E0
00
00

00
08
00
80
02
00
FF

00
83
89
38
00
00
B5

8D
3C
85
01
00
80
47

9D
37
4F
75
85
74
03

02
00
03
FA
C0
14
00

02
75
00
40
0F
35
00

00
EB
00
8B
84
00
FF

00
8D
5B
38
AE
00
95

33
74
FF
E8
00
00
E4

FF
37
B5
CD
00
80
02

E8
04
4F
00
00
50
00

8D
6A
D3
95
56
E9

B5
00
61
EB
0A
97

5A
FF
83
09
00
00

0A
95
C7
00
00
00

00
EB
08
00
8B
00

00
09
83
89
C6
56

8D
00
3C
85
EB
FF

9D
00
37
56
01
95

40
89
00
0A
40
E3

02
85
75
00
80
09

00
3A
E6
00
38
00

00
0A
8D
5B
01
00

33
00
74
60
75
89

FF
00
37
FF
FA
85

E8
EB
04
B5
40
4E

-202-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[RLPack 1:18 (aPlib 0:43) -> ap0x]

signature = 60 E8 00 00 00 00 8B 2C
61 01 00 00 EB 0F FF 74 37 04 FF 34
00 00 00 74 0E 83 BD 0A 04 00 00 00
68 ?? ?? ?? ?? 6A 00 FF 95 A7 03 00
?? 8B B5 16 04 00 00 8B C6 EB 01
ep_only = true

24
37
74
00

83
FF
05
89

C4
D3
E8
85

??
83
D7
16

8D
C4
01
04

B5
??
00
00

1A
83
00
00

04
C7
8D
5B

00
??
74
FF

00
83
37
B5

8D
3C
04
16

9D
37
53
04

C1
00
6A
00

02
75
??
00

00
EB
68
56

00
83
??
FF

33
BD
??
D3

FF
06
??
83

E8
04
??
C4

24
??
74
74
00
8B

83
??
37
05
89
C6

C4
??
04
E8
85
EB

??
??
FF
F6
1D
01

8D
6A
D3
01
0B

B5
00
61
00
00

21
FF
83
00
00

0B
95
C7
8D
5B

00
AA
??
74
60

00
0A
83
37
FF

8D
00
3C
04
B5

9D
00
37
53
F9

FF
89
00
6A
0A

02
85
75
??
00

00
F9
E6
68
00

00
0A
83
??
56

33
00
BD
??
FF

FF
00
0D
??
B5

E8
EB
0B
??
1D

ap0x]
5C 01
61 01
00 00
68 ??
?? 8B

00
00
00
??
B5

00
00
74
??
16

60
EB
0E
??
04

E8
0F
83
6A
00

00
FF
BD
??
00

00
74
0A
FF
8B

00
37
04
95
C6

00
04
00
A7
EB

8B
FF
00
03
01

2C
34
00
00

24
37
74
00

83
FF
05
89

C4
D3
E8
85

??
83
D7
16

8D
C4
01
04

B5
??
00
00

1A
83
00
00

04
C7
8D
5B

00
00
FF
00
??
00

00
00
B5
74
??
FF

60
6A
F9
0E
??
D3

E8
??
0A
83
6A
61

00
68
00
BD
??
8B

00
??
00
11
FF
B5

00
??
FF
0B
95
1D

00
??
34
00
AA
0B

8B
??
37
00
0A
00

2C
68
FF
00
00
00

24
??
74
74
00
8B

83
??
37
05
89
C6

C4
??
04
E8
85
EB

04
??
FF
F6
1D
01

8D
6A
D3
01
0B

B5
??
61
00
00

??
FF
83
00
00

??
95
C7
8D
5B

[RLPack 1:18 (LZMA 4:30) -> ap0x]

signature = 60 E8 00 00 00 00 8B 2C
9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68
14 60 FF B5 F9 0A 00 00 FF 34 37 FF
00 00 00 74 0E 83 BD 11 0B 00 00 00
68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00
0B 00 00 FF D3 61 8B B5 1D 0B 00 00
ep_only = true
[RLPack 1:18 Dll (aPlib
signature = 80 7C 24 08
00 00 8D 9D C1 02 00 00
?? 83 3C 37 00 75 EB 83
74 37 04 53 6A ?? 68 ??
FF B5 16 04 00 00 56 FF
ep_only = true

0:43)
01 0F
33 FF
BD 06
?? ??
D3 83

->
85
E8
04
??
C4

[RLPack 1:18 Dll (LZMA 4:30) -> ap0x]

signature = 80 7C 24 08 01 0F 85 ?? 01
?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 9F 01
AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60
08 83 3C 37 00 75 E6 83 BD 0D 0B 00 00
74 37 04 53 6A ?? 68 ?? ?? ?? ?? 68 ??
60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00
ep_only = true

[RLPack 1:19 Basic Edition]

signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 ?? ??
00 00 EB 0C
ep_only = true
[RLPack Full Edition 1:17 (LZMA)]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
8D B5 73 26 00 00 8D 9D 58 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ??
68 ?? ?? ?? ?? 6A
ep_only = true
[RLPack Full Edition 1:17 -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF
ep_only = true
[RLPack Full Edition 1:17 [aPLib]]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
8D B5 74 1F 00 00 8D 9D 1E 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F
FF 74 37 04 FF 34
ep_only = true
[RLPack Full Edition 1:17 DLL (LZMA)]
signature = 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A
00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95
EB 09 00 00 89 85
ep_only = true

-203-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[RLPack Full Edition 1:17 DLL -> Ap0x]

signature = 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ??
?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8
ep_only = true
[RLPack Full Edition 1:17 DLL [aPLib]]
signature = 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03
00 00 8D 9D 02 02 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7
08 83 3C 37 00 75
ep_only = true
[RLPack Full Edition 1:17 iBox (LZMA)]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
8D B5 67 30 00 00 8D 9D 66 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ??
68 ?? ?? ?? ?? 6A
ep_only = true
[RLPack Full Edition 1:17 iBox [aPLib]]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
8D B5 79 29 00 00 8D 9D 2C 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F
FF 74 37 04 FF 34
ep_only = true
[RLPack FullEdition V1:1X -> ap0x *
signature = 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
62 72 61 72 79 41 00 00 47 65 74 50
41 6C 6C 6F 63 00 00 56 69 72 74 75
65 63 74 00 00 47 65 74 4D 6F 64 75
ep_only = false
[RLPack FullEdition V1:20 (aPlib
signature = 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
75 6C 65 48 61 6E 64 6C 65 41 00
6F 63 41 64 64 72 65 73 73 00 00
6C 50 72 6F 74 65 63 74 00 00 56
ep_only = false

Sign:By:fly]
00 00 00 00 ??
00 6B 65 72 6E
?? ?? ?? ?? ??
72 6F 63 41 64
61 6C 46 72 65
6C 65 48 61 6E

0:43)
00 00
00 00
?? ??
00 4C
56 69
69 72

->
00
6B
??
6F
72
74

??
65
??
64
65
64

??
32
00
73
56
41

??
2E
00
73
69
00

??
64
00
00
72
00

??
6C
00
00
74
00

00
6C
00
56
75
10

00
00
4C
69
61

00
??
6F
72
6C

00
??
61
74
50

00
??
64
75
72

00
??
4C
61
6F

00
??
69
6C
74

ap0x * Sign:By:fly]
00 00 ?? ?? ?? ?? ??
65 72 6E 65 6C 33 32
?? ?? ?? ?? 00 00 00
61 64 4C 69 62 72 61
74 75 61 6C 41 6C 6C
75 61 6C 46 72 65 65

??
2E
00
72
6F
00

??
64
00
79
63
00

??
6C
00
41
00
00

00
6C
00
00
00
10

00
??
47
00
56
00

00
??
65
47
69
00

00
??
74
65
72
08

00
??
4D
74
74
00

00
??
6F
50
75
00

00
??
64
72
61
00

* Sign:By:fly]
?? ?? ?? ?? ??
6C 33 32 2E 64
00 00 00 4C 6F
00 00 56 69 72
72 74 75 61 6C

??
6C
61
74
50

00
6C
64
75
72

00
??
4C
61
6F

00
??
69
6C
74

00
??
62
41
65

00
??
72
6C
63

00
??
61
6C
74

00
??
72
6F
00

??
6C
00
41
00
00

00
6C
00
00
00
10

00
??
47
00
56
00

00
??
65
47
69
00

00
??
74
65
72
08

00
??
4D
74
74
00

00
??
6F
50
75
00

00
??
64
72
61
00

[RLPack FullEdition V1:20 (BasicEdition Stub) -> ap0x

signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ??
00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00
79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73
63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69
00 00 10 00 00 08 00 00 00
ep_only = false
[RLPack FullEdition V1:20 (LZMA 4:30) -> ap0x *
signature = 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
75 6C 65 48 61 6E 64 6C 65 41 00 00 4C 6F 61 64
6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75
6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72
ep_only = false

??
6C
??
72
00
6C

??
33
00
65
00
65

Sign:By:fly]
?? ?? ?? ?? ??
6E 65 6C 33 32
?? ?? 00 00 00
4C 69 62 72 61
61 6C 41 6C 6C
6F 74 65 63 74

??
2E
00
72
6F
00

??
64
00
79
63
00

[RLPack V1:0:beta -> ap0x > Sign by fly]

signature = 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33
FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB
-204-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[RLPack V1:11 -> ap0x > Sign by fly]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB
0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB
ep_only = true
[RLPack V1:12-V1:14 (aPlib 0:43) -> ap0x > Sign by fly]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF EB
0F FF ?? ?? ?? FF ?? ?? ?? D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB
ep_only = true
[RLPack V1:12-V1:14 (LZMA 4:30) -> ap0x > Sign by fly]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF 6A
?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? 60
ep_only = true
[RLPack V1:15-V1:17 (aPlib 0:43) -> ap0x > Sign by fly]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8
45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB
ep_only = true
[RLPack V1:15-V1:17 (LZMA 4:30) -> ap0x > Sign by fly]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8
83 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB
14
ep_only = true
[RLPack V1:15-V1:17 Dll -> ap0x > Sign by fly]
signature = 80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ??
?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8
ep_only = true
[RLPack V1:18 (aPlib
signature = 60 E8 00
61 01 00 00 EB 0F FF
00 00 00 74 0E 83 BD
ep_only = true

0:43)
00 00
74 37
0A 04

->
00
04
00

ap0x]
8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8
FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04
00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68

[RLPack V1:18 (LZMA 4:30) -> ap0x]

signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8
9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB
14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 ?? 83 3C 37 00 75 E6
ep_only = true
[RLPack v1:18 Basic [aPLib] -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8
61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04
00 00 00 74 0E 83
ep_only = true
[RLPack v1:18 Basic [LZMA] -> Ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8
9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB
14 60 FF B5 F9 0A
ep_only = true
[RLPack v1:18 Basic DLL
signature = 80 7C 24 08
00 00 8D 9D C1 02 00 00
08 83 3C 37 00 75 EB 83
ep_only = true

[aPLib] -> Ap0x]

01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04
33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7
BD 06 04 00 00 00 74 0E 83

-205-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

[RLPack v1:18 Basic DLL

signature = 80 7C 24 08
00 00 8D 9D FF 02 00 00
AA 0A 00 00 89 85 F9 0A
ep_only = true

04 August 2015 15:14

[LZMA] -> Ap0x]

01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B
33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95
00 00 EB 14 60 FF B5 F9 0A

[RLPack V1:18 Basic Edition (aPlib 0:43) -> ap0x]

signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8
61 01 00 00 EB 0F FF 74
ep_only = true
[RLPack V1:18 Basic Edition (aPLib or LZMA) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? 00 00 8D 9D ?? 02 00 00 33 FF E8
?? 01 00 00
ep_only = true
[RLPack V1:18 Basic Edition (LZMA 4:30) -> ap0x]
signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8
9F 01 00 00 6A 40 68 00
ep_only = true
[RLPack V1:18 Dll
signature = 80 7C
00 00 8D 9D C1 02
?? 83 3C 37 00 75
ep_only = true

(aPlib 0:43) -> ap0x]

24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04
00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7
EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7

[RLPack V1:18 Dll

signature = 80 7C
?? ?? 8D 9D ?? ??
AA 0A 00 00 89 85
ep_only = true

(LZMA
24 08
?? ??
F9 0A

4:30)
01 0F
33 FF
00 00

->
85
E8
EB

ap0x]
?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ??
9F 01 00 00 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95
14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF

[RLPack V1:19 (aPlib

signature = 60 E8 00
00 00 EB 0C 8B 85 38
52 01 00 00 EB 1B 8B
ep_only = true

0:43)
00 00
04 00
85 3C

->
00
00
04

ap0x > Sign

8B 2C 24 83
89 85 3C 04
00 00 FF 74

[RLPack V1:19 (aPlib

signature = 60 E8 00
00 00 EB 0C 8B 85 38
52 01 00 00 EB 1B 8B
C7 08 83 3C 37 00 75
8D 74 37 04 53 6A 40
5B FF B5 5C 04 00 00
38 03 BD 3C 04 00 00
84 B4 00 00 00 89 85
00 00 00 80 50 8B 85
FF 95 CD 03 00 00 85
85 58 04 00 00 66 81
BD 3C 04 00 00 83 C0
?? ?? FF B5 5C 04 00
C3
ep_only = true

0:43)
00 00
04 00
85 3C
DF 83
68 00
56 FF
83 C0
54 04
58 04
C0 74
78 02
04 89
00 FF

->
00
00
04
BD
10
D3
04
00
00
71
00
85
95

ap0x&nbsp= &nbsp=> Sign

8B 2C 24 83 C4 04 83 7C
89 85 3C 04 00 00 8D B5
00 00 FF 74 37 04 01 04
48 04 00 00 00 74 0E 83
00 00 68 ?? ?? ?? ?? 6A
83 C4 08 8B B5 5C 04 00
89 85 58 04 00 00 E9 94
00 8B C6 EB 5B 8B 85 58
00 C7 00 20 20 20 00 EB
89 07 83 C7 04 8B 85 58
80 74 A5 80 38 00 75 A0
58 04 00 00 80 3E 01 0F
D5 03 00 00 E8 3D 00 00

[RLPack V1:19 (LZMA 4:30) -> ap0x >

signature = 60 E8 00 00 00 00 8B 2C
00 00 EB 0C 8B 85 45 0B 00 00 89 85
40 68 00 10 00 00 68 00 20 0C 00 6A
ep_only = true

by
C4
00
37

fly]
04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04
00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8
04 01 04 24 FF 34 37 01 04 24 FF D3

by
24
60
24
BD
00
00
00
04
06
04
EB
85
00

fly]
28 01
04 00
FF 34
4C 04
FF 95
8B C6
00 00
00 00
FF B5
00 00
01 46
63 FF
E8 24

75
00
37
00
D1
EB
56
8B
58
EB
80
FF
01

0C
8D
01
00
03
01
FF
00
04
01
3E
FF
00

8B
9D
04
00
00
40
95
A9
00
40
00
68
00

44
EB
24
74
00
80
C9
00
00
80
75
00
61

24
02
FF
05
89
38
03
00
FF
38
FA
40
E9

24
00
D3
E8
85
01
00
00
B5
00
46
00
??

89
00
83
B8
5C
75
00
80
54
75
40
00
??

85
33
C4
01
04
FA
85
74
04
FA
8B
68
??

3C
FF
08
00
00
40
C0
14
00
40
38
??
??

04
E8
83
00
00
8B
0F
35
00
89
03
??
61

Sign by fly]
24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B
49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A
00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76

-206-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[RLPack V1:19 (LZMA 4:30) -> ap0x&nbsp= &nbsp=>

signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04
00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00
40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA
20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34
C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74
8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ??
5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF
01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89
00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00
00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00
B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87
01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81
3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0
FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00
0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D
C3
ep_only = true

Sign by fly]
83 7C 24 28 01
8D B5 6D 0B 00
0A 00 00 89 85
37 01 04 24 FF
0E 83 BD 59 0B
?? 6A 00 FF 95
D3 61 8B B5 69
85 65 0B 00 00
8B C6 EB 5F 8B
C7 00 20 20 20
00 00 00 89 07
78 02 00 80 74
04 89 85 65 0B
00 FF 95 DE 0A
00 00 00 E8 24

75
00
41
74
00
DA
0B
E9
85
00
83
A1
00
00
01

[RLPack V1:19 Dll

signature = 80 7C
01 75 0C 8B 44 24
00 00 8D 9D EB 02
ep_only = true

(aPlib 0:43) -> ap0x

24 08 01 0F 85 89 01
24 89 85 3C 04 00 00
00 00 33 FF E8 52 01

[RLPack V1:19 Dll

signature = 80 7C
01 75 0C 8B 44 24
00 00 8D 9D EB 02
34 37 01 04 24 FF
04 00 00 00 74 05
95 D1 03 00 00 89
C6 EB 01 40 80 38
00 56 FF 95 C9 03
00 8B 00 A9 00 00
B5 58 04 00 00 FF
00 EB 01 40 80 38
46 80 3E 00 75 FA
FF FF FF 68 00 40
24 01 00 00 61 E9
ep_only = true

(aPlib 0:43) -> ap0x&nbsp=

24 08 01 0F 85 89 01 00 00
24 89 85 3C 04 00 00 EB 0C
00 00 33 FF E8 52 01 00 00
D3 83 C4 08 83 C7 08 83 3C
E8 B8 01 00 00 8D 74 37 04
85 5C 04 00 00 5B FF B5 5C
01 75 FA 40 8B 38 03 BD 3C
00 00 85 C0 0F 84 B4 00 00
00 80 74 14 35 00 00 00 80
B5 54 04 00 00 FF 95 CD 03
00 75 FA 40 89 85 58 04 00
46 40 8B 38 03 BD 3C 04 00
00 00 68 ?? ?? ?? ?? FF B5
?? ?? ?? ?? 61 C3

&nbsp=> Sign by fly]

60 E8 00 00 00 00 8B
8B 85 38 04 00 00 89
EB 1B 8B 85 3C 04 00
37 00 75 DF 83 BD 48
53 6A 40 68 00 10 00
04 00 00 56 FF D3 83
04 00 00 83 C0 04 89
00 89 85 54 04 00 00
50 8B 85 58 04 00 00
00 00 85 C0 74 71 89
00 66 81 78 02 00 80
00 83 C0 04 89 85 58
5C 04 00 00 FF 95 D5

[RLPack V1:19 Dll

signature = 80 7C
01 75 0C 8B 44 24
00 00 8D 9D 2F 03
ep_only = true

(LZMA
24 08
24 89
00 00

4:30)
01 0F
85 49
33 FF

->
85
0B
6A

ap0x > Sign

C7 01 00 00
00 00 EB 0C
40 68 00 10

by
60
8B
00

[RLPack V1:19 Dll

signature = 80 7C
01 75 0C 8B 44 24
00 00 8D 9D 2F 03
85 41 0B 00 00 E8
FF 74 37 04 01 04
0B 00 00 00 74 05
95 DA 0A 00 00 89
69 0B 00 00 8B C6
00 E9 98 00 00 00
8B 85 65 0B 00 00
20 00 EB 06 FF B5
07 83 C7 04 8B 85

(LZMA
24 08
24 89
00 00
76 01
24 FF
E8 D7
85 69
EB 01
56 FF
8B 00
65 0B
65 0B

4:30)
01 0F
85 49
33 FF
00 00
D3 61
01 00
0B 00
40 80
95 D2
A9 00
00 00
00 00

->
85
0B
6A
EB
83
00
00
38
0A
00
FF
EB

ap0x&nbsp= &nbsp=> Sign

C7 01 00 00 60 E8 00 00
00 00 EB 0C 8B 85 45 0B
40 68 00 10 00 00 68 00
20 60 8B 85 49 0B 00 00
C7 08 83 3C 37 00 75 DA
8D 74 37 04 53 6A 40 68
5B 60 FF B5 41 0B 00 00
01 75 FA 40 8B 38 03 BD
00 00 89 85 61 0B 00 00
00 80 74 14 35 00 00 00
B5 61 0B 00 00 FF 95 D6
01 40 80 38 00 75 FA 40

0C
8D
0B
37
00
0A
00
98
65
EB
C7
80
00
00
00

8B
9D
00
04
00
00
00
00
0B
06
04
38
80
68
00

44
2F
00
01
74
00
8B
00
00
FF
8B
00
3E
00
61

24
03
E8
04
05
89
C6
00
00
B5
85
75
01
40
E9

24
00
76
24
E8
85
EB
56
8B
65
65
9C
0F
00
??

89
00
01
FF
D7
69
01
FF
00
0B
0B
EB
85
00
??

85
33
00
D3
01
0B
40
95
A9
00
00
01
5F
68
??

49
FF
00
61
00
00
80
D2
00
00
00
46
FF
00
??

0B
6A
EB
83
00
00
38
0A
00
FF
EB
80
FF
20
61

> Sign by fly]

00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28
EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04
00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04

2C
85
00
04
00
C4
85
8B
C7
07
74
04
03

24
3C
FF
00
68
08
58
C6
00
83
A5
00
00

83
04
74
00
??
8B
04
EB
20
C7
80
00
00

C4
00
37
00
??
B5
00
5B
20
04
38
80
E8

04
00
04
74
??
5C
00
8B
20
8B
00
3E
3D

83
8D
01
0E
??
04
E9
85
00
85
75
01
00

7C
B5
04
83
6A
00
94
58
EB
58
A0
0F
00

24
60
24
BD
00
00
00
04
06
04
EB
85
00

28
04
FF
4C
FF
8B
00
00
FF
00
01
63
E8

fly]
E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28
85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B
00 68 00 20 0C 00 6A 00 FF 95 DA

-207-

by
00
00
20
FF
83
00
56
49
85
80
0A
89

fly]
00 8B
00 89
0C 00
B5 41
BD 55
10 00
FF B5
0B 00
C0 0F
50 8B
00 00
85 65

2C
85
6A
0B
0B
00
69
00
84
85
85
0B

24
49
00
00
00
68
0B
83
C8
65
C0
00

83
0B
FF
00
00
??
00
C0
00
0B
0F
00

C4
00
95
FF
00
??
00
04
00
00
84
66

04
00
DA
34
74
??
FF
89
00
00
87
81

83
8D
0A
37
0E
??
D3
85
8B
C7
00
78

7C
B5
00
01
83
6A
61
65
C6
00
00
02

24
6D
00
04
BD
00
8B
0B
EB
20
00
00

28
0B
89
24
59
FF
B5
00
5F
20
89
80

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

74 A1 80 38 00
0B 00 00 80 3E
0A 00 00 68 00
24 01 00 00 61
ep_only = true

75
01
40
E9

9C
0F
00
??

EB
85
00
??

01
5F
68
??

04 August 2015 15:14

46
FF
00
??

80
FF
20
61

3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65
FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE
0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8
C3

[ROD High TECH -> Ayman]

signature = 60 8B 15 1D 13 40 00 F7 E0 8D 82 83 19 00 00 E8 58 0C 00 00
ep_only = true
[RPolyCrypt v 1:0 (personal polycryptor) sign from pinch]
signature = 50 58 97 97 60 61 8B 04 24 80 78 F3 6A E8 00 00 00 00 58 E8 00 00 00 00 58 91 91
EB 00 0F 85 6B F4 76 6F E8 00 00 00 00 83 C4 04 E8 00 00 00 00 58 90 E8 00 00 00 00 83 C4 04
8B 04 24 80 78 F1
ep_only = true
[RPolyCryptor V1:4:2 -> Vaska * Sign:By:fly]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00
ep_only = false
[Safe 2:0]
signature = 83 EC 10 53 56 57 E8 C4 01 00
ep_only = false
[SafeDisc 4]
signature = 00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F
ep_only = false
[Safedisc V4:50:000 -> Macrovision Corporation * Sign:By:fly *
signature = 55 8B EC 60 BB 6E ?? ?? ?? B8 0D ?? ?? ?? 33 C9 8A
2B C3 83 E8 05 EB 0E 51 B9 2B ?? ?? ?? 8B C1 2B C3 03 41 01 59
?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 25 FC FF FF 83 C4
C6 43 01 0C 85 C9 74 09 61 5D B8 00 00 00 00 EB 96 50 B8 F9 ??
24 08 00 75 40 51 8B 4C 24 04 89 0D ?? ?? ?? ?? B9 02 ?? ?? ??
?? ?? ?? FF 70 08 8B 40 0C FF D0 B8 FD ?? ?? ?? FF 30 8B 40 04
C3 72 16 61 13 60 0D E9 ?? ?? ?? ?? 66 83 3D ?? ?? ?? ?? ?? 74
ep_only = true

20080117]
08 85 C9 74
C6 03 E9 89
08 59 83 F8
?? ?? FF 10
89 4C 24 04
FF D0 58 B8
05 E9 91 FE

0C
43
00
61
59
25
FF

B8
01
74
5D
EB
??
FF

E4
51
1C
EB
29
??
C3

??
68
C6
47
50
??

??
D9
03
80
B8
FF

??
??
C2
7C
FD
30

[SafeDisc/SafeCast 2:xx
signature = 55 8B EC 60
C3 83 E8 05 EB 0E 51 B9
?? 33 C0 85 C9 74 05 8B
ep_only = false

- 3:xx -> Macrovision]

BB ?? ?? ?? ?? 33 C9 8A 0D 3D ?? ?? ?? 85 C9 74 0C B8 ?? ?? ?? ?? 2B
?? ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 09 ?? ??
45 08 EB 00 50 E8 76 00 00 00 83 C4 08 59 83 F8 00 74 1C

[SafeDisc/SafeCast 2:xx
signature = 55 8B EC 60
C3 83 E8 05 EB 0E 51 B9
?? 33 C0 85 C9 74 05 8B
43 01 0C 85 C9 74 09 61
08 00 75 3F 51 8B 4C 24
?? ?? ?? 70 08 8B 40 0C
16 61 13 60 0D E9 ?? ??
ep_only = true

- 3:xx -> Macrovision]

BB ?? ?? ?? ?? 33 C9 8A
?? ?? ?? ?? 8B C1 2B C3
45 08 EB 00 50 E8 76 00
5D B8 00 00 00 00 EB 97
04 89 0D ?? ?? ?? ?? B9
FF D0 B8 2D ?? ?? ?? ??
?? ?? CC CC 81 EC E8 02

0D
03
00
50
??
30
00

3D
41
00
A1
??
8B
00

??
01
83
29
??
40
53

??
59
C4
??
??
04
55

??
C6
08
??
89
FF
56

85
03
59
??
4C
D0
57

C9
E9
83
??
24
58

74
89
F8
D0
04
FF

0C
43
00
61
59
35

B8
01
74
5D
EB
??

??
51
1C
EB
28
??

??
68
C6
46
50
??

??
09
03
80
B8
??

??
??
C2
7C
2D
C3

2B
??
C6
24
??
72

[Safeguard 1:0 -> Simonzh]

signature = E8 00 00 00 00 EB 29
ep_only = true
[SafeGuard V1:0X -> simonzh2000 * Sign:By:fly]
signature = E8 00 00 00 00 EB 29 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? 59 9C 81 C1 E2 FF FF FF EB 01 ?? 9D FF E1
-208-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[Sc Obfuscator -> SuperCRacker > Sign by fly]
signature = 60 33 C9 8B 1D ?? ?? ?? ?? 03 1D ?? ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34
?? 88 04 19 41 3B 0D ?? ?? ?? ?? 75 E7 A1 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? 61 FF 25 ?? ?? ?? ??
00 00
ep_only = true
[SC Obfuscator -> SuperCRacker]
signature = 60 33 C9 8B 1D 00 ?? ?? ?? 03 1D 08 ?? ?? ?? 8A 04 19 84 C0 74 09 3C ?? 74 05 34
?? 88 04 19 41 3B 0D 04 ?? ?? ?? 75 E7 A1 08 ?? ?? ?? 01 05 0C ?? ?? ?? 61 FF 25 0C
ep_only = true
[SCAN /AV]
signature = 1E 0E 1F B8 ?? ?? 8E C0 26 8A 1E ?? ?? 80 ?? ?? 72
ep_only = true
[SCRAM> v0:8a1]
signature = B4 30 CD 21 3C 02 77 ?? CD 20 BC ?? ?? B9 ?? ?? 8B FC B2 ?? 58 4C
ep_only = true
[SCRAM> vC5]
signature = B8 ?? ?? 50 9D 9C 58 25 ?? ?? 75 ?? BA ?? ?? B4 09 CD 21 CD 20
ep_only = true
[SCRAMB v1:20]
signature = E9 J1 J1 E8 ?? ?? 5B 0E 1F 81 ?? ?? ?? 8B C3 05 ?? ?? 50 8B C8 03 D1 2B FA C3
ep_only = true
[SDC 1:2 (Self
signature = 55
53 83 EC 14 8B
44 24 04 00 00
ep_only = true

Decrypting Binary
89 E5 83 EC 08 C7
45 08 8B 00 8B 00
00 00 C7 04 24 08

Generator) - by Claes M
04 24 01 00 00 00 FF 15
3D 91 00 00 C0 77 3B 3D
00 00 00 E8 CE 24 00 00

Nyberg]
A0 91 40 00 E8 DB FE FF FF 55 89 E5
8D 00 00 C0 72 4B BB 01 00 00 00 C7
83 F8 01 0F 84 C4 00 00

[SDProtect -> Randy Li]

signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05
ep_only = true
[SDProtect() -> Randy Li]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00
00
ep_only = false
[SDProtector 1:1x -> Randy Li]
signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1
ep_only = true
[SDProtector 1:x -> Randy Li]
signature = 55 8B EC 6A FF 68
00 00 58 64 A3 00 00 00 00 58
00 51 8B 4C 24 10 89 81 B8 00
89 41 10 59 C3 C3 C3 C3 C3 C3
9D 90 90 C3 C3 C3 C3 C3 C3 C3
25 EB 00 EB FC 68 39 44 CD 00
EF FF FF FF 56 57 53 78 03 79
C8 74 C4 75 C2 E8 00 00 00 00
00 00 00 00 00 00 00 00 00 00
ep_only = true

1D
58
00
C3
C3
59
01
00
00

32
58
00
C3
C3
9C
E8
00
00

13
58
B8
C3
C3
50
68
00
00

05
8B
55
C3
C3
74
A2
00

68
E8
01
C3
C3
0F
AF
00

88
E8
00
C3
64
75
47
00

88
3B
00
C3
8F
0D
01
00

-209-

88
00
89
33
00
E8
59
00

08
00
41
C0
58
59
E8
00

64
00
20
64
74
C2
01
00

A1
E8
33
FF
07
04
00
00

00
01
C0
30
75
00
00
00

00
00
89
64
05
55
00
00

00
00
41
89
19
8B
FF
00

00
00
04
20
32
EC
58
00

50
FF
89
9C
67
E9
05
00

64
58
41
80
E8
FA
7B
00

89
05
08
4C
E8
FF
03
00

25
53
89
24
74
FF
00
00

00
00
41
01
27
0E
00
00

00
00
0C
01
75
E8
03
00

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[SDProtector 1:x -> Randy Li]

signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00
00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41
ep_only = true
[SDProtector Basic/Pro Edition 1:10
signature = 55 8B EC 6A FF 68 1D 32
00 00 58 64 A3 00 00 00 00 58 58 58
00 64 89 25 00 00 00 00 83 C4 08 50
00 00 64 A3 00 00 00 00 83 C4 08 58
44 CD 00 59 9C 50 74 0F 75 0D E8 59
78 0F 79 0D E8 34 99 47 49 34 33 EF
59 03 00 00 03 C8 74 B8 75 B6 E8 00
ep_only = true

->
13
58
64
74
C2
31
00

Randy
05 68
8B E8
FF 35
07 75
04 00
34 52

Li
88
50
00
05
55
47

(h)]
88 88
83 EC
00 00
19 32
8B EC
23 68

[SDProtector Basic/Pro Edition 1:10

signature = 55 8B EC 6A FF 68 1D 32
00 00 58 64 A3 00 00 00 00 58 58 58
00 64 89 25 00 00 00 00 83 C4 08 50
ep_only = true

->
13
58
64

Randy
05 68
8B E8
FF 35

Li]
88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00
50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00
00 00 00 00 64 89 25 00 00 00 00 64

[SDProtector Basic/Pro Edition 1:12

signature = 55 8B EC 6A FF 68 1D 32
00 00 58 64 A3 00 00 00 00 58 58 58
00 51 8B 4C 24 10 89 81 B8 00 00 00
89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3
9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3
25 EB 00 EB FC 68 39 44 CD 00 59 9C
EF FF FF FF 56 57 53 78 03 79 01 E8
C8 74 C4 75 C2 E8 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00
ep_only = true

->
13
58
B8
C3
C3
50
68
00
00

Randy
05 68
8B E8
55 01
C3 C3
C3 C3
74 0F
A2 AF
00 00
00 00

Li
88
E8
00
C3
64
75
47
00
00

(h)]
88 88
3B 00
00 89
C3 33
8F 00
0D E8
01 59
00 00
E2

08
08
00
67
E9
A2

08
00
41
C0
58
59
E8
00

64
64
64
E8
FA
AF

64
00
20
64
74
C2
01
00

A1
A1
89
E8
FF
47

A1
E8
33
FF
07
04
00
00

00
00
25
74
FF
01

00
01
C0
30
75
00
00
00

00
00
00
27
0E
59

00
00
89
64
05
55
00
00

00
00
00
75
E8
E8

00
00
41
89
19
8B
FF
00

00
00
00
25
EF
01

00
00
04
20
32
EC
58
00

50
64
00
EB
FF
00

50
FF
89
9C
67
E9
05
00

64
FF
64
00
FF
00

64
58
41
80
E8
FA
7B
00

89
35
8F
EB
FF
00

89
05
08
4C
E8
FF
03
00

25
00
05
FC
56
FF

25
53
89
24
74
FF
00
00

00
00
00
68
57
58

00
00
41
01
27
0E
00
00

00
00
00
39
53
05

00
00
0C
01
75
E8
03
00

[SDProtector Pro 1:12]

signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00
00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C
89 41 10 59 C3
ep_only = true
[SDProtector Pro Edition 1:16
signature = 55 8B EC 6A FF 68
00 00 58 64 A3 00 00 00 00 58
00 51 8B 4C 24 10 89 81 B8 00
89 41 10 59 C3 C3 C3 C3 C3 C3
9D 90 90 C3 C3 C3 C3 C3 C3 C3
25 EB 00 EB FC 68 39 44 CD 00
EF FF FF FF 56 57 53 78 03 79
C8 74 C4 75 C2 E8
ep_only = true

->
1D
58
00
C3
C3
59
01

Randy
32 13
58 58
00 B8
C3 C3
C3 C3
9C 50
E8 68

Li
05
8B
55
C3
C3
74
A2

(h)]
68 88
E8 E8
01 00
C3 C3
C3 64
0F 75
AF 47

[SDProtector Pro Edition 1:16

signature = 55 8B EC 6A FF 68
00 00 58 64 A3 00 00 00 00 58
00 51 8B 4C 24 10 89 81 B8 00
ep_only = false

->
1D
58
00

Randy
32 13
58 58
00 B8

Li]
05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00
8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00
55 01 00 00 89 41 18 33 C0 89 41 04 89 41

88
3B
00
C3
8F
0D
01

88
00
89
33
00
E8
59

08
00
41
C0
58
59
E8

64
00
18
64
74
C2
01

A1
E8
33
FF
07
04
00

[SDProtector V1:1X -> Randy Li > Sign by fly]

signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1
ep_only = true

-210-

00
01
C0
30
75
00
00

00
00
89
64
05
55
00

00
00
41
89
19
8B
FF

00
00
04
20
32
EC
58

50
FF
89
9C
67
E9
05

64
58
41
80
E8
FA
93

89
05
08
4C
E8
FF
03

25
53
89
24
74
FF
00

00
00
41
01
27
0E
00

00
00
0C
01
75
E8
03

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[SDW v1:74]
signature = E9 J1 J1 54 5B 3B DC 75 ?? EB ?? 9C 5B 81 ?? ?? ?? 53 9D 9C 58
ep_only = true
[SEA-AXE v2:2]
signature = FC BC ?? ?? 0E 1F A3 ?? ?? E8 ?? ?? A1 ?? ?? 8B ?? ?? ?? 2B C3 8E C0 B1 03 D3 E3
8B CB BF ?? ?? 8B F7 F3 A5
ep_only = true
[SEA-AXE]
signature = FC BC ?? ?? 0E 1F E8 ?? ?? 26 A1 ?? ?? 8B 1E ?? ?? 2B C3 8E C0 B1 ?? D3 E3
ep_only = true
[SecuPack v1:5]
signature = 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 ?? E8 E0 FC FF FF 33 C0 55
68 EA 3C 40 ?? 64 FF 30 64 89 20 6A ?? 68 80 ?? ?? ?? 6A 03 6A ?? 6A 01 ?? ?? ?? 80
ep_only = true
[SecureEXE 3:0 -> ZipWorx]
signature = E9 B8 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00
ep_only = true
[SecurePE 1:X]
signature = 8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00
53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33
C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55
ep_only = true
[SecurePE V1:X
signature = 8B
53 C3 00 00 00
C3 AB 43 81 FB
AD 68 34 40 00
ep_only = true

->
04
00
8E
8D

www:deepzone:org * Sign:By:fly]
24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00
8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33
2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55 34 40 00 89
85 BA 2F 40 00 50 C3

[SecuROM V7:X -> Sony DADC

signature = 9C 9C 83 EC 1C
?? ?? ?? C1 4C 24 18 18 ??
ED 80 64 24 18 FE ?? 8B 74
E2 00 8B 6C 24 0C 83 C4 18
81 04 24 ?? ?? ?? ?? 0F AC
ep_only = true

* Sign:By:fly * 20080114]
C7 44 24 18 ?? ?? ?? ?? C7
89 6C 24 0C 8B 2E 01 6C 24
24 1C C1 E1 00 8B 6C 24 18
9D ?? 74 12 81 04 24 ?? ??
F8 00 81 04 24 C2 04 00 3E

44
18
89
??
FF

24
??
74
??
74

14
83
24
??
24

BF
C6
18
81
04

03
04
8B
04
9D

01
66
74
24
EB

00
FF
24
C3
F5

89
4C
10
D1
EE

74
24
89
FF
93

24
14
6C
00
9D

10
52
24
EB

BE
5A
1C
FA

F0
75
C1
6B

[Securom7 -> Sony DADC * Sign:By:fly]

signature = B8 ?? ?? ?? ?? 8B ?? ?? ?? ?? 0A ?? ?? ?? ?? ?? ?? E8
ep_only = true
[SEN Debug Protector???]
signature = BB ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 29 ?? ?? 4E E8
ep_only = true
[Sentinel SuperPro (Automatic
signature = 68 ?? ?? ?? ?? 6A
C9 3D B7 00 00 00 A1 ?? ?? ??
05 ?? ?? ?? ?? 01 00 00 00 FF
ep_only = false

Protection)
01 6A 00 FF
?? 0F 94 C1
15 ?? ?? ??

6:4:0
15 ??
85 C0
?? 01

->
??
89
05

Safenet]
?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33
0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7
?? ?? ?? ?? FF 15

[Sentinel SuperPro (Automatic

signature = A1 ?? ?? ?? ?? 55
?? ?? ?? ?? 8B 0D ?? ?? ?? ??
?? ?? ?? ?? 6A 00 6A 00 68 ??
ep_only = false

Protection)
8B ?? ?? ??
55 51 FF 15
?? ?? ?? E8

6:4:1
85 C0
?? ??
?? ??

->
74
??
??

Safenet]
?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15
?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15
?? B8 01 00 00 00 5D C2 0C 00

-211-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Sentinel SuperPro (Automatic

signature = 68 ?? ?? ?? ?? 6A
C9 3D B7 00 00 00 A1 ?? ?? ??
05 ?? ?? ?? ?? 01 00 00 00 FF
?? ?? 25 FE FF DF 3F 0D 01 00
E8 ?? ?? ?? ?? 83 C4 04 83 F8
?? ?? ?? ?? FF D6 68 ?? ?? ??
?? FF D6 A1 ?? ?? ?? ?? 8B 2D
ep_only = true

Protection)
01 6A 00 FF
?? 0F 94 C1
15 ?? ?? ??
20 00 A3 ??
64 7C ?? 68
?? FF D6 68
?? ?? ?? ??

v6:4:0 -> Safenet]

15 ?? ?? ?? ?? A3 ??
85 C0 89 0D ?? ?? ??
?? 01 05 ?? ?? ?? ??
?? ?? ?? 33 C0 50 C7
?? ?? ?? ?? FF 15 ??
?? ?? ?? ?? FF D6 68
66 8B 55 00 83 C5 08

[Sentinel SuperPro (Automatic

signature = A1 ?? ?? ?? ?? 55
?? ?? ?? ?? 8B 0D ?? ?? ?? ??
?? ?? ?? ?? 6A 00 6A 00 68 ??
?? 6A 01 6A 00 FF 15 ?? ?? ??
?? ?? ?? 0F 94 C1 85 C0 89 0D
FF 15 ?? ?? ?? ?? 01 ?? ?? ??
00 20 00 A3 ?? ?? ?? ?? 33 C0
ep_only = true

Protection)
8B ?? ?? ??
55 51 FF 15
?? ?? ?? E8
?? A3 ?? ??
?? ?? ?? ??
?? ?? FF 15
50 C7 04 ??

v6:4:1 -> Safenet]

85 C0 74 ?? 85 ED 75
?? ?? ?? ?? 85 C0 74
?? ?? ?? ?? B8 01 00
?? ?? FF 15 ?? ?? ??
0F 85 ?? ?? ?? ?? 56
?? ?? ?? ?? 33 05 ??
?? ?? ?? ?? 00 00 00

[Sentinel SuperPro Dongle V5:42:0:0

signature = 60 E8 00 00 00 00 5D 81
?? 68 B9 20 FF 00 00 E8 ?? ?? ?? ??
F0 10 7F E8 ?? ?? ?? ?? 68 BB 02 00
01 00 00 00 E8 ?? ?? ?? ?? 68 50 1E
?? ?? ?? ?? 68 B9 20 12 00 00 E8 ??
68 BB 01 00 00 00 E8 ?? ?? ?? ?? 68
00 E8 ?? ?? ?? ?? 68
ep_only = true

->
ED
68
00
DF
??
88

[Sentinel UltraPro Dongle V1:1:0

signature = A1 ?? ?? ?? ?? 85 C0
?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF
?? A3 ?? ?? ?? ?? 33 C0 50 C7 04
7C E7 68 ?? ?? ?? ?? FF 15 ?? ??
FF D6 68 ?? ?? ?? ?? FF D6 68 ??
?? ?? ?? 66 8B 4D 00 83 C5 08 ??
?? ?? ?? 8B 55 FC 81 E1 FF FF 00
ep_only = true

SafeNet Inc: *
85 59 06 00 00
?? ?? ?? ?? 33
?? ?? ?? ?? ??
?? 8B 35 ?? ??
?? ?? FF D6 68
?? ?? ?? ?? ??
81 F9

->
0F
15
??
??
??
??
00

Rainbow Technologies
?? ?? ?? ?? B9 10 FF
B9 30 FF 00 00 E8 ??
00 E8 ?? ?? ?? ?? 68
80 E8 ?? ?? ?? ?? 68
?? ?? 68 E8 ?? ?? ??
B5 5B FF E8 ?? ?? ??

??
??
FF
04
??
??

??
0F
15
85
??
??

??
85
??
??
??
??

FF
??
??
??
8B
??

15
??
??
??
35
FF

??
??
??
??
??
D6

??
??
33
00
??
68

??
55
05
00
??
??

??
56
??
00
??
??

33
C7
??
00
68
??

??
??
00
??
C7
??
00

A1
8B
00
33
05
??
E8

??
15
5D
C9
??
??

??
??
C2
3D
??
25

??
??
0C
B7
??
FE

??
??
00
00
??
FF

50
??
68
00
01
DF

55
52
??
00
00
3F

FF
FF
??
A1
00
0D

15
15
??
??
00
01

* Sign:By:fly]
00 00 BB 00 00
?? ?? ?? 68 E8
07 D4 30 7F E8
B9 10 12 00 00
?? 68 07 2A A3
?? 68 B9 30 12

00
??
??
BB
00
00

00
??
??
00
E8
00

E8
??
??
00
??
BB

??
??
??
00
??
00

??
68
68
00
??
00

??
27
BB
E8
??
00

??
??
83
D6
??
??

??
??
C4
68
??
??

??
0D
04
??
??
66

??
01
83
??
8B
??

FF
??
F8
??
??
??

15
??
64
??
??
??

Sign:By:fly]
55 56 C7 05 ??
05 ?? ?? ?? ??
?? ?? ?? E8 BD
?? ?? 68 ?? ??
?? ?? ?? ?? FF
66 8B 75 FA ??

??
25
0F
??
D6
??

??
FE
00
??
A1
??

??
??
00
FF
??
??

[Setup Factory 6:0:0:3 Setup Launcher]

signature = 55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1
FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89
ep_only = false
[Setup Factory
signature = 55
00 00 83 EC 58
FF 00 00 00 89
ep_only = true

6:x Custom]
8B EC 6A FF 68 ?? 61 40 00 68 ?? 43 40 00 64 A1 00 00 00 00 50 64 89 25 00 00
53 56 57 89 65 E8 FF 15 ?? 61 40 00 33 D2 8A D4 89 15 A0 A9 40 00 8B C8 81 E1
0D

[Setup Factory
signature = 55
00 00 83 EC 58
FF 00 00 00 89
56 E8 E0 00 00
40 00 A3 40 8E
FF 89 75 D0 8D
D4 EB 03 6A 0A
FF FF 8B 45

v6:0:0:3
8B EC 6A
53 56 57
0D 58 89
00 59 85
40 00 E8
45 A4 50
58 50 FF

Setup
FF 68
89 65
40 00
C0 75
A4 0E
FF 15
75 9C

Launcher]
90 61 40 00
E8 FF 15 14
C1 E1 08 03
08 6A 1C E8
00 00 A3 90
0C 61 40 00
56 56 FF 15

68
61
CA
B0
89
E8
08

70
40
89
00
40
20
61

3B
00
0D
00
00
0B
40

-212-

40
33
54
00
E8
00
00

00
D2
89
59
4D
00
50

64
8A
40
89
0C
89
E8

A1
D4
00
75
00
45
5A

00
89
C1
FC
00
9C
E9

00
15
E8
E8
E8
F6
FF

00
5C
10
E6
8F
45
FF

00
89
A3
0F
0B
D0
89

50
40
50
00
00
01
45

64
00
89
00
00
74
A0

89
8B
40
FF
E8
06
50

25
C8
00
15
22
0F
E8

00
81
33
10
FE
B7
10

00
E1
F6
61
FF
45
FE

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = false
[Setup2Go Installer Stub]
signature = 5B 53 45 54 55 50 5F 49 4E 46 4F 5D 0D 0A 56 65 72
ep_only = false
[Sharp GPB Graphics format]
signature = 4D 00 00 00 00 ?? ?? ?? ?? 08 00 00 00 03 00 00
ep_only = false
[Shegerd Dongle V4:78 -> MS:Co:]
signature = E8 32 00 00 00 B8 ?? ?? ?? ?? 8B 18 C1 CB 05 89 DA 36 8B 4C 24 0C
ep_only = true
[ShellModify 0:1 -> pll621]
signature = 55 8B EC 6A FF 68 98 66 41 00 68 3C 3D 41 00 64 A1 00 00 00 00
ep_only = true
[shoooo's Pack -> shoooo]
signature = 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 ?? ?? ?? ?? E8
ep_only = true
[SHOWV20 Show-Text Utility]
signature = E9 J1 J1 B8 ?? ?? 2B ?? ?? ?? A3 ?? ?? E8 ?? ?? E8 ?? ?? E8
ep_only = true
[Shrink v1:0]
signature = 50 9C FC BE ?? ?? BF ?? ?? 57 B9 ?? ?? F3 A4 8B ?? ?? ?? BE ?? ?? BF ?? ?? F3 A4
C3
ep_only = true
[Shrink v2:0]
signature = E9 ?? ?? 50 9C FC BE ?? ?? 8B FE 8C C8 05 ?? ?? 8E C0 06 57 B9
ep_only = true
[Shrink Wrap v1:4]
signature = 58 60 8B E8 55 33 F6 68 48 01 ?? ?? E8 49 01 ?? ?? EB
ep_only = true
[Shrinker 3:2]
signature = 55 8B EC 56 57 75 65 68 00 01 00 00 E8 F1 E6 FF FF 83 C4 04
ep_only = false
[Shrinker 3:3]
signature = 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8
ep_only = false
[Shrinker 3:4]
signature = 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 11 0B 00 00 83 C4 04
ep_only = false
[Shrinker v3:2]
signature = 83 3D ?? ?? ?? ?? ?? 55 8B EC 56 57 75 65 68 00 01 ?? ?? E8 ?? E6 FF FF 83 C4 04
8B 75 08 A3 ?? ?? ?? ?? 85 F6 74 1D 68 FF
ep_only = true
[Shrinker v3:3]
signature = 83 3D ?? ?? ?? 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8
ep_only = true
[Shrinker v3:4]
signature = 83 3D B4 ?? ?? ?? ?? 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 ?? 0B 00 00 83 C4 04
-213-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

8B 75 08 A3 B4 ?? ?? ?? 85 F6 74 23 83 7D 0C 03 77 1D 68 FF
ep_only = true
[Shrinker v3:4]
signature = BB ?? ?? BA ?? ?? 81 C3 07 00 B8 40 B4 B1 04 D3 E8 03 C3 8C D9 49 8E C1 26 03 0E
03 00 2B
ep_only = true
[Silicon Realms Install
signature = 55 8B EC 6A
00 00 83 EC 58 53 56 57
FF 00 00 00 89 0D ?? ??
56 E8 ?? ?? 00 00 59 85
40 00 A3 ?? ?? 40 00 E8
FF 89 75 D0 8D 45 A4 50
D4 EB 03 6A 0A 58 50 FF
FF FF 8B 45 EC 8B 08 8B
FF FF 83 3D ?? ?? 40 00
ep_only = false

Stub]
FF 68
89 65
40 00
C0 75
?? ??
FF 15
75 9C
09 89
01 75

[Silicon Realms Install

signature = 55 8B EC 6A
00 00 83 EC 58 53 56 57
FF 00 00 00 89 0D ?? ??
ep_only = false

Stub]
FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00
89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1
40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3

??
E8
C1
08
00
??
56
4D
05

92
FF
E1
6A
00
91
56
98

40
15
08
1C
A3
40
FF
50

00
??
03
E8
??
00
15
51

68
??
CA
B0
??
E8
??
E8

??
40
89
00
40
??
91
??

??
00
0D
00
00
??
40
??

40
33
??
00
E8
00
00
00

00
D2
??
59
??
00
50
00

64
8A
40
89
??
89
E8
59

A1
D4
00
75
00
45
??
59

00
89
C1
FC
00
9C
??
C3

00
15
E8
E8
E8
F6
FF
8B

00
??
10
??
??
45
FF
65

00
??
A3
??
??
D0
89
E8

50
40
??
00
00
01
45
FF

64
00
??
00
00
74
A0
75

89
8B
40
FF
E8
06
50
98

25
C8
00
15
??
0F
E8
E8

00
81
33
??
??
B7
??
??

00
E1
F6
91
FF
45
??
??

[SimbiOZ -> Extranger]

signature = 50 60 E8 00 00 00 00 5D 81 ED 07 10 40 00 68 80 0B 00 00 8D 85 1F 10 40 00 50 E8
84 0B 00 00
ep_only = true
[SimbiOZ 1:3 -> Extranger]
signature = 57 57 8D 7C 24 04 50 B8 00 ?? ?? ?? AB 58 5F C3
ep_only = true
[Simple UPX Cryptor V30:4:2005 -> MANtiCORE]
signature = 60 B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? ?? ?? ?? ?? E2 FA 61 68 ?? ?? ?? ?? C3
ep_only = true
[Simple UPX Cryptor v30:4:2005 [multi layer encryption]
signature = 60 B8 ?? ?? ?? ?? B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? ?? C3
ep_only = true
[Simple UPX Cryptor v30:4:2005 [multi layer encryption]
signature = 60 B8 ?? ?? ?? 00 B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3
ep_only = true
[Simple UPX Cryptor v30:4:2005 [One layer encryption]
signature = 60 B8 ?? ?? ?? 00 B9 ?? 01 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3
ep_only = true
[SimplePack 1:11 Method
signature = 60 E8 00 00
00 0F B7 76 06 4E 8B 47
6A 00 FF 93 38 03 00 00
83 E1 03 F3 A4 5F 5E 8B
93 3C 03 00 00 83 C7 28
0F 84 FF 00 00 00 01 E9
00 00 6A 00 FF 93 38 03
56 6A 00 FF 93 48 03 00
ep_only = true

1 -> bagie[TMX]
00 00 5B 8D 5B FA
10 09 C0 74 55 0F
50 56 57 89 EE 03
04 24 89 EA 03 57
4E 75 9E BE ?? ??
89 CF 57 FF 93 30
00 00 89 C6 8D 83
00 89 E5

BD
B7
77
0C
??
03
6F

00
47
0C
E8
??
00
02

00
22
8B
3F
09
00
00

-214-

??
09
4F
01
F6
09
00

??
C0
10
00
0F
C0
57

8B
74
89
00
84
75
50

7D
4D
C7
58
0C
3D
56

3C
6A
89
68
01
6A
FF

8D
04
C8
00
00
04
93

74
68
C1
40
00
68
44

3D
00
E9
00
01
00
03

00
10
02
00
EE
10
00

8D
00
FC
FF
8B
00
00

BE
00
F3
77
4E
00
6A

F8
FF
A5
10
0C
68
10

00
77
89
50
09
00
6A

00
10
C1
FF
C9
10
00

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

[SimplePack 1:11 Method

signature = 60 E8 00 00
00 0F B7 76 06 4E 8B 47
6A 00 FF 93 38 03 00 00
ep_only = true

04 August 2015 15:14

1 -> bagie[TMX]]
00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00
10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10
50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC

[SimplePack 1:11 Method 2(NT) -> bagie[TMX]]

signature = 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00
00 00 00 00 00 E0 00 0F 03 0B 01
ep_only = true
[SimplePack V1:0X -> bagie > Sign by fly]
signature = 60 E8 00 00 00 00 5B 8D 5B FA 6A 00 FF 93 ?? ?? 00 00 89 C5 8B 7D 3C 8D 74 3D 00
8D BE F8 00 00 00 8B 86 88 00 00 00 09 C0
ep_only = true
[SimplePack V1:1X (Method1) -> bagie > Sign by fly]
signature = 60 E8 00 00 00 00 5B 8D 5B FA BD ?? ?? ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00
00 0F B7 76 06 4E 8B 47 10 09 C0
ep_only = true
[SimplePack V1:1X (Method2) -> bagie > Sign by fly]
signature = 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00
ep_only = false
[SimplePack V1:1X
signature = 4D 5A
00 00 00 00 00 E0
00 00 0C 00 00 00
00 00 00
ep_only = false

(Method2) -> bagie *

90 EB 01 00 52 E9 89
00 0F 03 0B 01 00 00
00 ?? ?? ?? 00 10 00

Sign:By:fly]
01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00

[SimplePack V1:1X
signature = 4D 5A
00 00 00 00 00 E0
00 00 0C 00 00 00
ep_only = false

(Method2) -> bagie]

90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00
00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04

[SimplePack V1:1X-V1:2X (Method2) -> bagie]

signature = 4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00
ep_only = true
[SimplePack V1:2:build:30:09 (Method2)
signature = 4D 5A 90 EB 01 00 52 E9 86
00 00 00 00 00 E0 00 0F 03 0B 01 00 00
00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00
00 00 00
ep_only = false

->
01
00
00

bagie
00 00
00 00
00 02

[SimplePack V1:2:build:30:09 (Method2)

signature = 4D 5A 90 EB 01 00 52 E9 86
00 00 00 00 00 E0 00 0F 03 0B 01 00 00
00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00
ep_only = true

->
01
00
00

bagie]
00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 02 00 00 01 00 00 00 00 00 00 00 04

[SimplePack V1:21:build:09:09
signature = 4D 5A 90 EB 01 00
00 00 00 00 00 E0 00 0F 03 0B
00 00 0C 00 00 00 00 ?? ?? ??
00 00 00
ep_only = false

* Sign:By:fly]
50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 01 00 00 00 00 00 00 00 04 00 00 00 00

(Method2) -> bagie *

52 E9 8A 01 00 00 50
01 00 00 00 00 00 00
00 10 00 00 00 02 00

-215-

Sign:By:fly]
45 00 00 4C 01 02 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 01 00 00 00 00 00 00 00 04 00 00 00 00

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[SimplePack V1:21:build:09:09
signature = 4D 5A 90 EB 01 00
00 00 00 00 00 E0 00 0F 03 0B
00 00 0C 00 00 00 00 ?? ?? ??
ep_only = true

(Method2) -> bagie]

52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04

[SimplePack V1:X (Method2)

signature = 4D 5A 90 EB 01
00 00 00 00 00 E0 00 0F 03
00 00 0C 00 00 00 00 ?? ??
00 00 00
ep_only = false

->
00
0B
??

bagie
52 E9
01 00
00 10

[SimplePack V1:X (Method2)

signature = 4D 5A 90 EB 01
00 00 00 00 00 E0 00 0F 03
00 00 0C 00 00 00 00 ?? ??
ep_only = true

->
00
0B
??

bagie]
52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04

* Sign:By:fly]
?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00

[SLR (OPTLINK) (1)]

signature = 87 C0 EB ?? 71 ?? 02 D8
ep_only = true
[SLR (OPTLINK)]
signature = BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB B4 30 CD 21
ep_only = true
[SLVc0deProtector 0:60 -> SLV / ICU]
signature = EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00
49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD
ep_only = false
[SLVc0deProtector
signature = E8 01
40 00 8B C0 8B D2
FF FF FF F3 B9 05
ep_only = false

1:1 -> SLV (h)]

00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A
2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2
00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6

[SLVc0deProtector 1:1x -> SLV / ICU]

signature = E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C ?? ?? 00
ep_only = true
[SLVc0deProtector v1:1 -> SLV (h)]
signature = E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C
ep_only = true
[SLVc0deProtector
signature = E8 01
40 00 8B C0 8B D2
FF FF FF F3 B9 05
D0 C0 FE C8 02 C1
A8 B0 1A 8B 08 91
0B 97 6B 79 63 A8
06 24 89 FA 74 30
ep_only = false

v1:1 -> SLV

00 00 00 A0
2B C2 83 E8
00 00 00 51
AA E2 EF 59
47 6C 5A 88
AB B8 78 A9

(h)]
5D EB
05 89
8D B5
E2 DE
6C 65
30 2F

01
42
BF
B7
39
2B

69
01
1A
FE
85
DA

81
E8
40
AB
DB
18

ED
FB
00
E1
CB
AC

5F
FF
8B
24
54
35

1A
FF
FE
C8
3D
45

40
FF
B9
0C
B9
36

00
69
58
88
24
BC

8D
83
15
7A
CF
0D

85
C4
00
E1
4C
7D

92
08
00
B1
AE
24

1A
E8
AC
6A
C6
D1

40
06
32
F7
63
51

00
00
C1
95
74
3C

F3
00
F6
83
2C
E6

8D
00
D0
1B
63
34

95
69
EB
A8
F0
11

83
E8
01
7F
C8
5A

1A
F2
00
F8
18
43

[SmartE -> Microsoft]

signature = EB 15 03 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00
00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 8F 07 00 00 89 85 83 07 00 00 FF 74 24 2C E8
BB 01 00 00 0F 82 2F 06 00 00 E8 8E 04 00 00 49 0F 88 23 06
ep_only = true

-216-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[SmokesCrypt v1:2]
signature = 60 B8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8A 14 08 80 F2 ?? 88 14 08 41 83 F9 ?? 75 F1
ep_only = true
[SnoopStop v1:15]
signature = ?? E9 J1 J1 EB ?? 20 ?? ?? ?? 73 ?? 20 ?? ?? 41 1A 05
ep_only = true
[Soft Defender 1:1x -> Randy Li]
signature = 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44
ep_only = true
[Soft Defender
signature = 74
59 C2 04 ?? 55
23 68 A2 AF 47
ep_only = true

v1:0 - v1:1]
07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD ?? 59 9C 50 74 0A 75 08 E8
8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47
01 59 E8 ?? ?? ?? ?? 58 05 BA 01 ?? ?? 03 C8 74 BE 75 BC E8

[Soft Defender v1:12]

signature = 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8
59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47
23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 BE 01 00 00 03 C8 74 BD 75 BB E8
ep_only = false
[Soft Defender v1:1x -> Randy Li]
signature = 74 07 75 05 ?? ?? ?? ?? ?? 74 1F 75 1D ?? 68 ?? ?? ?? 00 59 9C 50 74 0A 75 08 ??
59 C2 04 00 ?? ?? ?? E8 F4 FF FF FF ?? ?? ?? 78 0F 79 0D
ep_only = true
[SoftComp 1:x -> BG Soft PT]
signature = E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85
2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00
ep_only = false
[SoftDefender 1:x
signature = 74 07
59 C2 04 00 55 8B
23 68 A2 AF 47 01
ep_only = true

->
75
EC
59

Randy
05 19
E8 F4
E8 01

Li]
32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8
FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47
00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00

[SoftDefender 1:x
signature = 74 07
59 C2 04 00 55 8B
23 68 A2 AF 47 01
00 00 00 00 00 00
00 00 00 00 00 00
00 00 00 00 00 00
00 00 00 00 00 00
00 00 00 00 00 00
00 00 00 00 00 00
ep_only = true

->
75
EC
59
00
00
00
00
00
00

Randy
05 19
E8 F4
E8 01
00 00
00 00
00 00
00 00
00 00
00 00

Li]
32 67
FF FF
00 00
00 00
00 00
00 00
00 00
00 00
00 00

E8
FF
00
00
00
00
00
00
00

E8
56
FF
00
00
00
00
00
00

74
57
58
00
00
00
00
00

1F
53
05
00
00
00
00
00

75
78
E6
00
00
00
00
00

1D
0F
01
00
00
00
00
00

E8
79
00
00
00
00
00
00

68
0D
00
00
00
00
00
00

39
E8
03
00
00
00
00
00

44
34
C8
00
00
00
00
00

CD
99
74
00
00
00
00
00

00
47
BD
00
00
00
00
00

59
49
75
00
00
00
00
00

9C
34
BB
00
00
00
00
00

50
33
E8
00
00
00
00
00

74
EF
00
00
00
00
00
00

0A
31
00
00
00
00
00
00

75
34
00
00
00
00
00
00

08
52
00
00
00
00
00
00

E8
47
00
00
00
00
00
00

[SoftProtect -> SoftProtect:by:ru]

signature = EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03
?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35
9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C
ep_only = true
[SoftProtect -> SoftProtect:by:ru]
signature = EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03
?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35
9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C 75 F2 33 C4
-217-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

74 0C 23 C4 0B
?? E8 61 0E ??
07 E8 21 0D ??
EB 05 E8 A8 0C
E8 97 15 ?? ??
15 ?? ?? 8D 85
ep_only = true

C4
??
??
??
E8
88

C6
E8
EB
??
E2
0F

01
2E
09
E8
01
??

59
14
8D
B3
??
??

04 August 2015 15:14

C6
??
85
02
??
50

01
??
CF
??
8D
E8

59
8D
13
??
85

EB
85
??
8D
09

E2
E4
??
85
05

90
01
83
63
??

E8
??
08
02
??

44
??
01
??
50

14
50
83
??
E8

??
E8
BD
50
86

??
E2
1F
E8
15

8D
15
01
A3
??

85
??
??
15
??

CF
??
??
??
8D

13
83
01
??
85

??
BD
75
8D
F8

??
23
07
85
0F

C7
01
E8
F5
??

??
??
3E
02
??

??
??
0C
??
50

??
01
??
??
E8

??
75
??
50
7A

[SoftProtect -> SoftProtect:by:ru]

signature = E8 0C 15 00 00 8D 85 2F 14 00 00 C7 00 00 00 00 00 E8 29 0F 00 00 E8 F6 14 00 00
8D 85 20 01 00 00 50 E8 AA 16 00 00 83
ep_only = true
[SoftProtect -> www:softprotect:by:ru]
signature = E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? C7 00 00 00 00 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ??
8D ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? 01
ep_only = true
[SoftSentry v2:11]
signature = 55 8B EC 83 EC ?? 53 56 57 E9 50
ep_only = true
[SoftSentry v3:0]
signature = 55 8B EC 83 EC ?? 53 56 57 E9 B0 06
ep_only = true
[Software Compress -> BG Software]
signature = E9 BE 00 00 00 60 8B 74
73 F6 33 C9 E8 64 00 00 00 73 1C 33
C0 73 F7 75 3F AA EB D4 E8 4D 00 00
EB 1C 91 48 C1 E0 08 AC E8 2C 00 00
41 95 8B C5 B3 01 56 8B F7 2B F0 F3
FF FF FF 13 C9 E8 E7 FF FF FF 72 F2
95 1A 0F 41 00 89 44 24 1C 61 C2 04
81 2C 24 31 01 00 00 8B 85 2A 0F 41
00 8B 50 3C 03 D0 8B 92 80 00 00 00
ep_only = true

24
C0
00
00
A4
C3
00
00

24
E8
2B
3D
5E
2B
E8
29

8B
5B
CB
00
EB
7C
00
04

7C
00
75
7D
8E
24
00
24

24
00
10
00
02
28
00
8B

28
00
E8
00
D2
89
00
04

FC
73
42
73
75
7C
81
24

B2
23
00
0A
05
24
2C
89

80
B3
00
80
8A
1C
24
85

33
02
00
FC
16
61
3A
2A

DB
41
EB
05
46
C3
10
0F

A4
B0
28
73
12
60
41
41

B3
10
AC
06
D2
FF
00
00

02
E8
D1
83
C3
74
5D
58

E8
4F
E8
F8
33
24
E8
8B

6D
00
74
7F
C9
24
00
85

00
00
4D
77
41
6A
00
2A

00
00
13
02
E8
40
00
0F

00
12
C9
41
EE
FF
00
41

[Software Compress -> BG Software]

signature = E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00
73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12
C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8
ep_only = true
[Software Compress v1:2
signature = E9 BE 00 00
73 F6 33 C9 E8 64 00 00
C0 73 F7 75 3F AA EB D4
EB 1C 91 48 C1 E0 08 AC
41 95 8B C5 B3 01 56 8B
FF FF FF 13 C9 E8 E7 FF
95 1A 0F 41 00 89 44 24
81 2C 24 31 01 00 00 8B
ep_only = true

->
00
00
E8
E8
F7
FF
1C
85

BG
60
73
4D
2C
2B
FF
61
2A

Software
8B 74 24
1C 33 C0
00 00 00
00 00 00
F0 F3 A4
72 F2 C3
C2 04 00
0F 41 00

Protect Technologies
24 8B 7C 24 28 FC B2
E8 5B 00 00 00 73 23
2B CB 75 10 E8 42 00
3D 00 7D 00 00 73 0A
5E EB 8E 02 D2 75 05
2B 7C 24 28 89 7C 24
E8 00 00 00 00 81 2C
29 04 24

(h)]
80 33
B3 02
00 00
80 FC
8A 16
1C 61
24 3A

B3
10
AC
06
D2
FF
00

02
E8
D1
83
C3
74
5D

E8
4F
E8
F8
33
24
E8

6D
00
74
7F
C9
24
00

00
00
4D
77
41
6A
00

00
00
13
02
E8
40
00

00
12
C9
41
EE
FF
00

[Software Compress V1:2

signature = E9 BE 00 00
73 F6 33 C9 E8 64 00 00
C0 73 F7 75 3F AA EB D4
EB 1C 91 48 C1 E0 08 AC
41 95 8B C5 B3 01 56 8B
FF FF FF 13 C9 E8 E7 FF

->
00
00
E8
E8
F7
FF

BG
60
73
4D
2C
2B
FF

Software
8B 74 24
1C 33 C0
00 00 00
00 00 00
F0 F3 A4
72 F2 C3

Protect Technologies
24 8B 7C 24 28 FC B2
E8 5B 00 00 00 73 23
2B CB 75 10 E8 42 00
3D 00 7D 00 00 73 0A
5E EB 8E 02 D2 75 05
2B 7C 24 28 89 7C 24

* Sign:By:fly]
80 33 DB A4 B3
B3 02 41 B0 10
00 00 EB 28 AC
80 FC 05 73 06
8A 16 46 12 D2
1C 61 C3 60 FF

02
E8
D1
83
C3
74

E8
4F
E8
F8
33
24

6D
00
74
7F
C9
24

00
00
4D
77
41
6A

00
00
13
02
E8
40

00
12
C9
41
EE
FF

-218-

DB
41
EB
05
46
C3
10

A4
B0
28
73
12
60
41

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00
ep_only = true
[Software Compress V1:2 -> BG Software Protect Technologies]
signature = E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00
ep_only = true
[Software Compress V1:4
signature = E8 00 00 00
00 29 04 24 8B 04 24 89
03 D0 8B 4A 58 89 8D 49
64 89 8D 51 1A 41 00 8B
41 00 50 51 E8 1B 00 00
00 00 00 50 C3
ep_only = true

->
00
85
1A
4A
00

BG
81
5D
41
74
83

Software
2C 24 AA
1A 41 00
00 8B 4A
89 8D 59
C4 08 58

Protect Technologies
1A 41 00 5D E8 00 00
58 8B 85 5D 1A 41 00
5C 89 8D 4D 1A 41 00
1A 41 00 68 00 20 00
8D 78 74 8D B5 49 1A

* Sign:By:fly]
00 00 83 2C 24
8B 50 3C 03 D0
8B 4A 60 89 8D
00 E8 D2 00 00
41 00 B9 18 00

[Software Compress v1:4

signature = E8 00 00 00
00 29 04 24 8B 04 24 89
03 D0 8B 4A 58 89 8D 49
64 89 8D 51 1A 41 00 8B
41 00 50 51 E8 1B 00 00
00 00 00 50 C3 60 8B 74
E8 64 00 00 00 73 1C 33
3F AA EB D4 E8 4D 00 00
C1 E0 08 AC E8 2C 00 00
B3 01 56 8B F7 2B F0 F3
C9 E8 E7 FF FF FF 72 F2
00 89 44 24 1C 61 C2 04
ep_only = true

LITE -> BG Software Protect Technologies (h)]

00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C
85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03
1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89
4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00
00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18
24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D
C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00
00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74
00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F
A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9
C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24

[Software Compress v1:4

signature = E8 00 00 00
00 29 04 24 8B 04 24 89
03 D0 8B 4A 58 89 8D 49
ep_only = true

LITE -> BG Software Protect Technologies (h)]

00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41
85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00
1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A

24
D0
8D
00
00
00
00
4D
77
41
6A

6E
8B
55
00
00

8B
92
1A
50
00

85
80
41
8D
F3

5D
00
00
8D
A4

1A
00
8B
00
05

41
00
4A
1C
A4

6E
8B
55
00
00
00
00
13
02
E8
40

8B
92
1A
50
00
00
12
C9
41
EE
FF

85
80
41
8D
F3
73
C0
EB
41
FF
95

5D
00
00
8D
A4
F6
73
1C
95
FF
4D

1A
00
8B
00
05
33
F7
91
8B
FF
1A

41
00
4A
1C
A4
C9
75
48
C5
13
41

[SoftWrap]
signature = 52 53 51 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 36 ?? ?? ?? E8 ?? 01 ?? ?? 60 BA ?? ??
?? ?? E8 ?? ?? ?? ?? 5F
ep_only = true
[SOFTWrapper for Win9x/NT (Evaluation Version)]
signature = E8 00 00 00 00 5D 8B C5 2D ?? ?? ?? 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00
00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57
8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF
ep_only = true
[SOFTWrapper for Win9x/NT (Evaluation Version)]
signature = E8 00 00 00 00 5D 8B C5 2D ?? ?? ??
00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B
8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B
14 83 C7 14 EB D3 00 00 00 00 8B F5 81 C6 0D 0A
02 83 C6 06 E2 F8 E8 06 08 00 00 68 00 01 00 00
B5 03 0F 00 00 66 81 3E 4D 5A 75 33 03 76 3C 81
00 3B C5 74 1B 6A 30 E8 99 09 00 00 6A 30 8D 85
00 66 8B 85 9D 0A 00 00 F6 C4 80 74 31 E8 6A 07
8D 85 DD 0D 00 00 50 8B 9D 17 0F
ep_only = true

00
F8
1E
00
8D
3E
DD
00

50
03
89
00
85
50
0D
00

81
BD
1F
B9
DD
45
00
0B

ED
07
83
0C
0D
00
00
C0

05
0F
C6
00
00
00
50
75

00
00
04
00
00
75
8D
23

00
00
83
00
50
28
85
6A

00
83
C7
8B
6A
8B
2B
40

8B
7F
04
85
00
46
0F
E8

C5
0C
EB
03
E8
28
00
69

2B
00
EF
0F
95
03
00
09

85
74
5F
00
09
85
E9
00

03
2B
5E
00
00
03
55
00

0F
56
83
01
00
0F
03
6A

00
57
C6
46
8B
00
00
40

[Solidshield Protector V1:X -> Solidshield Technologies * Sign:By:fly]

signature = 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 00 60 89 00 0A 00 00 00 46 33 00 00 00 00 00
-219-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

00 00 00
ep_only = true
[Solidshield Protector V1:X DLL -> Solidshield Technologies
signature = 8B 44 24 08 48 75 0A FF 74 24 04 E8 ?? ?? ?? ??
8B 75 08 85 F6 75 28 68 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 FF 15
?? ?? 56 6A ?? FF ?? ?? ?? ?? ?? E9 80 00 00 00 83 FE 01 75
57 8B 7D 10 75 53 FF 75 24 FF 75 20 FF 75 1C FF 75 18 68 ??
?? ?? ?? BE ?? ?? ?? ?? 56 57 E8 ?? ?? ?? ?? 83 C4 20 3C 01
?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 56 57 E8 ?? ?? ?? ?? 83 C4 14
1B 57 E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59
75 0D FF 75 2C FF 75 28 E8 ?? ?? ?? ?? 59 59 83 FE 05 75 11
?? ?? ?? 83 C4 0C 33 C0 5F 5E 5D C3
ep_only = true

* Sign:By:fly]
59 33 C0 40 C2
?? ?? ?? ?? 59
07 5E 5D E9 D2
?? ?? ?? 68 ??
75 04 8B C6 EB
3C 01 74 DF 6A
6A 00 FF 15 ??
FF 75 30 FF 75

0C
59
F6
??
6A
03
??
2C

00
6A
FF
??
57
5E
??
FF

55
??
FF
??
FF
83
??
75

8B
68
83
FF
75
FE
83
28

EC
??
FE
15
0C
03
FE
E8

56
??
02
??
E8
75
04
??

[Spalsher 1:0 - 3:0 -> Amok]

signature = 9C 60 8B 44 24 24 E8 00 00 00 00
ep_only = true
[Spalsher v1:0 - v3:0]
signature = 9C 60 8B 44 24 24 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 50 E8 ED 02 ?? ?? 8C C0 0F
84
ep_only = true
[SPEC b2]
signature = 55 57 51 53 E8 ?? ?? ?? ?? 5D 8B C5 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 09
89 85 ?? ?? ?? ?? 0F B6
ep_only = true
[SPEC b3]
signature = 5B 53 50 45 43 5D E8 ?? ?? ?? ?? 5D 8B C5 81 ED 41 24 40 ?? 2B 85 89 26 40 ?? 83
E8 0B 89 85 8D 26 40 ?? 0F B6 B5 91 26 40 ?? 8B FD
ep_only = true
[Special EXE Password Protector v1:0]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00
89 85 3E 77
ep_only = true
[Special EXE Pasword
signature = 60 E8 00
89 85 3E 77 00 00 8D
7A 00 00 5D 6A 00 FF
ep_only = true

Protector 1:01
00 00 00 5D 81
95 C6 77 00 00
95 FC 79 00 00

(Eng)
ED 06
8D 8D
8D 8D

->
00
FF
60

Pavol
00 00
77 00
78 00

Cerven]
89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00
00 55 68 00 20 00 00 51 52 6A 00 FF 95 04
00 8D 95 85 01 00 00 55 68 00

[Special EXE Pasword

signature = 60 E8 00
89 85 3E 77 00 00 8D
7A 00 00 5D 6A 00 FF
6A 00 51 50 FF 95 08
C0 0F 84 FE 00 00 00
D2 8B BD 3E 77 00 00
8D 85 EB 75 00 00 89
77 00 00 60 74 1F 8D
00 F3 A5 61 EB 15 8D
ep_only = true

Protector v1:01 (Eng) -> Pavol Cerven]

00 00 00 5D 81 ED 06 00 00 00 89 AD 8C
95 C6 77 00 00 8D 8D FF 77 00 00 55 68
95 FC 79 00 00 8D 8D 60 78 00 00 8D 95
7A 00 00 5D 8D B5 3F 78 00 00 6A 00 6A
56 FF 95 10 7A 00 00 56 FF 95 14 7A 00
8D 85 1D 02 00 00 89 85 42 77 00 00 8D
85 4A 77 00 00 8B 84 D5 24 76 00 00 03
B5 BD 02 00 00 FF D6 85 D2 75 11 60 87
85 9F 02 00

01
00
85
00
00
85
F8
FE

00
20
01
6A
80
49
8B
8D

00
00
00
00
BD
02
8C
BD

8B
00
00
56
3E
00
D5
15

C5
51
55
FF
78
00
28
78

2B
52
68
95
00
89
76
00

85
6A
00
0C
00
85
00
00

FE
00
04
7A
00
46
00
B9

75
FF
00
00
74
77
3B
08

00
95
00
00
D4
00
85
00

00
04
52
0B
33
00
36
00

[Special EXE Pasword Protector v1:01 (Eng) -> Pavol Cerven]

signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00
89 85 3E
ep_only = true

-220-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Sphinx C-- v?:?? 19??]

signature = EB J3 31 C0 8E C0 26 C7 06 ?? ?? ?? ?? 26 8C 0E ?? ?? E9
ep_only = true
[Sphinx C-- v?:?? 19??]
signature = E9 J1 J1 B4 34 CD 21 8C 06 ?? ?? 89 1E ?? ?? B8 ?? ?? E8 ?? ?? B8 ?? ?? BB
ep_only = true
[Splash Bitmap
signature = E8
?? ?? 29 F9 31
45 00 00 75 E8
ep_only = true

v1:00
00 00
C0 FC
89 85

(With
00 00
F3 AA
?? ??

[Splash Bitmap
signature = E8
?? ?? 29 F9 31
45 00 00 75 E8
ep_only = true

v1:00
00 00
C0 FC
89 85

->
00
F3
??

Unpack Code) -> BoB / Bobsoft]

60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ??
8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50
?? ?? 6A 40

BoB /
00 60
AA 8B
?? ??

Bobsoft]
8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ??
04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50
?? 8D BD ?? ?? ?? ?? 6A 00

[SPLayer v0:08]
signature = 8D 40 00 B9 ?? ?? ?? ?? 6A ?? 58 C0 0C ?? ?? 48 ?? ?? 66 13 F0 91 3B D9 ?? ?? ??
?? ?? ?? ?? ?? 00 00 00 00
ep_only = false
[Splice 1:1 - by Tw1sted L0gic]
signature = 68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00
00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ??
?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC
ep_only = true
[ST Protector V1:5 -> Silent Software]
signature = 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64
64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00
ep_only = false
[StarForce 3:0 -> StarForce Technology]
signature = 68 ?? ?? ?? ?? FF 25 ?? ?? 63
ep_only = true
[StarForce ProActive 1:1 -> StarForce Technology]
signature = 68 ?? ?? ?? ?? FF 25 ?? ?? 57
ep_only = true
[StarForce Protection Driver -> Protection Technology (h)]
signature = 57 68 ?? 0D 01 00 68 00 ?? ?? 00 E8 50 ?? FF FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68
?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00
ep_only = true
[StarForce V3:X -> StarForce Copy Protection System]
signature = 68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00
ep_only = true
[StarForce V3:X DLL -> StarForce Copy Protection System]
signature = E8 ?? ?? ?? ?? 00 00 00 00 00 00
ep_only = true
[Stelth PE 1:01 -> BGCorp]
signature = ?? ?? ?? ?? ?? BA ?? ?? ?? 00
ep_only = true
[Stealth PE v1:1]
-221-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = BA ?? ?? ?? 00 FF E2 BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 03 B8 ?? ?? ?? ??
89 02 83 C2 FD FF E2
ep_only = true
[STNPEE 1:13]
signature = 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 3B 40 00
ep_only = true
[Stone's PE Encryptor v1:0]
signature = 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 63 3A 40 ?? 2B 95 C2 3A 40 ?? 83
EA 0B 89 95 CB 3A 40 ?? 8D B5 CA 3A 40 ?? 0F B6 36
ep_only = true
[Stone's PE Encryptor v1:13]
signature = 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 97 3B 40 ?? 2B 95 2D 3C 40 ?? 83
EA 0B 89 95 36 3C 40 ?? 01 95 24 3C 40 ?? 01 95 28
ep_only = true
[Stone's PE Encryptor v2:0]
signature = 53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 42 30 40 ?? FF 95 32 35 40 ?? B8 37 30
40 ?? 03 C5 2B 85 1B 34 40 ?? 89 85 27 34 40 ?? 83
ep_only = true
[Stone`s PE Encruptor v1:13]
signature = 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81
ep_only = true
[Stony Brook Pascal v6:14]
signature = 31 ED 9A ?? ?? ?? ?? 55 89 E5 ?? EC ?? ?? 9A
ep_only = true
[Stony Brook Pascal+ v7:0]
signature = 31 ED 9A ?? ?? ?? ?? 55 89 E5 81 EC ?? ?? B8 ?? ?? 0E 50 9A ?? ?? ?? ?? BE ?? ??
1E 0E BF ?? ?? 1E 07 1F FC
ep_only = true
[Stranik 1:3 Modula/C/Pascal]
signature = E8 ?? ?? FF FF E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? 00
ep_only = true
[Stranik 1:3 Modula/C/Pascal]
signature = E8 ?? ?? FF FF E8
?? ?? 00 ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ??
00 ?? ?? ?? ?? ?? ?? 00 ?? ??
?? 00 ?? ?? ?? ?? ?? ?? ?? ??
?? 00 ?? ?? ?? 00 00 00 ?? ??
?? ?? 00 ?? ?? ?? ?? ?? 00 ??
?? ?? ?? 00 00 00 ?? ?? 00 ??
?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true

??
??
??
??
??
??
??
??

??
??
??
??
??
00
00
??

FF
??
??
??
??
??
??
??

FF
??
??
??
??
??
??
??

??
??
??
??
??
00
??
??

??
??
??
??
??
??
00
00

??
??
??
??
??
00
00
??

??
??
??
??
??
??
00
??

??
??
??
??
??
00
??
00

??
??
??
00
??
00
??
??

[STUD RC4 1:0 Jamie Edition (ScanTime UnDetectable) signature = 68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00

00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00
72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00
ep_only = true

by
00
00
CC

MarjinZ]
00 30 00 00 00 38 00 00 00 00 00 00
00 00 00 00 01 00 00 00 20 20 46 6F
1A 40 00 07 00 00 00 D4

[SuckStop v1:11]
signature = EB ?? ?? ?? BE ?? ?? B4 30 CD 21 EB ?? 9B
ep_only = true
-222-

??
??
??
??
??
??
??
??

??
??
??
??
??
00
??
??

??
??
??
??
??
??
??
00

??
??
??
??
??
??
??
00

??
??
??
??
??
??
??
00

??
??
??
??
??
??
??
??

??
??
??
00
??
??
??
??

??
??
??
??
??
00
00
??

??
??
??
??
??
??
??
??

??
??
??
??
00
??
??
??

??
??
??
??
??
00
00
00

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Sun Icon Graphics format]

signature = 2F 2A 20 46 6F 72 6D 61 74 5F 76 65 72 73 69 6F 6E 3D 31 2C
ep_only = false
[SuperDAT]
signature = 55 8B EC 6A FF 68 40 F3 42 00 68 A4 BF 42 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 58 53 56 57 89 65 E8 FF 15 08 F2 42 00 33 D2 8A D4 89 15 60 42 43 00 8B C8 81 E1
FF 00 00 00 89 0D
ep_only = true
[SVK Protector 1:32 (Eng) -> Pavol Cerven]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB
03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA
8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E
ep_only = false
[SVK Protector 1:3x (Eng) -> Pavol Cerven]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB
03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA
8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E
ep_only = false
[SVK Protector
signature = 60
03 C7 84 E8 84
8B 8D C1 02 00
EB F8 46 E2 E3
06 8B 8D 0C 61
B4 00 00 00 50
62 75 67 67 65
65 74 65 63 74
00 00 00 00 00
ep_only = true

v1:32
E8 00
C0 EB
00 5E
8B C5
00 00
8D 85
72 20
65 64
00 00

(Eng)
00 00
03 C7
55 51
8B 4C
89 8D
B4 01
6F 72
21 21
00 00

->
00
84
6A
24
B5
00
20
21
00

Pavol
5D 81
E9 75
00 56
20 2B
02 00
00 50
74 6F
00 00
00

Cerven]
ED 06 00
67 B9 49
FF 95 0C
85 BD 02
00 8D 85
6A 00 FF
6F 6C 20
00 00 00

00
00
61
00
0E
95
66
00

00
00
00
00
03
18
6F
00

EB
00
00
89
00
61
72
00

05
8D
59
85
00
00
20
00

B8
B5
5D
B9
8B
00
6D
00

06
C5
40
02
DD
5D
6F
00

36
02
85
00
FF
6A
6E
00

42
00
C0
00
E0
FF
69
00

00
00
75
80
55
FF
74
00

64
56
3C
BD
68
95
6F
00

A0
80
80
B4
10
10
72
00

23
06
3E
02
10
61
69
00

00
44
00
00
00
00
6E
00

00
46
74
00
00
00
67
00

00
E2
03
01
8D
44
20
00

EB
FA
46
75
85
65
64
00

[SVK Protector
signature = 60
03 C7 84 E8 84
8B 8D C1 02 00
EB F8 46 E2 E3
06 8B 8D 0C 61
B4 00 00 00 50
62 75 67 67 65
65 74 65 63 74
00 00 00 00 00
ep_only = true

v1:3x
E8 00
C0 EB
00 5E
8B C5
00 00
8D 85
72 20
65 64
00 00

(Eng)
00 00
03 C7
55 51
8B 4C
89 8D
B4 01
6F 72
21 21
00 00

->
00
84
6A
24
B5
00
20
21
00

Pavol
5D 81
E9 75
00 56
20 2B
02 00
00 50
74 6F
00 00
00

Cerven]
ED 06 00
67 B9 49
FF 95 0C
85 BD 02
00 8D 85
6A 00 FF
6F 6C 20
00 00 00

00
00
61
00
0E
95
66
00

00
00
00
00
03
18
6F
00

EB
00
00
89
00
61
72
00

05
8D
59
85
00
00
20
00

B8
B5
5D
B9
8B
00
6D
00

??
C5
40
02
DD
5D
6F
00

??
02
85
00
FF
6A
6E
00

42
00
C0
00
E0
FF
69
00

00
00
75
80
55
FF
74
00

64
56
3C
BD
68
95
6F
00

A0
80
80
B4
10
10
72
00

23
06
3E
02
10
61
69
00

00
44
00
00
00
00
6E
00

00
46
74
00
00
00
67
00

00
E2
03
01
8D
44
20
00

EB
FA
46
75
85
65
64
00

[SVK-Protector v1:051]
signature = 60 EB 03 C7 84 E8 EB 03 C7 84 9A E8 00 00 00 00 5D 81 ED 10 00 00 00 EB 03 C7 84
E9 64 A0 23 00 00 00 EB
ep_only = true
[SVK-Protector v1:11]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? 64 A0 23
ep_only = true
[SVK-Protector v1:32]
signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23
ep_only = true
[SVK-Protector v1:43 -> www:anticracking:sk]
signature = 78 4E 88 4C 0E B0 3C 78 4E 97 56 7B 94 90 00 00 08 DB 5C 50 20 00 05 6
-223-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = false
[SVKP v1:32 ->
signature = 60
03 C7 84 E8 84
8B 8D C1 02 00
EB F8 46 E2 E3
06 8B 8D 0C 61
B4 00 00 00 50
ep_only = true

Pavol
E8 00
C0 EB
00 5E
8B C5
00 00
8D 85

Cerven (h)]
00 00 00 5D
03 C7 84 E9
55 51 6A 00
8B 4C 24 20
89 8D B5 02
B4 01 00 00

81
75
56
2B
00
50

ED
67
FF
85
00
6A

06
B9
95
BD
8D
00

00
49
0C
02
85
FF

00
00
61
00
0E
95

00
00
00
00
03
18

EB
00
00
89
00
61

05
8D
59
85
00
00

B8
B5
5D
B9
8B
00

06
C5
40
02
DD
5D

36
02
85
00
FF
6A

42
00
C0
00
E0
FF

00
00
75
80
55
FF

64
56
3C
BD
68
95

A0
80
80
B4
10
10

23
06
3E
02
10
61

00
44
00
00
00

00
46
74
00
00

00
E2
03
01
8D

EB
FA
46
75
85

[SVKP v1:42 ->

signature = 60
03 C7 84 E8 84
8B 8D C1 02 00
EB F8 46 E2 E3
06 8B 8D 2D 67
B4 00 00 00 50
ep_only = true

Pavol
E8 00
C0 EB
00 5E
8B C5
00 00
8D 85

Cerven (h)]
00 00 00 5D
03 C7 84 E9
55 51 6A 00
8B 4C 24 20
89 8D B5 02
B4 01 00 00

81
75
56
2B
00
50

ED
67
FF
85
00
6A

06
B9
95
BD
8D
00

00
49
2D
02
85
FF

00
00
67
00
0E
95

00
00
00
00
03
39

EB
00
00
89
00
67

05
8D
59
85
00
00

B8
B5
5D
B9
8B
00

49
C5
40
02
DD
5D

DC
02
85
00
FF
6A

EC
00
C0
00
E0
FF

00
00
75
80
55
FF

64
56
3C
BD
68
95

A0
80
80
B4
10
31

23
06
3E
02
10
67

00
44
00
00
00

00
46
74
00
00

00
E2
03
01
8D

EB
FA
46
75
85

[SVKP v1:43 ->

signature = 60
03 C7 84 E8 84
8B 8D C1 02 00
EB F8 46 E2 E3
06 8B 8D 2D 67
B4 00 00 00 50
ep_only = true

Pavol
E8 00
C0 EB
00 5E
8B C5
00 00
8D 85

Cerven (h)]
00 00 00 5D
03 C7 84 E9
55 51 6A 00
8B 4C 24 20
89 8D B5 02
B4 01 00 00

81
75
56
2B
00
50

ED
67
FF
85
00
6A

06
B9
95
BD
8D
00

00
49
2D
02
85
FF

00
00
67
00
0E
95

00
00
00
00
03
39

EB
00
00
89
00
67

05
8D
59
85
00
00

B8
B5
5D
B9
8B
00

49
C5
40
02
DD
5D

DC
02
85
00
FF
6A

CE
00
C0
00
E0
FF

05
00
75
80
55
FF

64
56
3C
BD
68
95

A0
80
80
B4
10
31

23
06
3E
02
10
67

00
44
00
00
00

00
46
74
00
00

00
E2
03
01
8D

EB
FA
46
75
85

[Symantec C v2:10; v4:00 or Zortech C v3:0r1]

signature = FA FC B8 ?? ?? 8E D8
ep_only = true
[Symantec C v4:00 + Libraries]
signature = FA B8 ?? ?? DB E3 8E D8 8C 06 ?? ?? 8B D8 2B 1E ?? ?? 89 1E ?? ?? 26
ep_only = true
[Symantec Visual Cafe v3:0]
signature = 64 8B 05 ?? ?? ?? ?? 55 8B EC 6A FF 68 ?? ?? 40 ?? 68 ?? ?? 40 ?? 50 64 89 25 ??
?? ?? ?? 83 EC 08 50 53 56 57 89 65 E8 C7 45 FC
ep_only = true
[Symantec WinFax PRO 7:5 Coverpage]
signature = 0C BD 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 06 80
ep_only = false
[Symantec WinFax PRO 8:3 Coverpage Quick CoverPage]
signature = FF FF ?? ?? ?? ?? ?? 43 6F 76 65 72 44 61 74 61 62 61 73 65
ep_only = false
[Symantec WinFax PRO 8:3 Coverpage]
signature = 0C BD 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 06 6C
ep_only = false
[SysPack v0:1]
signature = ?? ?? ?? ?? ?? ?? ?? ?? J2 J2 0E 2E ?? ?? ?? ?? 06 53 2E ?? ?? ?? ?? 26 ?? ?? ??
?? 74 ?? 26 ?? ?? ?? ?? ?? 5B 07
ep_only = true
[T-PACK v0:5c -m1]
signature = 68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 8E FE
ep_only = true
-224-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[T-PACK v0:5c -m2]

signature = 68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 CE FD
ep_only = true
[T:P:C's COM Scrambler v1:00]
signature = ?? ?? ?? ?? ?? ?? ?? EB J3 2E ?? ?? ?? ?? 8E C0 8C D8 BE ?? ?? BF ?? ?? 2E ?? ??
?? ?? 26 ?? ?? ?? 26 ?? ?? ?? ?? 26 ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 0E 07 B9 ?? ?? FC F3 A4 CC
ep_only = true
[TaiShanXiangYu LockSoft DLL V1:0 -> zlocksoft * Sign:By:fly]
signature = 60 E8 00 00 00 00 5D 81 ED E3 00 42 00 8B D5 81 C2
C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3
64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30
00 EB 01 ?? 33 DB B9 AF 28 42 00 81 E9 DD 01 42 00 8B D5 81 C2
E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 78 20 00 00
C3 90 EB 01 ?? AC
ep_only = false
[TaiShanXiangYu LockSoft V1:0
signature = E8 03 00 00 00 EB
03 00 00 00 EB 01 ?? E8 82 00
01 ?? E8 AB 00 00 00 E8 03 00
00 00 EB 01 ?? C3 60 E8 00 00
00 00 C3 C3 E8 03 00 00 00 EB
33 C0 64 FF 30 64 89 20 CC C3
00 00 00 EB 01 ?? 33 DB B9 ??
33 C0 E8 03 00 00 00 EB 01 ??
43 CC C3
ep_only = true

->
01
00
00
00
01
E8
??
E8

zlocksoft *
?? BB 55 00
00 E8 03 00
00 EB 01 ??
00 5D 81 ED
?? E8 0E 00
03 00 00 00
?? ?? 81 ??
17 00 00 00

Sign:By:fly]
00 00 E8 03 00
00 00 EB 01 ??
83 FB 55 E8 03
E3 00 42 00 8B
00 00 E8 D1 FF
EB 01 ?? 33 C0
?? ?? ?? ?? 8B
?? ?? ?? E9 ??

00
E8
00
D5
FF
64
D5
??

32
E8
64
DD
33

01
03
89
01
C0

42
00
20
42
64

00
00
4B
00
FF

52
00
CC
8D
30

E8
EB
C3
3A
64

01
01
E8
8B
89

00
??
03
F7
20

00
33
00
33
43

00
C0
00
C0
CC

00
B8
00
81
FF
FF
81
??

EB
00
00
C2
C3
30
??
??

01
00
EB
32
E8
64
??
33

??
00
01
01
03
89
??
C0

E8
E8
??
42
00
20
??
64

8F
03
75
00
00
4B
??
FF

00
00
2E
52
00
CC
8D
30

00
00
E8
E8
EB
C3
3A
64

00
00
03
01
01
E8
8B
89

E8
EB
00
00
??
03
F7
20

[TASM / MASM]
signature = 6A 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00
ep_only = true
[TAV]
signature = E8 ?? ?? 4D 5A CB
ep_only = true
[tElock 0:98 -> tHE EGOiSTE (h)]
signature = E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00
ep_only = false
[tElock 0:98 Special Build -> forgot & heXer]
signature = E9 99 D7 FF FF 00 00 00 ?? ?? ?? ?? AA ?? ?? 00 00 00 00 00 00 00 00 00 CA
ep_only = true
[tElock 0:99 - 1:0 private -> tE>]
signature = E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00
ep_only = true
[tElock 0:99 -> tE>]
signature = E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05
ep_only = true
[tElock 0:99 Special
signature = E9 5E DF
00 F5 ?? ?? 00 ED ??
00 00 00 00 00 00 00
ep_only = false

Build
FF FF
?? 00
00 00

->
00
00
00

heXer
00 00
00 00
00 00

& forgot]
?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ??
00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00
00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00

-225-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[tElock 0:99]
signature = E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ??
00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ??
?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00
ep_only = false
[tElock 1:0 (private) -> tE>]
signature = E9 ?? ?? FF FF ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ??
ep_only = true

??
??
??
00

??
??
??
00

??
??
??
00

??
??
??
00

??
??
??
00

??
??
??
6B

??
??
??
65

??
??
??
72

??
??
??
6E

??
??
??
65

??
??
??
6C

??
??
??
33

?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ??
32

[tElock v0:41x]
signature = 66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 50 8B FE 68 78
01 ?? ?? 59 EB 01 EB AC 54 E8 03 ?? ?? ?? 5C EB 08
ep_only = true
[tElock v0:42]
signature = C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 52 8B FE 68 79
01 59 EB 01 EB AC 54 E8 03 5C EB 08
ep_only = true
[tElock v0:4x - v0:5x]
signature = C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 ?? 8B FE 68 79
01 ?? ?? 59 EB 01
ep_only = true
[tElock v0:51]
signature = C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79
01 59 EB 01 EB AC 54 E8 03 5C EB 08
ep_only = true
[tElock v0:60]
signature = E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08
ep_only = true
[tElock v0:70]
signature = 60 E8 BD 10 00 00 C3 83 E2 00 F9 75 FA 70
ep_only = true
[tElock v0:71]
signature = 60 E8 ED 10 00 00 C3 83
ep_only = true
[tElock v0:71b2]
signature = 60 E8 44 11 00 00 C3 83
ep_only = true
[tElock v0:71b7]
signature = 60 E8 48 11 00 00 C3 83
ep_only = true
[tElock v0:7x - v0:84]
signature = 60 E8 00 00 C3 83
ep_only = true
[tElock v0:80]
signature = 60 E8 F9 11 00 00 C3 83
ep_only = true

-226-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[tElock v0:85f]
signature = 60 E8 02 00 00 00 CD 20 E8 00 00 00 00 5E 2B C9 58 74 02
ep_only = true
[tElock v0:90]
signature = ?? ?? E8 02 00 00 00 E8 00 E8 00 00 00 00 5E 2B
ep_only = true
[tElock v0:92a]
signature = E9 7E E9 FF FF 00
ep_only = true
[tElock v0:95]
signature = E9 D5 E4 FF FF 00
ep_only = true
[tElock v0:96]
signature = E9 59 E4 FF FF 00
ep_only = true
[tElock v0:98 -> tHE
signature = E9 25 E4
?? ?? ?? ?? ?? ?? ??
00 00 00 00 00 00 00
?? ?? ?? 00 00 00 00
72 33 32 2E 64 6C 6C
73 73 61 67 65 42 6F
ep_only = true

EGOiSTE (h)]
FF FF 00 00 00
?? ?? 00 00 00
00 00 00 00 00
?? ?? ?? ?? 00
00 00 00 47 65
78 41 00 00 00

??
00
00
00
74
00

??
00
00
00
4D
00

??
00
??
00
6F
00

??
00
??
6B
64
00

??
00
??
65
75
00

??
??
??
72
6C
00

??
??
00
6E
65
00

??
??
00
65
48
00

00
??
00
6C
61
00

00
??
00
33
6E
08

00
??
??
32
64
00

00
??
??
2E
6C
00

00
??
??
64
65
00

00
00
??
6C
41

00
00
00
6C
00

00
00
00
00
00

??
00
00
75
00

??
00
00
73
4D

??
00
??
65
65

[tElock v0:98]
signature = E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E
ep_only = true
[tElock v0:98b1]
signature = E9 25 E4 FF FF
ep_only = true
[tElock v0:98b2]
signature = E9 1B E4 FF FF
ep_only = true
[tElock v0:99 Special Build -> heXer &
signature = E9 5E DF FF FF 00 00 00 ??
00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00
?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00
ep_only = true
[tElock v0:99]
signature = E9
00 ?? ?? ?? 00
?? 00 00 00 00
?? 02 00 00 00
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? 00 ??
00 ?? ?? ?? 00
00 00 ?? ?? ??
ep_only = true

??
??
00
00
??
??
??
??
00

??
??
00
00
??
??
02
??
00

FF
02
00
??
??
??
00
00
00

FF
00
00
??
??
??
??
00
00

00
??
00
02
??
??
??
00
00

00
??
00
00
??
??
02
00
00

00
??
00
00
??
??
00
00

??
00
00
00
??
??
??
00

forgot]
?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ??
00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00
00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 00 00 00 1D
00 00

??
??
00
00
??
??
??
??

??
??
??
00
??
??
02
??

??
??
??
??
??
??
00
??

??
00
??
??
??
??
??
00

[tElock v1:00]
signature = E9 E5 E2 FF FF
-227-

??
??
00
??
??
00
??
00

??
??
00
??
??
00
02
??

00
??
00
??
??
00
00
??

??
00
00
??
??
00
77
00

??
??
00
??
??
??
??
00

??
??
??
??
??
00
02
00

??
??
??
??
??
00
00
??

??
00
02
??
??
00
??
00

??
??
00
??
??
00
??
00

??
??
00
??
??
00
02
??

00
??
00
??
??
??
00
??

??
00
00
??
??
??
??
00

??
??
00
??
??
??
??
??

??
??
??
??
??
00
??
??

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[The aPE Inline Patch Basic; Advanced; Stealth)]
signature = B9 ?? ?? ?? 00 E8 ?? ?? 00 00 89 01 68
ep_only = true
[The aPE Inline Patch ExtraStealth; SuperStealth)]
signature = E8 02 ?? ?? ?? EB 01 C3 3E 8B 44 24 FC 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89
ep_only = true
[The Guard Library]
signature = 50 E8 ?? ?? ?? ?? 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20
9D C3
ep_only = true
[The Norton Antivirus Information file]
signature = 54 68 65 20 4E 6F 72 74 6F 6E 20 41 6E 74 69 56 69 72 75 73 20 49 6E 66 6F 72 6D
61 74 69 6F 6E 20 46 69 6C 65
ep_only = false
[The WiZ Cryptor v1:00a by SP0T //UCL]
signature = E9 J1 J1 FA 60 56 1E 8E D8 BE ?? ?? BF ?? ?? B8 ?? ?? 87 ?? ?? ?? AB 8C C8 87 ??
?? ?? AB 1F 68 ?? ?? 9C 58 80 ?? ?? 50 9D FC
ep_only = true
[TheHyper's protector -> TheHyper (h)]
signature = 55 8B EC 83 EC 14 8B FC E8
01 01 ?? ?? 02 01 5E E8 0D 00 00 00 6B
D8 E8 0D 00 00 00 56 69 72 74 75 61 6C
56 69 72 74 75 61 6C 46 72 65 65 00 53
63 65 73 73 48 65 61 70 00 53 8B 06 FF
00 53 8B 06 FF 10 89 47 0C E8 09 00 00
57 FF 76 08 FF 76 0C FF 56 10 8B E5 5D
ep_only = true

14
65
41
8B
10
00

00
72
6C
06
89
48

00
6E
6C
FF
47
65

00
65
6F
10
08
61

??
6C
63
89
E8
70

??
33
00
47
0A
46

01
32
53
04
00
72

01
2E
8B
E8
00
65

??
64
06
0F
00
65

??
6C
FF
00
48
00

01
6C
10
00
65
53

01
00
89
00
61
8B

??
8B
07
47
70
06

??
46
E8
65
41
FF

??
04
0C
74
6C
10

00
FF
00
50
6C
89

??
10
00
72
6F
47

??
8B
00
6F
63
10

[TheHyper's protector -> TheHyper (h)]

signature = 55 8B EC 83 EC 14 8B FC E8 14 00 00 00 ?? ?? 01 01 ?? ?? 01 01 ?? ?? ?? 00 ?? ??
01 01 ?? ?? 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B
D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8
ep_only = false
[TheHyper's protector -> TheHyper (h)]
signature = 55 8B EC 83 EC 14 8B FC E8
01 01 ?? ?? ?? 01 5E E8 0D 00 00 00 6B
D8 E8 0D 00 00 00 56 69 72 74 75 61 6C
56 69 72 74 75 61 6C 46 72 65 65 00 53
63 65 73 73 48 65 61 70 00 53 8B 06 FF
00 53 8B 06 FF 10 89 47 0C E8 09 00 00
57 FF 76 08 FF 76 0C FF 56 10 8B E5 5D
ep_only = true

14
65
41
8B
10
00

00
72
6C
06
89
48

00
6E
6C
FF
47
65

00
65
6F
10
08
61

??
6C
63
89
E8
70

??
33
00
47
0A
46

01
32
53
04
00
72

01
2E
8B
E8
00
65

??
64
06
0F
00
65

??
6C
FF
00
48
00

01
6C
10
00
65
53

01
00
89
00
61
8B

??
8B
07
47
70
06

??
46
E8
65
41
FF

??
04
0C
74
6C
10

00
FF
00
50
6C
89

??
10
00
72
6F
47

??
8B
00
6F
63
10

[Themida -> Oreans Technologies 2004]

signature = B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61
EB 35 E8
ep_only = true
[themida 1:0:0:5 -> http?//www:oreans:com]
signature = B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61
EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50
3C 03 D0 BB E9 44
ep_only = true

-228-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Themida 1:0:x:x - 1:8:0:0

signature = B8 ?? ?? ?? ??
EB 35 E8 00 00 00 00 58 25
3C 03 D0 BB E9 44 00 00 83
ep_only = true

(compressed
60 0B C0 74
00 F0 FF FF
C3 67 39 1A

engine) -> Oreans

58 E8 00 00 00 00
33 FF 66 BB 19 5A
74 07 2D 00 10 00

Technologies]
58 05 43 00 00 00 80 38 E9 75 03 61
66 83 C3 34 66 39 18 75 12 0F B7 50
00 EB DA 8B F8 B8

[Themida 1:0:x:x - 1:8:0:0

signature = B8 ?? ?? ?? ??
EB 35 E8 00 00 00 00 58 25
3C 03 D0 BB E9 44 00 00 83
B9 5A ?? ?? ?? 03 CF EB 0A
58 2D 26 00 00 00 B9 EF 01
ep_only = true

(compressed
60 0B C0 74
00 F0 FF FF
C3 67 39 1A
B8 ?? ?? ??
00 00 C6 00

engine) -> Oreans

58 E8 00 00 00 00
33 FF 66 BB 19 5A
74 07 2D 00 10 00
?? B9 5A ?? ?? ??
E9 83 E9 05 89 48

Technologies]
58 05 43 00 00
66 83 C3 34 66
00 EB DA 8B F8
50 51 E8 84 00
01 61 E9 AF 01

[Themida 1:0:x:x - 1:8:x:x

signature = 55 8B EC 83 C4
00 8B 45 D8 40 89 45 D8 81
E1 89 45 DC 61 8B 45 DC C9
?? ?? ?? 8D 45 80 8B 5D 08
8D 7C FF FF FF 81 BD 7C FF
?? ?? 8D 75 80 8A 0E BB F4
8B 8D 7C FF FF FF 41 89 8D
F0 8B 75 08 C7 45 FC 00 00
7D 0C EB 7F C7 45 F8 00 00
ep_only = false

(no compression) -> Oreans

D8 60 E8 00 00 00 00 5A 81
7D D8 80 00 00 00 74 0F 8B
C2 04 00 55 8B EC 81 C4 7C
C7 85 7C FF FF FF 00 00 00
FF FF 80 00 00 00 75 E3 C7
01 00 00 B8 AB 37 54 78 D3
7C FF FF FF 81 F9 80 00 00
00 00 EB 04 FF 45 FC 46 80
00 00 EB

Technologies (h)]
EA ?? ?? ?? ?? 8B
45 08 89 83 ?? ??
FF FF FF 60 E8 00
00 8B 8D 7C FF FF
85 7C FF FF FF 00
D0 8A 0F D3 D0 4B
00 75 D1 61 C9 C2
3E 00 75 F7 BA 00

[Themida 1:0:x:x - 1:8:x:x

signature = 55 8B EC 83 C4
00 8B 45 D8 40 89 45 D8 81
E1 89 45 DC 61 8B 45 DC C9
ep_only = true

(no compression) -> Oreans

D8 60 E8 00 00 00 00 5A 81
7D D8 80 00 00 00 74 0F 8B
C2 04 00 55 8B EC 81 C4 7C

Technologies (h)]
EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00
45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB
FF FF FF 60 E8 00 00 00 00

00
39
B8
00

80
18
??
00

38
75
??
E8

E9
12
??
00

75
0F
??
00

03
B7
03
00

61
50
C7
00

DA
??
00
FF
00
75
04
00

C7
??
00
D1
00
F7
00
00

45
FF
00
C3
00
0F
55
00

D8
45
5A
88
8D
AF
8B
8B

00
08
81
18
BA
C3
EC
75

00
43
EA
41
??
47
83
08

00
EB
??
89
??
46
C4
8B

[Themida 1:2:0:1 (compressed)

signature = B8 00 00 ?? ?? 60
EB 35 E8 00 00 00 00 58 25 00
3C 03 D0 BB E9 44 00 00 83 C3
B9 ?? ?? ?? 00 03 CF EB 0A B8
58 2D 26 00 00 00 B9 EF 01 00
00 00 00 00 00 00 00 00 00 00
ep_only = true

->
0B
F0
67
??
00
00

Oreans Technologies (h)]

C0 74 58 E8 00 00 00 00 58
FF FF 33 FF 66 BB 19 5A 66
39 1A 74 07 2D 00 10 00 00
?? ?? ?? B9 5A ?? ?? ?? 50
C6 00 E9 83 E9 05 89 48 01
00 00

[Themida 1:2:0:1 (compressed)

signature = B8 00 00 ?? ?? 60
EB 35 E8 00 00 00 00 58 25 00
3C 03 D0 BB E9 44 00 00 83 C3
ep_only = true

->
0B
F0
67

Oreans Technologies (h)]

C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61
FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50
39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8

05
83
EB
51
61

43
C3
DA
E8
E9

00
34
8B
84
AF

00
66
F8
00
01

00
39
B8
00
00

80
18
??
00
00

38
75
??
E8
02

E9
12
??
00
00

75
0F
00
00
00

03
B7
03
00
00

61
50
C7
00
91

[Themida 1:2:0:1 -> Oreans

signature = 8B C5 8B D4 60
35 09 89 85 ?? ?? 35 09 83
24 24 89 85 ?? ?? 35 09 6A
ep_only = false

Technologies (h)]
E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ??
BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44
45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25

[Themida 1:2:0:1 -> Oreans

signature = 8B C5 8B D4 60
35 09 89 85 ?? ?? 35 09 83
24 24 89 85 ?? ?? 35 09 6A
D5 00 00 00 E9 11 02 00 00
ep_only = false

Technologies (h)]
E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ??
BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44
45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8
00 00 00

[Themida 1:8:x:x -> Oreans Technologies]

signature = B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61
-229-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

EB 45 DB 2D 37
66 BB 19 5A 66
2D 00 10 00 00
?? ?? ?? ?? 50
E9 05 89 48 01
ep_only = true

??
83
EB
51
61

??
C3
DA
E8
E9

??
34
8B
84

FF
66
F8
00

[Themida 1:8:x:x -> Oreans

signature = B8 ?? ?? ?? ??
EB 45 DB 2D 37 ?? ?? ?? FF
66 BB 19 5A 66 83 C3 34 66
ep_only = true

04 August 2015 15:14

FF
39
B8
00

FF
18
??
00

FF
75
??
E8

FF
12
??
00

FF
0F
??
00

FF
B7
03
00

FF
50
C7
00

3D
3C
B9
58

40
03
??
2D

E8
D0
??
26

00
BB
??
00

00
E9
??
00

00
44
03
00

00
00
CF
B9

58
00
EB
EF

25
83
0A
01

00
C3
B8
00

F0
67
??
00

FF
39
??
C6

FF
1A
??
00

33
74
??
E9

FF
07
B9
83

Technologies]
60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61
FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF
39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67

[Themida/WinLicense V1:0:0:0-V1:8:0:0 -> Oreans Technologies > Sign by fly]

signature = B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61
EB ?? E8 00 00 00 00
ep_only = true
[Themida/WinLicense V1:0:X-V1:7:X DLL -> Oreans
signature = B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00
EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66
3C 03 D0 BB ?? ?? ?? ?? 83 C3 ?? 39 1A 74 07 2D
B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ??
58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 00 E9 83 E9
ep_only = true

Technologies *
00 00 00 58 05
BB ?? ?? 66 83
00 10 00 00 EB
?? ?? ?? 50 51
?? 89 48 01 61

Sign:By:fly]
?? ?? ?? ?? 80
?? ?? 66 39 18
DA 8B F8 B8 ??
E8 84 00 00 00
E9

38
75
??
E8

E9
12
??
00

75
0F
??
00

03
B7
03
00

61
50
C7
00

[Themida/WinLicense V1:8:2:0 + -> Oreans Technologies > Sign by fly]

signature = B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61
EB ?? DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00
ep_only = true
[Themida/WinLicense V1:8:X-V1:9:X Other -> Oreans Technologies
signature = B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05
EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ??
66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ??
2D ?? ?? ?? ?? EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ??
?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58
ep_only = true

* Sign:By:fly * 20080131]
53 00 00 00 80 38 E9 75 13
00 00 58 25 00 F0 FF FF 33
?? ?? ?? 83 C3 ?? 39 1A 74
03 CF EB 0A B8 ?? ?? ?? ??

[Themida/WinLicense V1:8:X-V1:9:X&nbsp= -> Oreans Technologies&nbsp=

signature = B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00
EB 45 DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D ?? ?? ?? ?? 00 00
66 BB ?? ?? 66 83 ?? ?? 66 39 18 75 12 0F B7 50 3C 03 D0 BB ?? ?? ??
2D ?? ?? ?? ?? EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF
?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58 2D ?? ?? ?? ?? B9
E9 05 89 48 01 61 E9
ep_only = true
[Themida/WinLicense V1:X -> Oreans Technologies
signature = 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ??
00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64
41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00
49 6E 69 74 43 6F 6D 6D 6F 6E 43 6F 6E 74 72 6F
ep_only = false
[Themida/WinLicense V1:X NoCompression
signature = 8B C5 8B D4 60 E8 00 00 00
?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ??
24 24 89 85 ?? ?? ?? ?? 6A 45 E8 A3 00
D5 00 00 00 E9 ?? ?? ?? ?? 00 00 00 00
ep_only = false

* Sign:By:fly]
00 00 00 00 ??
?? 00 00 00 00
6C 6C 00 00 00
43 4F 4D 43 54
6C 73 00 00 00

??
00
43
4C
00

??
00
72
33
00

&nbsp=* Sign:By:fly]
00 00 80 38 E9 75 13
58 25 00 F0 FF FF 33
?? 83 C3 ?? 39 1A 74
EB 0A B8 ?? ?? ?? ??
?? ?? ?? ?? C6 00 E9

??
00
65
32
00

??
00
61
2E

SecureEngine -> Oreans Technologies

00 5D 81 ED ?? ?? ?? ?? 89 95 ?? ??
?? ?? 74 0C 8B E8 8B E2 B8 01 00 00
00 00 68 9A 74 83 07 E8 DF 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00

-230-

??
00
74
64

??
00
65
6C

??
00
46
6C

00
00
69
00

00
00
6C
00

61
FF
07
B9

61
FF
07
B9
83

00
00
65
00

* Sign:By:fly]
?? ?? 89 B5 ?? ??
00 C2 0C 00 8B 44
68 25 4B 89 0A E8
00 00 00 00

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[theWRAP - by TronDoc]
signature = 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B
4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0
A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF
ep_only = true
[Thinstall 2:403 -> Jitit]
signature = 6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88
29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B
44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41
ep_only = false
[Thinstall 2:4x - 2:5x -> Jitit Software]
signature = 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ??
?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? BD ?? ?? ?? ?? 03 E8
ep_only = true
[Thinstall 2:5
signature = 55
1A 00 00 BA 20
?? 81 75 04 ??
ep_only = true

->
8B
1B
??

??? (h)]
EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A7 1A 00 00 B9 6C
00 00 BE 00 10 00 00 BF B0 53 00 00 BD EC 1A 00 00 03 E8 81 75 00 ?? ?? ??
?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10

[Thinstall 2:628 -> Jtit (h)]

signature = E8 00 00 00 00 58
00 00 E8 C3 FE FF FF E9 99 FF
56 8B 75 08 8B 7D 0C C7 45 FC
8B 4D F8 E8 27 01 00 00 02 45
5B B9 04 00 00 00 E8 05 01 00
00 00 E8 DF 00 00 00 88 07 47
00 00 83 C0 07 89 45 F8 C6 45
07 00 00 00 E8 AA 00 00 00 50
5E 83 F9 02 74 6A 41 E8 88 00
7D 00 00 00 EB 3A 49 8B C1 55
00 00 00 3D 00 00 01 00 73 14
41 41 56 8B F7 2B F0 F3
ep_only = true

BB
FF
08
F7
00
4D
F7
33
00
8B
3D

34
FF
00
AA
48
75
00
C9
00
4D
FF

1D
CC
00
EB
74
F5
83
B1
89
FC
37

00
CC
00
E9
DE
E8
F8
02
45
8B
00

00
CC
33
E8
0F
C7
08
E8
FC
E8
00

2B
CC
DB
04
89
00
74
A0
E9
33
73

C3
CC
BA
01
C6
00
89
00
48
C0
0E

50
CC
00
00
00
00
E8
00
FF
D3
3D

68
CC
00
00
00
72
B1
00
FF
E5
7F

00
CC
00
0F
00
E9
00
8B
FF
E8
02

00
CC
80
82
E8
5D
00
C8
E8
5D
00

40
CC
43
96
DF
EB
00
41
87
00
00

00
55
33
00
00
A2
88
41
00
00
73

68
8B
C0
00
00
B9
45
58
00
00
08

00
EC
E8
00
00
01
F7
0B
00
0B
83

40
83
19
E8
73
00
E9
C0
49
C5
F8

00
C4
01
F9
1B
00
7C
74
E2
5D
7F

00
F4
00
00
55
00
FF
04
09
8B
77

68
FC
00
00
BD
E8
FF
8B
8B
D8
04

BC
53
73
00
00
D0
FF
D8
C3
E8
41

00
57
0E
73
01
00
B9
EB
E8
5F
41

[Thinstall Embedded V1:9X -> Jitit > Sign by fly]

signature = 55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 ?? ?? ?? ?? 50 E8 87 FC FF FF 59 59 A1 ??
?? ?? ?? 8B 40 10 03 05 ?? ?? ?? ?? 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00
ep_only = true
[Thinstall Embedded V2:0X -> Jitit > Sign
signature = B8 EF BE AD DE 50 6A 00 FF 15
29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49
44 24 04 C7 41 0C 01 00 00 00 89 81 29 04
00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF
72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2
45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39
FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00
ep_only = true

by
??
01
00
39
F7
4D

fly]
?? ??
D1 E9
00 0F
45 0C
F7 8B
0C 73

??
89
B6
8B
5E
F4

E9
48
40
F1
10
48

AD
10
01
76
33
8B

FF
C7
D1
0C
D2
14

FF
40
E8
8B
8B
82

FF
14
89
4D
F8
2B

8B
80
41
08
8B
CA

C1
00
10
03
C3
0F

8B
00
C7
3C
F7
AF

4C
00
41
81
F7
CF

24
C2
14
40
89
2B

04
04
80
3B
7E
D9

89
00
00
45
18
0F

88
8B
00
0C
89
AF

[Thinstall Embedded V2:0X -> Jitit]

signature = B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88
29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B
44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41
ep_only = true
[Thinstall Embedded V2:2X-V2:308 -> Jitit > Sign by fly]
signature = B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88
-231-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

29 04 00 00 C7
44 24 04 C7 41
00 C2 04 00 55
72 F4 8B CE E8
45 0C 33 C0 33
FA 89 7E 14 89
ep_only = true

40
0C
8B
43
C9
5E

0C
01
EC
00
8B
10

01
00
53
00
55
5F

00
00
56
00
08
5E

04 August 2015 15:14

00
00
57
8B
03
5B

00
89
33
46
0C
5D

0F
81
C0
14
82
C2

B6
29
33
33
40
08

49
04
FF
D2
39
00

01
00
39
F7
4D

D1
00
45
F7
0C

E9
0F
0C
8B
73

[Thinstall Embedded V2:2X-V2:308

signature = B8 EF BE AD DE 50 6A
29 04 00 00 C7 40 0C 01 00 00 00
44 24 04 C7 41 0C 01 00 00 00 89
ep_only = true

->
00
0F
81

Jitit]
FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88
B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B
29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41

> Sign by fly]

E8 D4 F8 FF FF
B6 49 01 D1 E9
29 04 00 00 0F
33 FF 39 45 0C
33 D2 F7 F7 8B
40 39 4D 0C 73
08 00

89
B6
8B
5E
F4

48
40
F1
10
48

10
01
76
33
8B

C7
D1
0C
D2
14

40
E8
8B
8B
82

14
89
4D
F8
2B

80
41
08
8B
CA

00
10
03
C3
0F

00
C7
3C
F7
AF

00
41
81
F7
CF

C2
14
40
89
2B

04
80
3B
7E
D9

00
00
45
18
0F

8B
00
0C
89
AF

[Thinstall Embedded V2:312

signature = 6A 00 FF 15 ??
29 04 00 00 C7 40 0C 01 00
44 24 04 C7 41 0C 01 00 00
00 C2 04 00 55 8B EC 53 56
72 F4 8B CE E8 43 00 00 00
45 0C 33 C0 33 C9 8B 55 08
FA 89 7E 14 89 5E 10 5F 5E
ep_only = true

->
??
00
00
57
8B
03
5B

Jitit
?? ??
00 0F
89 81
33 C0
46 14
0C 82
5D C2

[Thinstall Embedded V2:312

signature = 6A 00 FF 15 ??
29 04 00 00 C7 40 0C 01 00
44 24 04 C7 41 0C 01 00 00
ep_only = true

->
??
00
00

Jitit]
?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88
00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B
89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41

[Thinstall Embedded V2:422-V2:428 -> Jitit >

signature = 55 8B EC B8 ?? ?? ?? ?? BB ?? ??
1A 00 00 BA 14 1B 00 00 BE 00 10 00 00 BF B0
?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ??
ep_only = true
[Thinstall Embedded V2:501
signature = 55 8B EC B8 ??
1A 00 00 BA 21 1B 00 00 BE
?? 81 75 04 ?? ?? ?? ?? 81
ep_only = true

->
??
00
75

Jitit
?? ??
10 00
08 ??

E9
89
B6
8B
5E
F4

E9
48
40
F1
10
48

AD
10
01
76
33
8B

FF
C7
D1
0C
D2
14

FF
40
E8
8B
8B
82

FF
14
89
4D
F8
2B

8B
80
41
08
8B
CA

C1
00
10
03
C3
0F

8B
00
C7
3C
F7
AF

4C
00
41
81
F7
CF

24
C2
14
40
89
2B

04
04
80
3B
7E
D9

89
00
00
45
18
0F

88
8B
00
0C
89
AF

Sign by fly]
?? ?? 50 E8 00 00 00 00 58 2D 9B 1A 00 00 B9 84
53 00 00 BD E0 1A 00 00 03 E8 81 75 00 ?? ?? ??
81 75 0C ?? ?? ?? ?? 81 75 10

> Sign by fly]

BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A8 1A 00 00 B9 6D
00 BF C0 53 00 00 BD F0 1A 00 00 03 E8 81 75 00 ?? ?? ??
?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10

[Thinstall Embedded V2:545 -> Jitit > Sign by fly]

signature = E8 F2 FF FF FF 50 68 ?? ?? ?? ?? 68 40 1B 00 00 E8 42 FF FF FF E9 9D FF FF FF 00
00 00 00 00 00
ep_only = true
[Thinstall Embedded V2:547-V2:600 -> Jitit > Sign by fly]
signature = E8 00 00 00 00 58 BB BC 18 00 00 2B C3 50 68 ?? ?? ?? ?? 68 60 1B 00 00 68 60 00
00 00 E8 35 FF FF FF E9 99 FF FF FF 00 00
ep_only = true
[Thinstall Embedded V2:609 -> Jitit > Sign by fly]
signature = E8 00 00 00 00 58 BB AD 19 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 1C 00 00 68 80 00
00 00 E8 35 FF FF FF E9 99 FF FF FF 00
ep_only = true
[Thinstall Embedded V2:620-V2:623 -> Jitit > Sign by fly]
signature = E8 00 00 00 00 58 BB AC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 21 00 00 68 C4 00
00 00 E8 C3 FE FF FF E9 99 FF FF FF 00 00
ep_only = true

-232-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Thinstall Embedded V2:717-V2:719 -> Jitit >

signature = 9C 60 E8 00 00 00 00 58 BB ?? ??
?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC
0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80
00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82
E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8
00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D
45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00
00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8
41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8
49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D
01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00
F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7
ep_only = true

Sign by fly]
?? ?? 2B C3 50
CC 55 8B EC 83
43 33 C0 E8 19
96 00 00 00 E8
DF 00 00 00 73
EB A2 B9 01 00
00 88 45 F7 E9
41 41 58 0B C0
87 00 00 00 49
00 00 00 0B C5
00 73 08 83 F8
2B 45 0C 5E 5F

68
C4
01
F9
1B
00
7C
74
E2
5D
7F
5B

??
F4
00
00
55
00
FF
04
09
8B
77
C9

??
FC
00
00
BD
E8
FF
8B
8B
D8
04
C2

??
53
73
00
00
D0
FF
D8
C3
E8
41
08

??
57
0E
73
01
00
B9
EB
E8
5F
41
00

68
56
8B
5B
00
00
07
5E
7D
00
41

??
8B
4D
B9
00
00
00
83
00
00
41

??
75
F8
04
E8
83
00
F9
00
00
56

??
08
E8
00
DF
C0
00
02
00
3D
8B

??
8B
27
00
00
07
E8
74
EB
00
F7

68
7D
01
00
00
89
AA
6A
3A
00
2B

[Thinstall Embedded V2:717-V2:719 -> Jitit]

signature = 9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68
?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D
0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D
ep_only = true
[Thinstall V2:403
signature = 6A 00
29 04 00 00 C7 40
44 24 04 C7 41 0C
00 C2 04 00 55 8B
72 F4 8B CE E8 43
45 0C 33 C0 33 C9
FA 89 7E 14 89 5E
00 00 8B 41 0C 8B
30 C1 61 14 08 D1
ep_only = true

->
FF
0C
01
EC
00
8B
10
59
E8

Jitit]
15 20 50
01 00 00
00 00 00
53 56 57
00 00 8B
55 08 03
5F 5E 5B
10 03 DB
09 41 10

40
00
89
33
46
0C
5D
8A
39

00
0F
81
C0
14
82
C2
14

E8
B6
29
33
33
40
08
30

D4
49
04
FF
D2
39
00
83

F8
01
00
39
F7
4D
57
E2

FF
D1
00
45
F7
0C
BF
01

FF
E9
0F
0C
8B
73
00
0B

E9
89
B6
8B
5E
F4
00
D3

E9
48
40
F1
10
48
80
C1

AD
10
01
76
33
8B
00
E2

FF
C7
D1
0C
D2
14
39
07

FF
40
E8
8B
8B
82
79
40

FF
14
89
4D
F8
2B
14
89

8B
80
41
08
8B
CA
77
51

C1
00
10
03
C3
0F
36
10

8B
00
C7
3C
F7
AF
53
89

4C
00
41
81
F7
CF
56
41

24
C2
14
40
89
2B
8B
0C

04
04
80
3B
7E
D9
B1
0F

89
00
00
45
18
0F
29
B6

88
8B
00
0C
89
AF
04
04

[Thinstall v2:460 -> Jitit]

signature = 55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 F4 18 40 00 50 E8 87 FC FF FF 59 59 A1 94
1A 40 00 8B 40 10 03 05 90 1A 40 00 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 76 0C 00
00 D4 0C 00 00 1E
ep_only = true
[Thinstall V2:736
signature = 9C 60
CC 00 00 00 E8 C1
FC 53 57 56 8B 75
00 73 0E 8B 4D F8
00 00 73 5B B9 04
BD 00 01 00 00 E8
E8 D0 00 00 00 83
FF FF B9 07 00 00
8B D8 EB 5E 83 F9
8B C3 E8 7D 00 00
D8 E8 5F 00 00 00
04 41 41 41 41 56
C2 08 00
ep_only = true

->
E8
FE
08
E8
00
DF
C0
00
02
00
3D
8B

Jitit
00 00
FF FF
8B 7D
27 01
00 00
00 00
07 89
E8 AA
74 6A
EB 3A
00 00
F7 2B

> Sign by fly]

00 00 58 BB F3
E9 97 FF FF FF
0C C7 45 FC 08
00 00 02 45 F7
E8 05 01 00 00
00 88 07 47 4D
45 F8 C6 45 F7
00 00 00 50 33
41 E8 88 00 00
49 8B C1 55 8B
01 00 73 14 3D
F0 F3 A4 5E E9

[Thinstall V2:736
signature = 9C 60
CC 00 00 00 E8 C1
FC 53 57 56 8B 75
ep_only = true

->
E8
FE
08

Jitit]
00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68
FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4
8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0

1C
CC
00
AA
48
75
00
C9
00
4D
FF
F0

00
CC
00
EB
74
F5
83
B1
89
FC
37
FE

00
CC
00
E9
DE
E8
F8
02
45
8B
00
FF

[Thinstall V2:7X -> Jitit]

-233-

2B
CC
33
E8
0F
C7
08
E8
FC
E8
00
FF

C3
CC
DB
04
89
00
74
A0
E9
33
73
33

50
CC
BA
01
C6
00
89
00
48
C0
0E
C0

68
CC
00
00
00
00
E8
00
FF
D3
3D
EB

00
CC
00
00
00
72
B1
00
FF
E5
7F
05

00
CC
00
0F
00
E9
00
8B
FF
E8
02
8B

40
CC
80
82
E8
5D
00
C8
E8
5D
00
C7

00
CC
43
96
DF
EB
00
41
87
00
00
2B

68
55
33
00
00
A2
88
41
00
00
73
45

00
8B
C0
00
00
B9
45
58
00
00
08
0C

26
EC
E8
00
00
01
F7
0B
00
0B
83
5E

00
83
19
E8
73
00
E9
C0
49
C5
F8
5F

00
C4
01
F9
1B
00
7C
74
E2
5D
7F
5B

68
F4
00
00
55
00
FF
04
09
8B
77
C9

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68
?? ?? ?? ?? E8 ?? ?? ?? ?? E9
ep_only = true
[Thinstall Virtualization Suite 3:035-3:043 -> Thinstall
signature = 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00
?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF
55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC
ep_only = true

Company]
00 00 58 BB 37 1F 00 00 2B C3 50 68
E9 90 FF FF FF CC CC CC CC CC CC CC
08 00 00 00 33 DB BA 00

[Thinstall Virtualization Suite 3:0xx -> Jitit Software]

signature = 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68
00 00 00 01 68 00 ?? 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC
55 8B EC 83 C4 F4
ep_only = true
[Thinstall Virtualization Suite V3:035-V3:043 -> Thinstall Company >
signature = 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB
?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF
55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00
33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9
00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE
00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8
ep_only = true

Sign by fly]
37 1F 00 00 2B
FF CC CC CC CC
33 DB BA 00 00
E8 04 01 00 00
0F 89 C6 00 00
C7 00 00 00 72

C3
CC
00
0F
00
E9

50
CC
80
82
E8
5D

68
CC
43
96
DF
EB

[Thinstall Virtualization Suite V3:049-V3:080 -> Thinstall Company >

signature = 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB
?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF
55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00
33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9
00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE
00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8
ep_only = true

Sign by fly]
37 1F 00 00 2B
FF CC CC CC CC
33 DB BA 00 00
E8 04 01 00 00
0F 89 C6 00 00
C7 00 00 00 72

C3
CC
00
0F
00
E9

50
CC
80
82
E8
5D

68
CC
43
96
DF
EB

[Thinstall Virtualization Suite V3:049-V3:080 -> Thinstall Company]

signature = 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68
?? ?? ?? ?? 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC
55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00
ep_only = true
[Thinstall Virtualization Suite V3:0X -> Thinstall
signature = 9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8
?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE
55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7
33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00
00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05
00 00 00 73 1B 55 BD ?? ?? ?? ?? E8 DF 00 00 00 88
ep_only = true

Company > Sign

00 00 00 00 58
FF FF E9 ?? ??
45 FC 08 00 00
02 45 F7 AA EB
01 00 00 48 74
07 47 4D 75 F5

[Thinstall Virtualization Suite V3:0X -> Thinstall

signature = 9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8
?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE
55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7
ep_only = true

Company]
00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68
FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC
45 FC 08 00 00 00 33 DB BA

[Thinstall Virtualization Suite V3:10X

signature = 9C 60 68 53 74 41 6C 68 54
?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45
00 00 73 0E 8B 4D F8 E8 27 01 00 00 02
ep_only = true

->
68
??
FC
45

Thinstall Company
49 6E E8 00 00 00
E8 2C FF FF FF E9
08 00 00 00 33 DB
F7 AA EB E9

-234-

by
BB
??
00
E9
DE
E8

fly]
?? ??
?? CC
33 DB
E8 04
0F 89
C7 00

??
CC
BA
01
??
00

??
CC
??
00
??
00

2B
CC
??
00
??
72

C3
CC
??
0F
??
E9

50
CC
??
82
E8
5D

68
CC
43
96
DF
EB

* Sign:By:fly]
00 58 BB ?? ?? ?? ?? 2B C3 50 68
90 FF FF FF CC CC 55 8B EC 83 C4
BA 00 00 00 80 43 33 C0 E8 19 01

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Thinstall Virtualization Suite V3:10X

signature = 9C 60 68 53 74 41 6C 68 54
?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45
ep_only = true

->
68
??
FC

Thinstall Company]
49 6E E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68
E8 2C FF FF FF E9 90 FF FF FF CC CC 55 8B EC 83 C4
08 00 00 00 33 DB BA 00 00 00 80 43 33

[Thinstall vx:x]
signature = B8 EF BE AD DE 50 6A ?? FF 15 10 19 40 ?? E9 AD FF FF FF
ep_only = true
[Thunderbolt V0:02 -> deXep (forgot) *
signature = E9 00 00 00 00 60 E8 14 00
00 00 00 E8 58 61 E8 AA 00 00 00 ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
07 53 E8 5D 00 00 00 EB FF 71 E8 C2 50
5E 83 C6 4C 75 F4 59 8D 71 E8 75 09 81
24 00 00 81 36 50 56 8B 36 EB FF 77 C4
EC FC E9 E7 00 00 00 5B EB FF F3 EB FF
ep_only = true

Sign:By:fly]
00 00 5D 81 ED
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
00 EB D6 5E F3
F6 EB FF 51 B9
36 81 F6 EB 87
C3

00
??
??
??
??
??
??
68
01
34

00
??
??
??
??
??
??
89
00
24

00
??
??
??
??
??
??
74
83
8B

00
??
??
??
??
??
??
24
EE
8B

6A
??
??
??
??
??
??
48
FC
1C

45
??
??
??
??
??
??
74
49
24

E8
??
??
??
??
??
??
24
FF
83

A3
??
??
??
??
??
??
58
71
EC

00
??
??
??
??
??
5D
FF
C7
FC

00
??
??
??
??
??
68
8D
75
EB

00
??
??
??
??
??
00
74
19
01

68
??
??
??
??
??
FE
24
8B
E8

00
??
??
??
??
??
9F
58
74
83

[Tiny Xor v0:1]

signature = E9 J1 J1 FC B8 ?? ?? BB ?? ?? B9 ?? ?? BE ?? ?? 30 04 02 C3 86 C4 86 DF 46 E2 ??
BE ?? ?? C7 ?? ?? ?? C6 ?? ?? ?? 33 C0 33 DB 33 C9 FF E6
ep_only = true
[TMT-Pascal v0:40]
signature = 0E 1F 06 8C 06 ?? ?? 26 A1 ?? ?? A3 ?? ?? 8E C0 66 33 FF 66 33 C9
ep_only = true
[TopSpeed v3:01 1989]
signature = 1E BA ?? ?? 8E DA 8B ?? ?? ?? 8B ?? ?? ?? FF ?? ?? ?? 50 53
ep_only = true
[TPAV Cryptor V1:1 -> msaha_dev * Sign:By:fly]
signature = 8D 85 08 FF FF FF 50 8D 85 C4 FE FF FF 50 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 8D
95 C0 FE FF FF 33 C0 E8 ?? ?? FF FF 8B 85 C0 FE FF FF E8 ?? ?? FF FF 50 6A 00 FF 15 2C ?? ??
70
ep_only = false
[TPPpack-> clane]
signature = E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 ?? E8
ep_only = false
[Trainer Creation
signature = 6A 00
00 50 6A 00 68 40
00 6A 00 E8 2E 02
ep_only = false

Kit 5
68 80
45 40
00 00

Trainer]
00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00
00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00
A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40

[Trainer Creation
signature = 6A 00
00 50 6A 00 68 40
00 6A 00 E8 2E 02
40 00 50 E8 15 02
68 D4 10 40 00 6A
00 E8 27 02 00 00
74 EC B3 0A FE CB
8B EC 56 51 57 8B

Kit v5 Trainer]
68 80 00 00 00 6A
45 40 00 68 00 10
00 00 A3 70 45 40
00 00 6A 00 FF 35
00 6A 01 FF 35 70
83 F8 00 74 EC B3
74 16 68 25 45 40
45 0C 98 3D 10 01

02
00
00
30
45
0A
00
00

6A
00
68
45
40
FE
E8
00

00
68
25
40
00
CB
96
0F

6A
00
45
00
E8
74
01
85

00
30
40
50
02
10
00
C7

-235-

68
40
00
6A
02
FF
00
00

00
00
E8
02
00
35
83
00

00
50
2B
E8
00
30
F8
00

00
E8
02
4D
B3
45
00
6A

40
54
00
02
0A
40
74
01

68
02
00
00
FE
00
ED
FF

25
00
A3
00
CB
E8
6A
35

45
00
30
A3
74
B7
00
70

40
58
45
74
10
01
E8
45

00
50
40
45
FF
00
90
40

E8
E8
00
40
35
00
01
00

3C
17
68
00
74
83
00
E8

02
02
34
6A
45
F8
00
B0

00
00
45
00
40
00
55
01

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

00 00 50 6A 01 68 80 00 00 00 FF
ep_only = false
[Trap v1:21]
signature = E8 J1 J1 5B 83 ?? ?? ?? 8B D3 E8 ?? ?? ?? 5B 2E ?? ?? ?? 74 ?? ?? ?? 8B DA B9 ??
?? EB
ep_only = true
[Trilobyte's JPEG graphics Library]
signature = 84 10 FF FF FF FF 1E 00 01 10 08 00 00 00 00 00
ep_only = false
[Trivial173 by SMT/SMF]
signature = EB ?? ?? 28 54 72 69 76 69 61 6C 31 37 33 20 62 79 20 53 4D 54 2F 53 4D 46 29
ep_only = true
[TrueType Font file]
signature = 00 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 4C 54 53 48
ep_only = false
[TrueType Font file]
signature = 00 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 4F 53 2F 32
ep_only = false
[TSCRUNCH v3:01]
signature = EB J3 06 1E 55 57 56 52 51 53 50 16 1F 0E 07 8B F4
ep_only = true
[TTPpack]
signature = E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 F6 E8 11 00 00 00 8B 64 24 08 64 8F 05
ep_only = true
[Turbo Basic v1:0 1987]
signature = 2E 8C ?? ?? ?? 2E C7
ep_only = true
[Turbo C 1987 or Borland C++ 1991]
signature = FB BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21
ep_only = true
[Turbo C 1987]
signature = FB 8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA
ep_only = true
[Turbo C 1988]
signature = 8C D8 BB ?? ?? 8E DB 8C D3 8B CC FA 8E ?? ?? ?? BC
ep_only = true
[Turbo C 1990 or Turbo C 1988]
signature = BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 8B ?? ?? ?? 8B ?? ?? ?? 8E DA
ep_only = true
[Turbo C or Borland C++]
signature = BA ?? ?? 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA
ep_only = true
[Turbo C++ 3:0 1990]
signature = 8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C 06
ep_only = true
[Turbo C]
signature = BC ?? ?? E8 ?? ?? 2E 8E ?? ?? ?? E8 ?? ?? 2E 80 ?? ?? ?? ?? 75 ?? E8 ?? ?? 8B C3
-236-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

2E F7 ?? ?? ?? E8
ep_only = true
[Turbo or Borland Pascal v7:0]
signature = 9A ?? ?? ?? ?? C8 ?? ?? ?? 9A ?? ?? ?? ?? 09 C0 75 ?? EB ?? 8D ?? ?? ?? 16 57 6A
?? 9A ?? ?? ?? ?? BF ?? ?? 1E 57 68
ep_only = true
[Turbo Pascal Configuration File]
signature = 54 75 72 62 6F 20 50 61 73 63 61 6C 20 43 6F 6E 66 69 67 75 72 61 74 69 6F 6E
ep_only = false
[Turbo Pascal Desktop File]
signature = 54 75 72 62 6F 20 50 61 73 63 61 6C 20 44 65 73 6B 74 6F 70
ep_only = false
[Turbo Pascal Help File]
signature = 54 55 52 ?? ?? ?? 50 41 53 ?? ?? ?? ?? 48 45 4C 50
ep_only = false
[Turbo Pascal v2:0 1984]
signature = ?? ?? ?? 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 34
ep_only = true
[Turbo Pascal v3:0 1985]
signature = ?? ?? ?? 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 35
ep_only = true
[Turbo Pascal Version 3:0 1985]
signature = E9 J1 J1 E8 ?? ?? 06 00 ?? ?? ?? 4B 8E 04 85 00 00 04 ?? ?? ?? ?? ?? ?? 80 ?? ??
EC E8 ?? ?? 45 1B ?? ?? ?? A6
ep_only = true
[Turbo Profiler Areas file]
signature = 54 75 72 62 6F ?? 50 72 6F 66 69 6C 65 72 ?? 61 72 65 61 73 ?? 66 69 6C 65
ep_only = false
[TurboBAT v3:10 :: 5:0 (Patched)]
signature = 90 90 90 90 90 90 90 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ??
?? 24 ?? 3A C4 90 90
ep_only = true
[TurboBAT v3:10 :: 5:0]
signature = BA ?? ?? B4 09 ?? ?? 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ??
?? 24 0F 3A C4 ?? ?? 26 ?? ?? ?? 24 0F 3A C4
ep_only = true
[TXT2COM (Read-A-Matic v1:0)]
signature = B8 ?? ?? 8E D8 8C 06 ?? ?? FA 8E D0 BC ?? ?? FB B4 ?? CD 21 A3 ?? ?? 06 50 B4 34
CD 21
ep_only = true
[TXT2COM v2:06]
signature = 8D 26 ?? ?? E8 ?? ?? B8 ?? ?? CD 21 CD 20 54 58 54 32 43 4F 4D 20
ep_only = true
[TXT2COM]
signature = E8 ?? ?? CD 20
ep_only = true
[TXTMaker v1:22]
signature = EB J3 B4 ?? 33 DB CD 10 80 ?? ?? 74 ?? B0 ?? EB ?? 8B
-237-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[UCEXE v2:3; v2:4]
signature = 50 1E 0E 1F FC 33 F6 E8 ?? ?? 16 07 33 F6 33 FF B9 ?? ?? F3 A5 06 B8 ?? ?? 50 CB
ep_only = true
[UCOMCRY]
signature = E9 J1 J1 60 06 FA E4 64 0C 40 E6 64 B8 ?? ?? 8E C0 26
ep_only = true
[UG2002 Cruncher v0:3b3]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? E8 0D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? 58
ep_only = true
[UltraPro V1:0 -> SafeNet * Sign:By:fly]
signature = A1 ?? ?? ?? ?? 85 C0 0F 85 3B 06 00 00 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15
?? ?? ?? ??
ep_only = true
[UltraPro V1:0 -> SafeNet]
signature = A1 ?? ?? ?? ?? 85 C0 0F 85 3B 06 00 00 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15
ep_only = true
[UnderGround Crypter - by Booster2000]
signature = 55 8B EC 83 C4 F0 B8 74 3C 00 11 E8 94 F9 FF FF E8 BF FE FF FF E8 0A F3 FF FF 8B
C0
ep_only = true
[UNITA3 (tm) by Sanitary Equipment Research]
signature = E8 ?? ?? 4D 5A 3E
ep_only = true
[Unknown by SMT]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 83 ?? ?? 57 EB
ep_only = true
[Unknown encryptor (1)]
signature = EB ?? 2E 90 ?? ?? 8C DB 8C CA 8E DA FA 8B EC BE ?? ?? BC ?? ?? BF
ep_only = true
[Unknown encryptor (2) - "PK7Tjrvx"]
signature = 06 B4 52 CD 21 07 E8 ?? ?? B4 62 CD 21 E8
ep_only = true
[Unknown encryptor (3)]
signature = ?? ?? ?? E9 J1 J1 1E 06 8C D8 05 ?? ?? 8E D8 8E C0 2E ?? ?? ?? ?? 2E ?? ?? ?? ??
8B E8 2E
ep_only = true
[Unknown Joiner (sign from pinch 26:03:2007 02<12)]
signature = 44 90 4C 90 B9 DE 00 00 00 BA 00 10 40 00 83 C2 03 44 90 4C B9 07 00 00 00 44 90
4C 33 C9 C7 05 08 30 40 00 00 00 00 00 90 68 00 01 00 00 68 21 30 40 00 6A 00 E8 C5 02 00 00
90 6A 00 68 80
ep_only = true
[Unknown packer (01)]
signature = EB ?? ?? BE ?? ?? BF ?? ?? 2E
ep_only = true
[Unknown packer (02)]
signature = FA 8C DE 8C CF 8E DF 8E C7 83 C7 ?? BB
-238-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[Unknown packer (03)]
signature = 06 1E 57 56 50 53 51 52 BD ?? ?? 0E 1F 8C
ep_only = true
[Unknown packer (04)]
signature = BC ?? ?? C3 2E FF 2E ?? ?? CF
ep_only = true
[Unknown packer (05)]
signature = FA BB ?? ?? B9 ?? ?? 87 E5 87 27 03 E3 91 8A CB 80 E1 ?? D3 C4 91 33 E3 87 27
ep_only = true
[Unknown packer (06)]
signature = FA B8 ?? ?? BE ?? ?? 33 F0 0E 17 2E ?? ?? ?? BA ?? ?? 87 E6 5B 33 DC
ep_only = true
[Unknown packer (07)]
signature = 8C C8 05 ?? ?? 50 B8 ?? ?? 50 B0 ?? 06 8C D2 06 83
ep_only = true
[Unknown packer (08)]
signature = 8B C4 2D ?? ?? 24 00 8B F8 57 B9 ?? ?? BE ?? ?? F3 A5 FD C3 97 4F 4F
ep_only = true
[Unknown Packer -> Northfox]
signature = 54 59 68 61 7A 79
ep_only = true
[Unknown Protected Mode compiler (1)]
signature = FA BC ?? ?? 8C C8 8E D8 E8 ?? ?? E8 ?? ?? E8 ?? ?? 66 B8 ?? ?? ?? ?? 66 C1
ep_only = true
[Unknown Protected Mode compiler (2)]
signature = FA FC 0E 1F E8 ?? ?? 8C C0 66 0F B7 C0 66 C1 E0 ?? 66 67 A3
ep_only = true
[Unknown UPX modifyer]
signature = E8 02 00 00 00 CD 03 5A 81 C2 ?? ?? ?? ?? 81 C2 ?? ?? ?? ?? 89 D1 81 C1 3C 05 00
00 52 81 2A 33 53 45 12 83 C2 04 39 CA 7E F3 89 CA 8B 42 04 8D 18 29 02 BB 78 56 00 00 83 EA
04 3B 14 24 7D EC C3
ep_only = true
[Unnamed Scrambler 1:0 -> p0ke]
signature = 55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40
00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF
FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF
ep_only = true
[Unnamed Scrambler 1:1C
signature = 55 8B EC 83
FF FF BE 5C 67 00 10 33
BA E0 4A 00 10 B8 CC 67
ep_only = true

->
C4
C0
00

p0ke]
E4 53 56 33 C0 89 45 E4 89 45 E8 89 45 EC B8 C0 47 00 10 E8 4F F3
55 68 D2 4A 00 10 64 FF 30 64 89 20 E8 EB DE FF FF E8 C6 F8 FF FF
10 E8 5F F8 FF FF 8B D8 8B D6 8B C3 8B 0D CC 67 00 10

[Unnamed Scrambler 1:2B

signature = 55 8B EC 83
70 3A 40 00 E8 C4 EC FF
FF FF B8 20 65 40 00 33
ep_only = true

->
C4
FF
C9

p0ke]
D8 53 56 57 33 C0 89 45 D8 89 45 DC 89 45 E0 89 45 E4 89 45 E8 B8
33 C0 55 68 5C 3F 40 00 64 FF 30 64 89 20 E8 C5 D7 FF FF E8 5C F5
BA 04 01 00 00 E8 D3 DB FF FF 68 04 01 00 00 68 20 65

-239-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Unnamed Scrambler 1:2C

signature = 55 8B EC B9
FF FF 33 C0 55 68 ?? ??
33 C9 BA 04 01 00 00 E8
ep_only = true

/ 1:2D -> p0ke]

05 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? 3A ?? ?? E8 ?? EC
?? ?? 64 FF 30 64 89 20 E8 ?? D7 FF FF E8 ?? ?? FF FF B8 20 ?? ?? ??
?? DB FF FF 68 04 01 00 00 68 20 ?? ?? ?? 6A 00 FF 15 10

[Unnamed Scrambler 1:3B

signature = 55 8B EC B9
FF 33 C0 55 68 AC 5D 00
EC FF FF E8 C6 CE FF FF
FF B8 08 BC 00 10 33 C9
00 E8 E2 EB FF FF 68 04
68 FC 5D 00 10 6A 00 E8
F7 05 00 00 BA 74 77 00
ep_only = true

->
08
10
6A
BA
01
BD
10

p0ke]
00 00
64 FF
00 68
04 01
00 00
EB FF
8B 0D

[Unnamed Scrambler 1:3B

signature = 55 8B EC B9
FF 33 C0 55 68 AC 5D 00
EC FF FF E8 C6 CE FF FF
ep_only = true

->
08
10
6A

p0ke]
00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF
64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23
00 68 BC 5D 00 10 68 ?? ?? ?? ?? 6A 00 E8 0B EC FF FF

00
30
BC
00
68
FF
70

6A
64
5D
00
08
BA
77

00
89
00
E8
BC
10
00

6A
20
10
C1
00
5E
10

00
6A
68
D2
10
00
E8

49
00
??
FF
6A
10
FE

75
68
??
FF
00
B8
CD

F9
BC
??
6A
FF
70
FF

53
5D
??
00
15
77
FF

56
00
6A
68
68
00
6A

57
10
00
BC
77
10
00

B8
68
E8
5D
00
E8

98
C4
0B
00
10
CA

56
5D
EC
10
6A
F3

00
00
FF
68
00
FF

10
10
FF
E4
68
FF

E8
6A
E8
5D
BC
85

48
00
F2
00
5D
C0

EB
E8
F4
10
00
0F

FF
23
FF
6A
10
84

[Unnamed Scrambler 2:0 -> p0ke]

signature = 55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF
FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B
D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74
ep_only = true
[Unnamed Scrambler 2:1(Beta) / 2:1:1 -> p0ke]
signature = 55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF
FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B
D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8
ep_only = true
[Unnamed Scrambler 2:5:1(Beta
signature = 55 8B EC B9 ?? 00
FF 33 C0 55 68 ?? ?? 40 00 64
D8 85 DB 75 07 6A 00 E8 ?? ??
05 ?? ?? 40 00 0A 00 00 00 BB
00 00 00 E8 ?? EB FF FF 83 3B
0F 84 F7 04 00 00 B8 ?? ?? 40
03 8B 0E E8 ?? ?? FF FF 8B C7
40 00 BA ?? ?? 40 00 E8 8B ED
ep_only = true

2)
00
FF
FF
??
00
00
A3
FF

/ 2:5:2 -> p0ke]

00 6A 00 6A 00 49
30 64 89 20 BA ??
FF BA ?? ?? 40 00
?? 40 00 BE ?? ??
74 04 33 C0 89 03
8B 16 E8 ?? E1 FF
?? ?? 40 00 8D 55
FF 3C 01 75 2B A1

[Unnamed Scrambler 2:5:1(Beta

signature = 55 8B EC B9 ?? 00
FF 33 C0 55 68 ?? ?? 40 00 64
D8 85 DB 75 07 6A 00 E8 ?? ??
ep_only = true

2)
00
FF
FF

/ 2:5:2 -> p0ke]

00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF
30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B
FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8

[Unnamed Scrambler 2:5A

signature = 55 8B EC B9
FF FF 33 C0 55 68 60 44
8B D8 85 DB 75 07 6A 00
ep_only = true

->
0B
40
E8

75
??
8B
40
8B
FF
EC

F9
40
C3
00
D7
B8
33

53
00
8B
BF
8B
??
C0

56
B8
0D
??
C6
??
E8

57
??
??
??
E8
40
??

B8
??
??
40
0A
00
D3

??
40
40
00
F3
E8
FF

??
00
00
B8
FF
??
FF

40
E8
E8
??
FF
E0
8B

00
63
??
??
89
FF
45

E8
F3
??
40
03
FF
EC

??
FF
FF
00
83
8B
B9

EA
FF
FF
BA
3B
D0
??

FF
8B
C7
04
00
8B
??

p0ke]
00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA
00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF
A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8

[Unpacked BS-SFX Archive v1:9]

signature = 1E 33 C0 50 B8 ?? ?? 8E D8 FA 8E D0 BC ?? ?? FB B8 ?? ?? CD 21 3C 03 73
ep_only = true
[UPack 0:11]
-240-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5
1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03
50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7
ep_only = false
[Upack 0:12 beta -> Dwing]
signature = BE 48 01 40 00 AD ?? ?? ?? A5 ?? C0 33 C9 ?? ?? ?? ?? ?? ?? ?? F3 AB ?? ?? 0A ??
?? ?? ?? AD 50 97 51 ?? 87 F5 58 8D 54 86 5C ?? D5 72 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? B6 5F FF C1
ep_only = true
[Upack 0:1x -> Dwing]
signature = BE 48 01 40 00 AD 8B F8
ep_only = true
[Upack 0:1x beta -> Dwing]
signature = BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5
?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03
50 0F B6 5F FF C1
ep_only = true
[Upack 0:20 beta -> Dwing]
signature = BE 88 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5
?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6
5F FF C1 E3 ?? B3
ep_only = true
[Upack 0:21 beta -> Dwing]
signature = BE 88 01 40 00 AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A B5 ??
F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F
FF C1 E3 ?? B3 00
ep_only = true
[Upack 0:22 - 0:23 -> Dwing]
signature = 6A 07 BE 88 01 40 00 AD
ep_only = true
[Upack 0:22 - 0:23 beta -> Dwing]
signature = 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85
5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D
9C 9D 0C 10 00 00
ep_only = true
[Upack 0:22 - 0:23 beta -> Dwing]
signature = ?? ?? ?? ?? ?? ?? ?? AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85
5C FF 16 72 ?? 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D
9C 9D 0C 10 00 00
ep_only = true
[Upack 0:24 beta -> Dwing]
signature = BE 88 01 40 00 AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C
FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C
9D 0C 10 00 00 B0
ep_only = true
[Upack 0:28 - 0:399 (relocated image base
signature = 60 E8 09 00 00 00 ?? ?? ?? 00
2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56
?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C
ep_only = false

- Delphi; :NET; DLL or something

E9 06 02 00 00 33 C9 5E 87 0E E3
91 01 1E AD E2 FB AD 8D 6E 10 01
FF 16 72 57 2C 03 73 02 B0 00 3C

[Upack 0:2x -> Dwing]

-241-

else -> Dwing (h)]

F4 2B F1 8B DE AD
5D 00 8D 7D 1C B5
07 72

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = BE 88 01 40 00 AD 8B F8
ep_only = true
[Upack 0:36 beta -> Dwing]
signature = BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E
44 4C 4C
ep_only = false
[Upack 0:37 beta -> Dwing]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61
72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00
00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00
ep_only = false
[Upack 0:38 beta -> Dwing]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61
72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00
00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00
ep_only = false
[Upack 0:399 -> Dwing]
signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61
72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00
00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00
ep_only = false
[Upack v0:10 - v0:12Beta -> Sign by hot_UNP]
signature = BE 48 01 ?? ?? ?? ?? ?? 95 A5 33 C0
ep_only = true
[Upack V0:10-V0:11 -> Dwing >
signature = BE ?? ?? ?? ?? AD
?? F3 AB AD 50 97 51 AD 87 F5
50 0F B6 5F FF C1 E3 ?? B3 ??
2A 33 D2 84 E9 0F 95 C6 52 FE
ep_only = true

Sign by fly]
8B F8 95 A5 33
58 8D 54 86 5C
8D 1C 5B 8D ??
C6 8A D0 8D 14

C0
FF
??
93

33
D5
??
FF

C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5
72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ??
?? ?? ?? B0 ?? 67 E3 29 8B D7 2B 56 0C 8A
D5

[Upack V0:10-V0:11 -> Dwing]

signature = BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5
?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ??
50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7
ep_only = true
[UPack v0:11]
signature = BE 48
1C F3 AB AD 50 97
50 0F B6 5F FF C1
2A 33 D2 84 E9 0F
B4 00 33 C9 B5 01
72 1B 83 C2 30 FF
60 FF D5 87 5E 10
8D 96 7C 07 00 00
8D 96 C4 0B 00 00
ep_only = false

01
51
E3
95
FF
D5
73
FF
FF

40
AD
03
C6
55
72
0D
55
55

00
87
B3
52
CC
2B
83
D0
D0

AD
F5
00
FE
33
3C
C2
5B
50

8B
58
8D
C6
C9
07
30
91
48

F8
8D
1C
8A
E9
B0
FF
EB

95
54
5B
D0
DF
09
D5
77

A5
86
8D
8D
00
72
87
3C

33
5C
9C
14
00
02
5E
07

C0
FF
9E
93
00
B0
14
B0

33
D5
0C
FF
8B
0B
73
07

[Upack V0:1X-V0:2X -> Dwing]

signature = BE 88 01 ?? ?? AD 8B F8 95
ep_only = true
[Upack v0:21Beta -> Sign by hot_UNP]
signature = BE 88 01 ?? ?? AD 8B F8 ?? ?? ?? ?? 33
ep_only = true
-242-

C9
72
10
D5
5E
50
03
72

AB
5A
00
5A
0C
8B
87
02

48
2C
00
9F
83
C7
5E
B0

AB
03
B0
12
C2
2B
18
0A

F7
73
01
C0
30
46
3C
50

D8
02
67
D0
FF
0C
07
87

B1
B0
E3
E9
D5
B1
B0
5E

04
00
29
74
73
80
08
10

F3
3C
8B
0E
50
8A
72
87

AB
07
D7
9E
83
00
02
5E

C1
72
2B
1A
C2
EB
B0
14

E0
02
56
F2
30
CF
0B
89

0A
2C
0C
74
FF
83
50
5E

B5
03
8A
E4
D5
C2
53
18

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Upack v0:22 v0:23Beta -> Sign by hot_UNP]

signature = 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5
ep_only = true
[Upack v0:24 v0:28alpha -> Sign by hot_UNP]
signature = BE 88 01 40 00 AD ?? ?? 95 AD 91 F3 A5 AD
ep_only = true
[Upack v0:29 beta -> Dwing]
signature = E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 29
ep_only = true
[Upack v0:29 Beta v0:31 Beta -> Sign by hot_UNP]
signature = BE 88 01 ?? ?? AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3
ep_only = false
[Upack v0:2Beta]
signature = BE 88 01 ?? ?? AD 8B F8 95 A5 33 C0 33
ep_only = true
[Upack v0:30 beta -> Dwing]
signature = E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 30
ep_only = true
[Upack v0:31 beta -> Dwing]
signature = E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 31
ep_only = true
[Upack v0:32 Beta (Patch) -> Sign by hot_UNP]
signature = BE 88 01 ?? ?? AD 50 ?? AD 91 F3 A5
ep_only = false
[Upack v0:32 beta -> Dwing]
signature = E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32
ep_only = true
[Upack v0:32 Beta -> Sign by hot_UNP]
signature = BE 88 01 ?? ?? AD 50 ?? AD 91 ?? F3 A5
ep_only = false
[Upack v0:32 Beta -> Sign by hot_UNP]
signature = BE 88 01 ?? ?? AD 50 ?? ?? AD 91 F3 A5
ep_only = false
[Upack v0:33 v0:34 Beta -> Sign by hot_UNP]
signature = ?? ?? ?? ?? 59 F3 A5 83 C8 FF 8B DF AB 40 AB 40
ep_only = true
[Upack v0:35 alpha -> Sign by hot_UNP]
signature = 8B F2 8B CA 03 4C 19 1C 03 54 1A 20
ep_only = false
[Upack V0:36 -> Dwing *
signature = 0B 01 ?? ??
?? ?? ?? ?? ?? 00 10 00
?? ?? ?? ?? ?? ?? ?? ??
00 00 00 0A 00 00 00 00

Sign:By:fly]
?? ?? ?? ?? ??
00 00 02 00 00
?? ?? ?? ?? ??
00 00 00 00 00

??
??
??
00

??
??
??
00

??
??
??
??

??
??
??
??

-243-

??
??
??
??

??
??
??
??

??
??
??
14

18
??
??
00

10
??
??
00

00
??
??
00

00
??
??
??

10
??
??
??

00
00
??
??

00
00
??
??

00
00
??
??

??
00
??
??

??
??
??
??

??
??
00
??

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 47 65 74 50 72 6F
63 41 64 64 72 65 73 73 00 FF 76 08 FF 76 0C BE 1C 01
ep_only = true
[Upack V0:36 -> Dwing]
signature = 0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 18 10 00 00 10 00 00 00 ?? ?? ??
?? ?? ?? ?? ?? 00 10 00 00 00 02 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00
ep_only = true
[Upack V0:36 -> Dwing]
signature = BE ?? ?? ?? ?? FF 36 E9 C3 00 00 00
ep_only = true
[Upack v0:36 alpha -> Sign by hot_UNP]
signature = AB E2 E5 5D 59 8B 76 68 51 59 46 AD 85 C0
ep_only = false
[Upack V0:37 -> Dwing *
signature = 0B 01 ?? ??
?? ?? ?? ?? ?? 00 10 00
?? ?? ?? ?? ?? ?? ?? ??
00 00 00 0A 00 00 00 00
?? ?? ?? ?? ?? ?? ?? ??
?? 47 65 74 50 72 6F 63
ep_only = true
[Upack v0:37 beta
signature = BE B0
72 79 41 00 00 18
00 00 00 00 37 00
00 ?? 00 00 ?? ??
EE ?? ?? ?? 14 00
F3 A5 FF 76 04 83
00 00 ?? ?? ?? ??
?? ?? ?? E3 B1 04
13 D2 E2 FA 5D 03
FF FF 58 5F 59 E3
AB E2 E5 5E 5D 59
ep_only = true

->
11
10
04
00
00
C8
??
D3
EA
1B
51

Sign:By:fly]
?? ?? ?? ?? ??
00 00 02 00 00
?? ?? ?? ?? ??
00 00 00 00 00
?? ?? ?? ?? ??
41 64 64 72 65

Dwing]
?? ?? AD
00 00 10
00 00 00
00 00 10
00 00 ??
FF 8B DF
00 00 00
E0 03 E8
45 59 89
8A 07 47
59 46 AD

50
00
00
00
??
AB
40
8D
6B
04
85

FF
00
00
00
??
EB
AB
53
08
18
C0

76
00
00
10
??
1C
40
18
56
3C
74

??
??
??
00
??
73

??
??
??
00
??
73

??
??
??
??
??
00

??
??
??
??
??
00

??
??
??
??
??

??
??
??
??
??

??
??
??
14
??

18
??
??
00
??

10
??
??
00
??

00
??
??
00
??

00
??
??
??
??

10
??
??
??
??

00
00
??
??
??

00
00
??
??
??

00
00
??
??
??

??
00
??
??
??

??
??
??
??
??

??
??
00
??
??

34
00
00
00
??
00
B1
33
8B
02
1F

EB
??
00
00
??
00
04
C0
F7
73

7C
??
??
00
00
00
F3
55
2B
F7

48
??
??
00
FF
00
AB
40
F5
8B

01
00
??
00
76
47
C1
51
F3
07

??
00
00
00
38
65
E0
D3
A4
3C

??
??
02
0A
AD
74
0A
E0
AC
??

0B
??
00
00
50
50
B5
8B
5E
75

01
00
00
00
8B
72
??
EA
B1
F1

4C
10
00
00
3E
6F
F3
91
80
B0

6F
00
00
00
BE
63
AB
FF
AA
00

61
00
00
00
F0
41
8B
56
3B
0F

64
00
00
00
??
64
7E
4C
7E
C8

4C
02
??
00
??
64
0C
33
34
03

69
00
00
00
??
72
57
D2
0F
46

62
00
00
00
6A
65
51
59
82
38

72
04
??
00
27
73
E9
D1
8E
2B

61
00
00
00
59
73
??
E8
FE
C7

62
00
00
00
6A
65
51
59
82
38

72
04
??
00
27
73
E9
D1
97
2B

61
00
00
00
59
73
??
E8
FE
C7

[Upack v0:37 v0:38 Beta (Strip base relocation table Option) -> Sign by hot_UNP]
signature = 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33
ep_only = false
[Upack V0:37-V0:39 -> Dwing]
signature = BE ?? ?? ?? ?? AD 50 FF ?? ?? EB
ep_only = true
[Upack v0:38 beta
signature = BE B0
72 79 41 00 00 18
00 00 00 00 38 00
00 ?? 00 00 ?? ??
EE ?? ?? ?? 14 00
F3 A5 FF 76 04 83
00 00 ?? ?? ?? ??
?? ?? ?? E3 B1 04
13 D2 E2 FA 5D 03
FF FF 58 5F 59 E3
AB E2 E5 5E 5D 59
ep_only = true

->
11
10
04
00
00
C8
??
D3
EA
1B
51

Dwing]
?? ?? AD
00 00 10
00 00 00
00 00 10
00 00 ??
FF 8B DF
00 00 00
E0 03 E8
45 59 89
8A 07 47
59 46 AD

50
00
00
00
??
AB
40
8D
6B
04
85

FF
00
00
00
??
EB
AB
53
08
18
C0

76
00
00
10
??
1C
40
18
56
3C
74

34
00
00
00
??
00
B1
33
8B
02
1F

EB
??
00
00
??
00
04
C0
F7
73

7C
??
??
00
00
00
F3
55
2B
F7

48
??
??
00
FF
00
AB
40
F5
8B

-244-

01
00
??
00
76
47
C1
51
F3
07

??
00
00
00
38
65
E0
D3
A4
3C

??
??
02
0A
AD
74
0A
E0
AC
??

0B
??
00
00
50
50
B5
8B
5E
75

01
00
00
00
8B
72
??
EA
B1
F1

4C
10
00
00
3E
6F
F3
91
80
B0

6F
00
00
00
BE
63
AB
FF
AA
00

61
00
00
00
F0
41
8B
56
3B
0F

64
00
00
00
??
64
7E
4C
7E
C8

4C
02
??
00
??
64
0C
33
34
03

69
00
00
00
??
72
57
D2
0F
46

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Upack v0:39 final -> Dwing (h)]

signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61
72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00
00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00
ep_only = true
[Upack v0:39 final -> Sign by hot_UNP]
signature = 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91
ep_only = false
[Upack v0:39 final -> Sign by hot_UNP]
signature = FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF
ep_only = false
[Upack v0:399 -> Dwing]
signature = BE B0 11 ??
72 79 41 00 00 18 10 00
00 00 00 00 3A 00 04 00
00 10 00 00 ?? ?? 00 00
EE ?? ?? ?? 14 00 00 00
F3 A5 FF 76 04 83 C8 FF
00 00 ?? ?? ?? ?? ?? 00
?? ?? ?? 56 10 E2 E3 B1
D1 E8 13 D2 E2 FA 5D 03
ep_only = true

??
00
00
00
00
8B
00
04
EA

AD
10
00
10
??
DF
00
D3
45

50
00
00
00
??
AB
40
E0
59

FF
00
00
00
??
EB
AB
03
89

76
00
00
10
??
1C
40
E8
6B

34
00
00
00
??
00
B1
8D
08

EB
??
00
00
00
00
04
53
56

7C
??
??
00
00
00
F3
18
8B

48
??
??
00
FF
00
AB
33
F7

01
00
??
00
76
47
C1
C0
2B

??
00
00
00
38
65
E0
55
F5

??
??
02
0A
AD
74
0A
40
F3

0B
??
00
00
50
50
B5
51
A4

01
00
00
00
8B
72
??
D3
AC

4C
10
00
00
3E
6F
F3
E0
5E

6F
00
00
00
BE
63
AB
8B
B1

61
00
00
00
F0
41
8B
EA
80

64
00
00
00
??
64
7E
91
AA

4C
02
??
00
??
64
0C
FF
3B

69
00
00
00
??
72
57
56

62
00
00
00
6A
65
51
4C

72
04
??
00
27
73
E9
99

61
00
00
00
59
73
??
59

[Upack v0:399 -> Dwing]

signature = 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ??
00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ??
?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00
ep_only = true
[Upack v0:399 -> Dwing]
signature = 0B 01 4C 6F
00 00 00 40 00 00 10 00
?? 00 00 02 00 00 00 00
00 00 00 0A 00 00 00 00
FF 76 38 AD 50 8B 3E BE
00 47 65 74 50 72 6F 63
AB C1 E0 0A B5
ep_only = true

61
00
00
00
F0
41

64
00
00
00
??
64

4C
02
??
00
??
64

69
00
00
00
00
72

62
00
00
00
6A
65

72
04
00
00
27
73

61
00
00
00
59
73

72
00
00
EE
F3
00

79
00
10
??
A5
00

41
00
00
??
FF
??

00
00
00
00
76
??

00
3A
??
14
04
??

18
00
00
00
83
00

10
04
00
00
C8
??

00
00
00
00
FF
00

00
00
00
00
8B
00

[Upack V0:3X -> Dwing]

signature = 60 E8 09 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 5E 87 0E
ep_only = true
[Upack_Patch -> Sign by hot_UNP]
signature = 81 3A 00 00 00 02 00 00 00 00
ep_only = true
[Upack_Patch -> Sign by hot_UNP]
signature = 2A A3 F2 54 CE
ep_only = false
[Upack_Patch or any Version -> Sign by hot_UNP]
signature = 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02
ep_only = true
[Upack_Unknown (DLL ???) -> Sign by hot_UNP]
signature = 60 E8 09 00 00 00 17 CD 00 00 E9 06 02
ep_only = true
-245-

10
00
10
??
DF
00

00
00
00
??
AB
40

00
00
00
00
EB
AB

00
00
10
??
1C
40

00
00
00
??
00
B1

??
00
00
00
00
04

??
??
00
00
00
F3

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[UPolyX 0:x -> Delikon]

signature = 81 FD 00 FB FF FF 83 D1 ?? 8D 14 2F 83 FD FC 76 ?? 8A 02 42 88 07 47 49 75
ep_only = true
[UPolyX V0:1 -> Delikon]
signature = E2 ?? FF ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false
[UPolyX v0:5]
signature = 83 EC 04 89 ?? 24 59 ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? 00
ep_only = false
[UPolyX v0:5]
signature = 83 EC
?? ?? ?? ?? ?? ??
?? ?? ?? 00 ?? ??
?? ?? ?? ?? 00 00
?? ?? ?? ?? ?? ??
ep_only = false

04
??
??
??
00

89
??
??
??

??
??
??
??

24
??
??
??

59
??
??
??

??
??
??
??

??
??
??
??

00
??
??
??

00
??
??
??

00
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

52
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
00
??

??
??
??
??

?? ?? ?? ??
?? ?? ?? ??
?? ?? ?? ??
00

[UPolyX v0:5]
signature = 83 EC 04 89 ?? 24 59 ?? ?? 00 00 00
ep_only = false
[UPolyX v0:5]
signature = 83 EC
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ??
ep_only = false

04
??
??
??

89
??
??
??

14
??
??
??

24
??
??
??

59
??
??
??

BA
??
00
??

??
??
??
??

00
??
??
??

00
??
??
??

00
??
??
??

[UPolyX v0:5]
signature = 83 EC 04 89 14 24 59 BA ?? 00 00 00 52 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
ep_only = false
[UPolyX v0:5]
signature = ?? 00
?? ?? ?? ?? ?? ??
00 00 00 00 00 00
00 00 00 00 00 00
00 00 00 00 00 00
ep_only = false

BD
??
00
00
00

46
??
00
00
00

00
??
00
00

??
??
00
00

??
??
00
00

??
??
00
00

??
??
00
00

??
??
00
00

??
??
00
00

??
??
00
00

??
??
00
00

??
??
00
00

??
??
00
00

??
??
00
00

??
00
00
00

??
00
00
00

??
00
00
00

??
00
00
00

??
00
00
00

??
00
00
00

??
00
00
00

??
00
00
00

??
00
00
00

??
00
00
00

??
00
00
00

[UPolyX v0:5]
signature = ?? 00 BD 46 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false
[UPolyX v0:5]
signature = 55 8B EC ?? 00 BD 46 00 8B ?? B9 ?? 00 00 00 80 ?? ?? 51 ?? ?? ?? ?? 00 ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false
[UPolyX v0:5]
signature = BB 00 BD 46 00 83 EC 04 89 1C 24 ?? B9 ?? 00 00 00 80 33 ?? ?? ?? ?? ?? ?? 00 ??
-246-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false
[UPolyX v0:5]
signature = E8 00
?? ?? ?? ?? ?? ??
00 00 00 00 00 00
00 00 00 00 00 00
00 00 00 00 00 00
ep_only = false

00
??
00
00
00

00
??
00
00
00

00
??
00
00

59
??
00
00

83
??
00
00

C1
??
00
00

07
??
00
00

51
??
00
00

C3
??
00
00

C3
??
00
00

??
??
00
00

00
??
00
00

BD
??
00
00

46
??
00
00

00
??
00
00

??
??
00
00

B9
??
00
00

??
00
00
00

00
00
00
00

00
00
00
00

00
00
00
00

??
00
00
00

??
00
00
00

??
00
00
00

??
00
00
00

[UPolyX v0:5]
signature = EB 01 C3 ?? 00 BD 46 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false
[UPolyX v0:5]
signature = EB 01
?? ?? ?? ?? ?? ??
00 00 00 00 00 00
00 00 00 00 00 00
00 00 00 00 00 00
ep_only = false

C3
??
00
00
00

??
??
00
00
00

00
??
00
00

BD
??
00
00

46
??
00
00

00
??
00
00

??
??
00
00

??
??
00
00

??
??
00
00

??
??
00
00

??
??
00
00

??
??
00
00

??
??
00
00

??
??
00
00

??
??
00
00

??
??
00
00

??
??
00
00

??
??
00
00

??
??
00
00

??
??
00
00

??
??
00
00

??
00
00
00

??
00
00
00

??
00
00
00

??
00
00
00

[UPolyX v0:5]
signature = E8 00 00 00 00 59 83 C1 07 51 C3 C3 ?? 00 BD 46 00 ?? B9 ?? 00 00 00 ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false
[UPolyX v0:5]
signature = E8 00
00 81 ?? ?? ?? ??
00 00 00 00 00 00
00 00 00 00 00 00
00 00 00 00 00 00
ep_only = false

00
00
00
00
00

00
??
00
00
00

00
??
00
00

59
??
00
00

83
??
00
00

C1
??
00
00

07
??
00
00

51
??
00
00

C3
??
00
00

C3
??
00
00

??
??
00
00

00
??
00
00

BD
??
00
00

46
??
00
00

00
??
00
00

83
??
00
00

EC
??
00
00

04
??
00
00

89
??
00
00

??
??
00
00

24
??
00
00

B9
??
00
00

??
00
00
00

00
00
00
00

00
00
00
00

[UPolyX v0:5]
signature = E8 00 00 00 00 59 83 C1 07 51 C3 C3 ?? 00 BD 46 00 83 EC 04 89 ?? 24 B9 ?? 00 00
00 81 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ep_only = false
[UPolyX v0:5]
signature = ?? 59 ?? ?? 00 00 00
ep_only = false
[UPolyX v0:5]
signature = ?? ??
?? ?? ?? ?? ?? ??
?? ?? ?? 00 00 00
?? 00 00 00 ?? ??
?? ?? 00 00 00
ep_only = false

??
??
??
??

??
??
??
??

??
??
??
??

??
00
??
??

??
00
??
??

??
??
??
00

??
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
00
00

??
??
00
00

??
??
00
00

??
??
??
??

??
00
??
??

??
??
??
??

??
??
??
??

??
00
??
??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

??
??
??
??

[UPolyX v0:5]
signature = 55 8B EC ?? 00 BD 46 00 8B ?? B9 ?? 00 00 00 80 ?? ?? 51 ?? ?? ?? ?? 00 ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
-247-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
ep_only = false
[UPolyX v0:5]
signature = BB 00
?? ?? ?? ?? ?? ??
00 00 00 00 00 00
00 00 00 00 00 00
00 00 00 00 00 00
ep_only = false

BD
??
00
00
00

46
??
00
00
00

00
??
00
00

83
??
00
00

EC
??
00
00

04
??
00
00

89
00
00
00

1C
??
00
00

24
??
00
00

??
??
00
00

B9
??
00
00

??
??
00
00

00
??
00
00

00
??
00
00

00
??
00
00

80
??
00
00

33
??
00
00

??
??
00
00

??
??
00
00

??
00
00
00

??
00
00
00

??
00
00
00

??
00
00
00

00
00
00
00

??
00
00
00

[UPX + ECLiPSE layer]

signature = B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 33 D2 EB 01 0F 56 EB 01 0F E8 03 00 00 00 EB 01 0F
EB 01 0F 5E EB 01
ep_only = true
[UPX -> www:upx:sourceforge:net]
signature = 60 BE ?? ?0 4? 00 8D BE ?? ?? F? FF
ep_only = false
[UPX -> www:upx:sourceforge:net]
signature = 60 BE ?? ?? ?? 00 8D BE ?? ?? ?? FF
ep_only = false
[UPX 0:50 - 0:70]
signature = 60 E8 00 00 00 00 58 83 E8 3D
ep_only = true
[UPX 0:72]
signature = 60 E8 00 00 00 00 83 CD FF 31 DB 5E
ep_only = true
[UPX 2:00-3:0X ->
signature = 5E 89
66 C1 E8 08 C1 C0
8B 07 09 C0 74 3C
ep_only = false

Markus Oberhumer & Laszlo Molnar

F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8
10 86 C4 29 F8 80 EB E8 01 F0 89
8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01

[UPX 2:00-3:0X ->

signature = 5E 89
66 C1 E8 08 C1 C0
8B 07 09 C0 74 3C
47 08 C0 74 DC 89
?? ?? ?? ?? 8B AE
?? ?? ?? ?? 80 20
83 EC 80 E9
ep_only = false

Markus Oberhumer &amp= Laszlo

F7 B9 ?? ?? ?? ?? 8A 07 47 2C
10 86 C4 29 F8 80 EB E8 01 F0
8B 5F 04 8D ?? ?? ?? ?? ?? ??
F9 57 48 F2 AE 55 FF ?? ?? ??
?? ?? ?? ?? 8D BE 00 F0 FF FF
7F 80 60 28 7F 58 50 54 50 53

& John Reiser]

3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04
07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ??
F3 50 83 C7 08 FF

Molnar &amp= John

E8 3C 01 77 F7 80
89 07 83 C7 05 88
01 F3 50 83 C7 08
?? ?? 09 C0 74 07
BB 00 10 00 00 50
57 FF D5 58 61 8D

Reiser]
3F ?? 75
D8 E2 D9
FF ?? ??
89 03 83
54 6A 04
44 24 80

F2
8D
??
C3
53
6A

8B
??
??
04
57
00

07
??
??
EB
FF
39

8A
??
95
E1
D5
C4

5F
??
8A
FF
8D
75

04
??
07
??
87
FA

[UPX 2:90 (LZMA)]

signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF 89
E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ??
?? ?? 56 83 C3 04
ep_only = true
[UPX 2:90 (LZMA)]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0
50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03
?? ?? ?? ?? 90 90
ep_only = true
[UPX 2:90 (LZMA)]
-248-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46
88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11
DB 11 C0 01 DB
ep_only = true
[UPX 2:93 (LZMA)]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC
75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 03 00 02
00 90 90 90 90 90
ep_only = true
[UPX [com]
signature = B9 ?? ?? BE ?? ?? BF C0 FF FD
ep_only = true
[UPX Alternative stub]
signature = 01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 00 00 00 01 DB 07 8B 1E 83 EE FC 11 DB 11
C0 01 DB 73 0B
ep_only = true
[UPX Inliner 1:0 by GPcH]
signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B
06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5
8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01
ep_only = false
[UPX Inliner v1:0
signature = 9C 60
06 83 F8 00 74 11
8B 85 B1 FE FF FF
FD 60 6A 40 68 00
85 C5 FE FF FF E8
61 03 BD A9 FE FF
83 C3 04 83 3B 00
56 57 FF 95 C5 FE
C5 FE FF FF FF 95
ep_only = false

by
E8
8D
2B
10
00
FF
74
FF
09

GPcH]
00 00
B5 E1
D0 89
00 00
00 00
8B DF
2D 01
FF 5B
FF FF

00
FE
95
68
00
83
13
5A
FF

00
FF
B1
00
5B
3F
8B
59
8D

5D
FF
FE
10
B9
00
33
5F

B8
8B
FF
00
31
75
03
83

B3
06
FF
00
89
0A
7B
F9

85
83
01
6A
40
83
04
00

40
F8
95
00
00
C7
57
74

00
01
C9
FF
81
04
51
05

2D
0F
FE
95
E9
B9
52
83

AC
84
FF
05
2E
00
53
C3

85
F1
FF
FF
86
00
FF
08

40
01
8D
FF
40
00
B5
EB

00
00
B5
FF
00
00
09
CE

2B
00
E5
85
03
EB
FF
68

E8
C7
FE
C0
D9
16
FF
00

8D
06
FF
0F
50
B9
FF
80

B5
01
FF
84
53
01
FF
00

D5
00
01
06
E8
00
B5
00

FE
00
16
03
3D
00
05
6A

FF
00
8B
00
02
00
FF
00

FF
8B
36
00
00
03
FF
FF

8B
D5
8B
89
00
3B
FF
B5

FF
00
E8
00
D2
31
E8
09
C0
83

FC
73
42
73
75
C9
08
C0
74
C3

B2
23
00
0A
05
5E
C1
74
DC
04

80
B3
00
80
8A
89
C0
45
89
EB

31
02
00
FC
16
F7
10
8B
F9
D8

DB
41
EB
05
46
B9
86
5F
79
FF

A4
B0
28
73
10
??
C4
04
07
96

B3
10
AC
06
D2
??
29
8D
0F
??

02
E8
D1
83
C3
??
F8
84
B7
??

E8
4F
E8
F8
31
??
80
30
07
??

6D
00
74
7F
C9
8A
EB
??
47
??

00
00
4D
77
41
07
E8
??
50
61

[UPX Modified Stub b

signature = 60 BE ??
00 00 73 F6 31 C9 E8
00 10 C0 73 F7 75 3F
11 C9 EB 1C 91 48 C1
02 41 41 95 89 E8 B3
E8 EE FF FF FF 11 C9
47 2C E8 3C 01 77 F7
01 F0 89 07 83 C7 05
?? ?? 01 F3 50 83 C7
47 B9 57 48 F2 AE 55
E9
ep_only = true

->
??
64
AA
E0
01
E8
80
89
08
FF

Farb-rausch
?? ?? 8D BE
00 00 00 73
EB D4 E8 4D
08 AC E8 2C
56 89 FE 29
E7 FF FF FF
3F ?? 75 F2
D8 E2 D9 8D
FF 96 ?? ??
96 ?? ?? ??

Consumer
?? ?? ??
1C 31 C0
00 00 00
00 00 00
C6 F3 A4
72 F2 C3
8B 07 8A
BE ?? ??
?? ?? 95
?? 09 C0

Consulting]
?? 57 83 CD
E8 5B 00 00
29 D9 75 10
3D 00 7D 00
5E EB 8E 00
31 C0 31 DB
5F 04 66 C1
?? ?? 8B 07
8A 07 47 08
74 07 89 03

[UPX Modified Stub b

signature = 60 BE ??
00 00 73 F6 31 C9 E8
00 10 C0 73 F7 75 3F
ep_only = true

->
??
64
AA

Farb-rausch
?? ?? 8D BE
00 00 00 73
EB D4 E8 4D

Consumer
?? ?? ??
1C 31 C0
00 00 00

Consulting]
?? 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00
E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00
29 D9 75 10 E8 42 00 00 00 EB 28 AC

[UPX Modified Stub c

signature = 60 BE ??
66 A4 FF D3 73 FB 31
E2 E8 4A 00 00 00 49

->
??
C9
E2

Farb-rausch
?? ?? 8D BE
FF D3 73 14
10 E8 40 00

Consumer
?? ?? ??
31 C0 FF
00 00 EB

Consulting]
?? 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3
D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB
28 AC D1 E8 74 45 11 C9 EB 1C 91 48
-249-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[UPX Modified Stub c
signature = 60 BE ??
66 A4 FF D3 73 FB 31
E2 E8 4A 00 00 00 49
E8 2A 00 00 00 3D 00
C6 F3 A4 5E EB 9F 00
DB 31 C9 5E 89 F7 B9
C1 E8 08 C1 C0 10 86
07 09 C0 74 45 8B 5F
08 C0 74 DC 89 F9 79
03 83 C3 04 EB D8 FF
ep_only = true

->
??
C9
E2
7D
D2
??
C4
04
07
96

Farb-rausch
?? ?? 8D BE
FF D3 73 14
10 E8 40 00
00 00 73 0A
75 05 8A 16
?? ?? ?? 8A
29 F8 80 EB
8D 84 30 ??
0F B7 07 47
?? ?? ?? ??

Consumer
?? ?? ??
31 C0 FF
00 00 EB
80 FC 05
46 10 D2
07 47 2C
E8 01 F0
?? ?? ??
50 47 B9
61 E9

Consulting]
?? 57 83 CD
D3 73 1D 41
28 AC D1 E8
73 06 83 F8
C3 31 C9 41
E8 3C 01 77
89 07 83 C7
01 F3 50 83
57 48 F2 AE

FF
B0
74
7F
FF
F7
05
C7
55

FC
10
45
77
D3
80
89
08
FF

B2
FF
11
02
11
3F
D8
FF
96

80
D3
C9
41
C9
0E
E2
96
??

E8
10
EB
41
FF
75
D9
??
??

00
C0
1C
95
D3
F2
8D
??
??

00
73
91
89
72
8B
BE
??
??

00
FA
48
E8
F8
07
??
??
09

00
75
C1
56
C3
8A
??
95
C0

5B
3C
E0
89
31
5F
??
8A
74

83
AA
08
FE
C0
04
??
07
07

C3
EB
AC
29
31
66
8B
47
89

[UPX Modified stub]

signature = 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 84 ?? 00 00 09 C0 74 07 89 03 83
C3 04 EB D8 FF 96 88 ?? 00 00 61 E9 ?? ?? ?? FF
ep_only = true
[UPX Modifier v0:1x]
signature = 50 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD
ep_only = true
[UPX Protector v1:0x (2)]
signature = EB ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB
ep_only = false
[UPX Protector v1:0x]
signature = EB EC ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07
ep_only = true
[UPX v0:51]
signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 D8 01 ?? ?? 83 CD FF
31 DB ?? ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 0B 8A 06 46 88 07 47 EB EB 90
ep_only = true
[UPX v0:60 - v0:61]
signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 E8
ep_only = true
[UPX v0:62 [DLL]
signature = 80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 58
ep_only = true
[UPX v0:62]
signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ??
8D B0 F0 01 ?? ?? 83 CD FF 31 DB 90 90 90 EB 08 90 90 8A 06 46 88 07 47 01 DB 75 07
ep_only = true
[UPX v0:62]
signature = 60 E8 ?? ?? ?? ?? 58 83 ?? ?? 50 8D ?? ?? ?? ?? ?? 57 ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? 83 ?? ?? 31 DB ?? ?? ?? EB
ep_only = true
[UPX v0:70]
signature = 8C CB B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8D ?? ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3
A5 FC 2E ?? ?? ?? ?? 73
ep_only = true
[UPX v0:70]
signature = 60 E8 ?? ?? ?? ?? 58 83 ?? ?? 50 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ??
-250-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

8D ?? ?? ?? ?? ?? 83 ?? ?? 31 DB EB
ep_only = true
[UPX v0:70]
signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ??
8D B0 EC 01 ?? ?? 83 CD FF 31 DB EB 07 90 8A 06 46 88 07 47 01 DB 75 07
ep_only = true
[UPX v0:71 - v0:72]
signature = 60 E8 00 00 00 00 83 CD FF 31 DB 5E 8D BE FA ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ??
?? 81 C6 B3 01 ?? ?? EB 0A ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07
ep_only = true
[UPX v0:71 [DLL]
signature = 80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 83
ep_only = true
[UPX v0:72]
signature = 60 E8 ?? ?? ?? ?? 83 ?? ?? 31 DB 5E 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ??
?? 81 ?? ?? ?? ?? ?? EB
ep_only = true
[UPX v0:76:1 [dos exe]
signature = B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8C C8 05 ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5
FC
ep_only = true
[UPX v0:76:1 [pe exe]
signature = 60 BE ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 57 83 ?? ?? 31 DB EB
ep_only = true
[UPX v0:80 - v0:84]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8A 06 46
88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11
DB 11 C0 01 DB 77 EF 75 09 8B 1E 83 EE FC
ep_only = true
[UPX v0:81 - v0:84 Modified]
signature = 01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC
11 DB 11 C0 01 DB 77 EF
ep_only = true
[UPX v0:89:6 - v1:02 / v1:05 - v1:22 DLL]
signature = 80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF
ep_only = true
[UPX v0:89:6 - v1:02 / v1:05 - v1:22 Modified]
signature = 01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC
11 DB 11 C0 01 DB 73 ?? 75
ep_only = true
[UPX v0:89:6 - v1:02 / v1:05 - v1:22]
signature = 80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD
ep_only = true
[UPX v0:89:6 signature = ??
88 07 47 01 DB
DB 11 C0 01 DB
ep_only = true

v1:02
?? ??
75 07
73 ??

/ v1:05 - v1:22]
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8A 06 46
8B 1E 83 EE FC 11 DB 72 ED B8 01 ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11
75 ?? 8B 1E 83 EE FC

[UPX v0:89:6 - v1:02 / v1:05 -v1:22 (Delphi) stub]

-251-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF EB
0E ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B
ep_only = true
[UPX v1:03 - v1:04 Modified]
signature = 01 DB ?? 07 8B 1E 83 EE FC 11 DB 8A 07 ?? EB B8 01 00 00 00 01 DB ?? 07 8B 1E 83
EE FC 11 DB 11 C0 01 DB 73 EF
ep_only = true
[UPX v1:03 - v1:04]
signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8A 06 46
88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 8A 07 72 EB B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE
FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC
ep_only = true
[Upx v1:2 -> Marcus & Lazlo]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 05 A4 01 DB 75 07 8B 1E 83 EE
FC 11 DB 72 F2 31 C0 40 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 75 07 8B 1E 83 EE FC 11
DB 73 E6 31 C9 83
ep_only = true
[UPX V1:94 -> Markus Oberhumer &amp= Laszlo Molnar &amp= John Reiser]
signature = FF D5 80 A7 ?? ?? ?? ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4
75 FA 83 EC 80 E9
ep_only = false
[UPX v2:0 -> Markus;
signature = 55 FF 96
?? ?? ?? 8D BE 00 F0
80 60 28 7F 58 50 54
ep_only = false

Laszlo &
?? ?? ??
FF FF BB
50 53 57

Reiser (h)]
?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ??
00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F
FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9

[UPX v2:0 -> Markus;

signature = 55 FF 96
?? ?? ?? 8D BE 00 F0
80 60 28 7F 58 50 54
ep_only = false

Laszlo &
?? ?? ??
FF FF BB
50 53 57

Reiser (h)]
?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ??
00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F
FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80

[UPX V2:00-V2:90 -> Markus Oberhumer &amp= Laszlo Molnar &amp= John Reiser]
signature = FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44
24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9
ep_only = false
[UPX v3:0 (DLL_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser]
signature = 80 7C 24 08 01 0F 85 C7 0B 00 00 60 BE 00 ?? ?? ?? 8D BE 00 ?? ?? FF 57 89 E5 8D
9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? 00
ep_only = true
[UPX v3:0 (EXE_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser]
signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC
75 FB 46 46 53 68 ?? ?? ?? 00 57 83 C3 04 53 68 ?? ?? ?? 00 56
ep_only = true
[UPX$HiT 0:0:1 -> sibaway7yahoo:com]
signature = E2 FA 94 FF E0 61 00 00 00 00 00 00 00
ep_only = false
[UPX$HiT v0:0:1]
signature = 94 BC ?? ?? ?? 00 B9 ?? 00 00 00 80 34 0C ?? E2 FA 94 FF E0 61
ep_only = false
[Upx-Lock 1:0 - 1:2 -> CyberDoom / Team-X & BoB / BobSoft]
-252-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 60 E8 00 00 00 00 5D 81 ED 48 12 40 00 60 E8 2B 03 00 00 61
ep_only = true
[UPX-SCRAMBLER 3:06 -> OnToL]
signature = E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE ?? ?? ?? ?? 83 EC 04 89 34 24 B9 80 00 00
00 81 36 ?? ?? ?? ?? 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6
ep_only = true
[UPX-Scrambler by Guru:eXe]
signature = 66 C7 05 ?? ?? ?? ?? 75 07 E9 ?? FE FF FF 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00
00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00 00 00 ?? ?? 00 ?? ?? 00
00 00 ?? ?? 00
ep_only = false
[UPX-Scrambler RC v1:x]
signature = 90 61 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF
ep_only = true
[UPX-Shit 0:1 -> 500mhz]
signature = E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ??
?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77
77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79
ep_only = true
[UPX-Shit 0:1 -> 500mhz]
signature = E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ??
?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77
77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79
ep_only = true
[UPX-Shit v0:1
signature = E8
?? 00 ?? ?? ??
77 77 2E 62 6C
30 6D 68 7A 5D
ep_only = true

->
00
00
61

500mhz]
00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ??
?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77
63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 20 5B 35 30

[UPX-Shit v0:1
signature = E8
?? 00 ?? ?? ??
53 68 69 74 20
2D 20 63 6F 64
ep_only = true

->
00
00
76
65

500mhz]
00 00 00
?? ?? ??
30 2E 31
20 62 79

5E 83
<SPAN
20 2D
20 5B

C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ??
STYLE="FONT-WEIGHT< BOLD">01</SPAN> ?? ?? ?? 00 55 50 58 2D
20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20
35 30 30 6D 68 7A 5D

[UPX-Shit v0:1 -> 500mhz]

signature = E8 ?? ?? ?? ?? 5E 83 C6 ?? AD 89 C7 AD 89 C1 AD 30 07 47 E2 ?? AD FF E0 C3
ep_only = true
[UPX-Shit v0:1
signature = E8
?? 00 ?? ?? ??
77 77 2E 62 6C
30 6D 68 7A 5D
ep_only = true

->
00
00
61

500mhz]
00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ??
?? ?? ?? ?? ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77
63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 20 5B 35 30

[UPXcrypter -> archphase/NWC]

signature = BF ?? ?? ?? 00 81 FF ?? ?? ?? 00 74 10 81 2F ?? 00 00 00 83 C7 04 BB 05 ?? ?? 00
FF E3 BE ?? ?? ?? 00 FF E6 00 00 00 00
ep_only = true
[UPXFreak 0:1 (Borland Delphi) -> HMX0101]
signature = BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10
-253-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C
D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00
ep_only = false
[UPXFreak v0:1
signature = BE
00 00 00 00 ??
D1 42 00 ?? 56
?? ?? ?? 00 FF
00 ?? 00 00 00
42 00 ?? 56 ??
?? ?? ?? ?? ??
?? ?? 00 00 ??
00
ep_only = true

(Borland
?? ?? ??
?? ?? ??
?? 00 ??
FF 00 00
?? 1E ??
00 0B 4D
?? 77 ??
?? ?? 00

Delphi) -> HMX0101]

?? 83 C6 01 FF E6 00
00 00 ?? F6 ?? 00 B2
?? ?? 00 ?? ?? ?? 00
?? 24 ?? 00 ?? 24 ??
00 ?? F7 ?? 00 A6 4E
43 00 ?? F7 ?? 00 ??
?? ?? 00 ?? ?? ?? 00
?? ?? ?? ?? ?? ?? ??

00
4F
??
00
43
F7
??
??

00
45
??
??
00
??
??
??

??
00
??
??
??
00
??
??

??
??
00
??
56
??
77
??

??
F9
??
00
??
56
??
00

00
??
24
40
00
??
??
??

03
00
??
00
AD
00
00
??

00
EF
00
00
D1
??
00
??

00
4F
??
C0
42
??
??
??

00
45
??
00
00
??
??
00

??
00
??
00
??
??
??
00

??
??
00
??
F7
??
00
00

??
F6
34
??
??
00
??
00

??
??
50
??
00
00
??
??

00
00
45
??
A1
00
??
??

10
8C
00
00
D2
??
??
??

[UPXFreak V0:1 -> HMX0101]

signature = BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00
ep_only = true
[UPXLock v1:0 -> CyberDoom]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 60 E8 2B 03 00 00
ep_only = true
[UPXLock v1:1 -> CyberDoom & Bob]
signature = 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? 00 60
ep_only = true
[UPXShit 0:06]
signature = B8 ?? ?? 43 00 B9 15 00 00 00 80 34 08 ?? E2 FA E9 D6 FF FF FF
ep_only = true
[USCC v1:4]
signature = E9 J1 J1 60 BB ?? ?? B9 ?? ?? 30 0F 43 E2 ?? 5D F5 F5 FC EF EE FA 4B 9E
ep_only = true
[USERNAME v3:00]
signature = E9 J1 J1 E8 ?? ?? 5D 83 ?? ?? FA FC 33 F6 8E DE BF ?? ?? 03 FD B9 ?? ?? F3 A4 8B
FC
ep_only = true
[USERNAME v3:00]
signature = FB 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8C C8 2B C1 8B C8
2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 33 C0 8E D8 06 0E 07 FC 33 F6
ep_only = true
[USSR 0:31 - by Spirit]
signature = E8 00 00 00 00 5D 83 C5 12 55 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 8C C9 30 C9
E3 01 C3 BE 32 ?? ?? ?? B0 ?? 30 06 8A 06 46 81 FE 00 ?? ?? ?? 7C F3
ep_only = true
[USSR V0:31 -> SpiritST
signature = 00 00 00 00
00 ?? ?? ?? ?? 00 10 00
00 00 00 00 00 00 00 00
ep_only = false

> Sign by fly]

00 00 00 00 00 00 00 00 40 00 00 C0 2E 55 53 53 52 00 00 00 00 10 00
00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00

[USSR V0:31 -> SpiritST]

signature = 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 2E 55 53 53 52 00 00 00 00 10 00
00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00
ep_only = false

-254-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Utah RLE Graphics format]

signature = 52 CC 00 00 00 00 ?? ?? ?? ?? 09 ?? 08 ?? 08
ep_only = false
[v:02Packer -> tt:t]
signature = 60 E8 36 FE FF FF C3 90 ?? 00
ep_only = true
[VBOX v4:2 MTE]
signature = 8C E0 0B C5 8C E0 0B C4 03 C5 74 00 74 00 8B C5
ep_only = true
[VBOX v4:3 - v4:6]
signature = 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B
C5 8B C5 8B C5
ep_only = false
[VBOX v4:3 - v4:6]
signature = 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B
C4 8B C4 8B C4
ep_only = false
[VBOX v4:3 - v4:6]
signature = ?? ?? ?? ?? 90 03 C4 33 C4 33 C5 2B C5 33 C5 8B C5 ?? ?? 2B C5 48 ?? ?? 0B C0 86
E0 8C E0 ?? ?? 8C E0 86 E0 03 C4 40
ep_only = false
[VBOX v4:3 MTE]
signature = 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0
ep_only = true
[vcasm 1:0 - 1:1 -> vcasm]
signature = EB 01 9A 60
ep_only = true
[VcAsm Protector -> VcAsm]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3
ep_only = true
[VcAsm Protector V1:0X -> VcAsm]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 E8 03 00 00 00
ep_only = true
[Vcasm Protector V1:X -> vcasm]
signature = EB ?? 5B 56 50 72 6F 74 65 63 74 5D
ep_only = true
[Vcasm-Protector 1:0]
signature = 55 8B EC 6A
00 00 E8 03 00 00 00 C7
01 E9 83 C0 07 50 C3 FF
E9 50 C3 E8 B9 04 00 00
E8 F2 FF FF FF 0F B9 49
59 74 05 75 F8 51 EB F1
C4 04 EB 14 64 FF 35 00
EB 05 E8 EB FB 00 00 83
00 58 EB 09 0F 25 E8 F2
ep_only = true

FF
84
35
00
75
E8
00
C4
FF

68
00
E8
E8
F1
16
00
04
FF

??
58
07
1F
EB
00
00
B9
FF

??
EB
00
00
05
00
64
04
0F

??
01
00
00
EB
00
89
00
B9

00
E9
00
00
F9
8B
25
00

68
83
C7
EB
EB
5C
00
00

??
C0
83
FA
F0
24
00
E8

??
07
83
E8
D6
0C
00
1F

[Vcasm-Protector 1:0]
-255-

??
50
C0
16
EB
8B
00
00

00
C3
13
00
01
A3
33
00

64
FF
EB
00
0F
C4
C9
00

A1
35
0B
00
31
00
99
EB

00
E8
58
E9
F0
00
F7
FA

00
03
EB
EB
EB
00
F1
E8

00
00
02
F8
0C
64
E9
16

00
00
CD
00
33
8F
E8
00

50
00
20
00
C8
05
05
00

64
C7
83
58
EB
00
00
00

89
84
C0
EB
03
00
00
E9

25
00
02
09
EB
00
00
EB

00
58
EB
0F
09
00
0F
F8

00
EB
01
25
0F
83
01
00

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB
01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83
ep_only = true
[Vcasm-Protector 1:0a - 1:0d -> vcasm]
signature = 55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 E8 03 00 00 00
ep_only = true
[Vcasm-Protector 1:0e -> vcasm]
signature = EB 0A 5B 56 50 72 6F 74 65 63 74 5D
ep_only = true
[Vcasm-Protector 1:1 - 1:2 -> vcasm]
signature = EB 0B 5B 56 50 72 6F 74 65 63 74 5D
ep_only = true
[vfp&exeNc V5:00 -> Wang JianGuo]
signature = 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 64 FF 35 00 00 00 00
64 89 25 00 00 00 00 CC
ep_only = true
[vfp&exeNc v6:00 -> Wang JianGuo]
signature = 60 E8 01 00 00 00 63 58 E8 01 00 00 00 7A 58 2D 0D 10 40 00 8D 90 C1 10 40 00 52
50 8D 80 49 10 40 00 5D 50 8D 85 65 10 40 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC
ep_only = true
[Video-CD file]
signature = 52 49 46 46 ?? ?? ?? ?? 43 44 58 41 66 6D 74
ep_only = false
[Video-Lan-Client -> (UnknownCompiler)]
signature = 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00
ep_only = true
[Video-Lan-Client]
signature = 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF
ep_only = true
[Virogen Crypt v0:75]
signature = 9C 55 E8 EC 00 00 00 87 D5 5D 60 87 D5 80 BD 15 27 40 00 01
ep_only = true
[Virogen`s PE Shrinker v0:14]
signature = 9C 55 E8 ?? ?? ?? ?? 87 D5 5D 60 87 D5 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 57 56
AD 0B C0 74
ep_only = true
[VIRUS - I-Worm:Bagle]
signature = 6A 00 E8 95
01 E1 FF FF 05 88 13 00
B0 EA FF FF E8 3A FC FF
00 00 EB F4 CC FF 25 A4
AC 40 40 00 FF 25 9C 40
40 40 00 FF 25 2C 40 40
40 00 FF 25 40 40 40 00
00 FF 25 54 40 40 00 FF
FF 25 64 40 40 00 FF 25
ep_only = false

01
00
FF
40
40
00
FF
25
68

00
A3
83
40
00
FF
25
58
40

00
03
3D
00
FF
25
44
40
40

E8
50
54
FF
25
30
40
40

9F
40
57
25
A0
40
40
00

E6
00
40
B8
40
40
00
FF

FF
68
00
40
40
00
FF
25

FF
5C
00
40
00
FF
25
5C

83
57
74
00
FF
25
48
40

-256-

3D
40
05
FF
25
34
40
40

03
00
E8
25
A8
40
40
00

50
68
F3
B4
40
40
00
FF

40
F6
FA
40
40
00
FF
25

00
30
FF
40
00
FF
25
60

00
40
FF
00
FF
25
4C
40

75
00
68
FF
25
38
40
40

14
FF
E8
25
24
40
40
00

68
35
03
B0
40
40
00
FF

C8
03
00
40
40
00
FF
25

AF
50
00
40
00
FF
25
BC

00
40
E8
00
FF
25
50
40

00
00
B1
FF
25
3C
40
40

E8
E8
00
25
28
40
40
00

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VIRUS - I-Worm:Bagle]
signature = 6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8
01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8
B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00
ep_only = false
[VIRUS - I-Worm:Hybris]
signature = EB 16 A8 54 ?? ?? 47 41 42 4C 4B 43 47 43 ?? ?? ?? ?? ?? ?? 52 49 53 ?? FC 68 4C
70 40 ?? FF 15
ep_only = false
[VIRUS - I-Worm:KLEZ]
signature = 55 8B EC 6A FF 68 40 D2 40 ?? 68 04 AC 40 ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ??
?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 BC D0
ep_only = false
[VisualUPX 0:2 -> emadicius]
signature = 66 C7 05 ?? ?? ?? 00 75 07 E9 ?? FE FF FF
ep_only = true
[VMProtect 0:7x - 0:8 -> PolyTech]
signature = 5B 20 56 4D 50 72 6F 74 65 63 74 20 76 20 30 2E 38 20 28 43 29 20 50 6F 6C 79 54
65 63 68 20 5D
ep_only = false
[VMProtect 0:x -> PolyTech]
signature = 5B 20 56 4D 50 72 6F 74 65 63 74 20
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 57 52 51 50 53 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21
8B 45 00 36 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 55 51 57 52 52 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45
00 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 51 55 52 50 52 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8
83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 52 53 56 50 57 51 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 46 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 51 53 55 51 50 52 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
8B 6D 00 E9
ep_only = true

-257-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 51 52 55 51 50 57 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 83 C6 01
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 50 52 51 57 53 55 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED
04 83 C6 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 83 EE FF
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 46 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 57 53 52 55 51 56 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 8D 76 01
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 C6 01 66 89 14 07
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 56 53 57 52 51 57 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8A 06
46 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 52 56 53 57 51 54 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 01 45 04 9C 8F 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 50 52 56 51 50 53 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
89 EC 59 5F 5B 5A 59 5E 5A 58 5D 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 57 50 55 56 57 51 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D
00 E9
-258-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 56 56 50 55 51 57 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83
C5 02 66 8B 00 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 C6 01 88 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 EE FF 66 89 14 07
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 55 56 56 57 51 50 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
89 E8 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 51 52 55 52 50 56 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 EE FF 88 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 50 55 56 51 57 50 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 50 52 51 55 56 52 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
89 E8 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 56 53 55 53 51 50 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 75 00 83
C5 04 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 56 51 57 53 50 55 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED
04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 46 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 83 C6 01 E9
ep_only = true
-259-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 83 EE FF E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 8D 76 01 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 55 51 53 53 57 50 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 A5 06 00 00 8B 45 00 66 8B 55 04 83 C5
06 66 89 10 E9
ep_only = false
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 53 51 55 57 56 50 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 8D 76 01 66 89 14 07
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 8D 76 01 88 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C6 01 83 C5 02 66 89 14 07
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C6 01 83 C5 02 88 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 EE FF 83 C5 02 66 89 14 07
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 51 56 57 50 50 53 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45
00 8A 55 04 83 C5 06 88 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 56 55 52 50 55 53 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75
00 83 C5 04 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 56 53 52 50 55 52 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83
-260-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

C5 02 36 8A 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 55 57 53 56 50 52 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 53 50 52 56 55 57 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 52 56 50 53 56 55 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06
83 ED 04 8D 76 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 EE FF 83 C5 02 88 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 8D 76 01 83 C5 02 66 89 14 07
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 57 53 51 52 55 54 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21
89 EC 58 5E 59 5D 5A 59 5B 5F 58 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 8D 76 01 83 C5 02 88 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 46 98 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 83 C6 01 98 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 83 EE FF 98 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 56 57 53 55 51 52 54 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 56 57 51 52 53 55 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83
C5 02 8A 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
-261-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 52 53 52 56 57 55 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 51 53 57 56 52 55 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 47 50 39 C5 0F 87 ?? ?? ?? ?? 8D 4F 40 29 E1 8D
45 80 29 C8 89 C4 9C 56 89 FE 8D BD 40 FF FF FF 57 FC F3 A4 5F 5E 9D E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 6D 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 00 83 C5 02 36 8A 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 F7 D0 F7 D2 21 D0 89 45 04 9C 8F
45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 8A 4D 08 83 C5 02 0F AD D0 89 45
04 9C 8F 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 8A 4D 08 83 C5 02 0F A5 D0 89 45
04 9C 8F 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9
ep_only = true

-262-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 36 88 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E8 89 45 04 9C 8F 45
00 E9 01 7D 00 00
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E8 89 45 04 9C 8F 45
00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E0 89 45 04 9C 8F 45
00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 36 8B 00 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 36 89 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 EE FC 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 8D 76 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 8D 76 04 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 EE FC E9
ep_only = true
-263-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 83 C6 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 C6 04 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 8A 4D 02 83 ED 02 D2 E8 66 89 45 04 9C 8F
45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 8A 4D 02 83 ED 02 D2 E0 66 89 45 04 9C 8F
45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 83 ED 02 00 45 04 9C 8F 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 8A 04 07 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 98 98 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 8D 76 01 98 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 55 00 83 C5 02 88 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 55 00 83 C5 02 66 89 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 04 07 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 8D 76 01 83 ED 02 66 89 45 00 E9
ep_only = true
-264-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 EE FF 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 8D 76 01 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 83 EE FF 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 83 C6 01 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 8D 76 01 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 83 EE FF E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 83 C6 01 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 46 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 C6 01 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 57 51 50 55 51 53 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21
8B 6D 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 57 55 52 50 53 51 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED
04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 46 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 46 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 C6 01 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
-265-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 46 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 46 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 8A 04 07 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 98 98 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 55 00 83 C5 02 88 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 55 00 83 C5 02 66 89 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 04 07 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 8D 76 01 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 83 EE FF 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 83 C6 01 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 8D 76 01 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 83 EE FF E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 51 53 55 56 50 52 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 06
83 ED 04 89 45 00 8D 76 04 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 52 53 51 55 50 55 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 80 E0 3C 8B
14 07 83 ED 04 89 55 00 E9
ep_only = true
-266-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 83 C6 01 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 46 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 52 55 56 51 50 53 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 46 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 8A 04 07 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 83 C6 01 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 83 EE FF 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 98 98 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 55 00 83 C5 02 88 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 55 00 83 C5 02 66 89 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 04 07 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 8D 76 01 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 EE FF 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 8D 76 01 89 45 00 E9
ep_only = true

-267-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 8D 76 01 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 83 EE FF E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 46 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 83 C6 01 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 46 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 55 52 54 50 51 53 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8
83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 83 EE FF 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 83 C6 01 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 46 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 C6 01 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 46 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 8D 76 01 98 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 83 EE FF 98 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 83 C6 01 98 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 46 98 83 ED 04 89 45 00 E9
ep_only = true

-268-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 8D 76 01 83 C5 02 88 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 8D 76 01 83 C5 02 66 89 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 EE FF 83 C5 02 88 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 EE FF 83 C5 02 66 89 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C6 01 83 C5 02 88 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C6 01 83 C5 02 66 89 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 8D 76 01 88 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 8D 76 01 66 89 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 8D 76 01 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 83 EE FF E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 83 C6 01 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 46 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 EE FF 88 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 EE FF 66 89 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 C6 01 88 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 C6 01 66 89 14 07 E9
-269-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 8D 76 01 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 83 EE FF E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 83 C6 01 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 46 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 46 88 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 46 66 89 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 46 83 C5 02 88 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 46 83 C5 02 66 89 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 8D 76 01 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 EE FF 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 8D 76 01 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 83 EE FF 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 83 C6 01 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 83 EE FF E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 83 C6 01 66 89 45 00 E9
ep_only = true

-270-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 8D 76 01 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 83 EE FF E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 83 C6 01 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 46 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 46 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 C6 01 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 46 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 C6 01 83 ED 02 66 89 45 00
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 46 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 46 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 8A 04 07 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 98 98 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 55 00 83 C5 02 88 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 55 00 83 C5 02 66 89 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
-271-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 04 07 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 8D 76 01 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5F 59 5D 5A 5B 5B 5E 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5F 58 5E 5A 5B 59 5D 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 8D 76 01 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 EE FF 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5D 5E 59 5B 58 5B 5F 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5D 59 58 5F 5A 5E 5B 5B C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 59 5A 5B 58 5B 5F 5E 5D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 9D 58 5B 5D 5A 5A 5E 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 5F 5B 58 59 5D 5A 5E 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 5A 58 5E 5D 5B 9D 59 5D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 9D 5F 5D 5B 58 5D 59 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 9D 5D 5B 59 5A 58 5F 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5F 58 59 9D 5F 5B 5D 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5D 5B 5A 9D 58 5A 59 5F C3
ep_only = true
-272-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5D 58 59 58 9D 5A 5B 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 8D 76 01 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 04 07 83 ED 02 66 89 45 00
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 55 00 83 C5 02 66 89 14 07
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 55 00 83 C5 02 88 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5A 59 9D 5F 5D 5B 58 5B C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 59 5A 5B 9D 5F 58 58 5D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 98 98 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 8A 04 07 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 59 58 5F 5B 5D 5D 5A 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 5F 5D 5A 59 9D 5A 5B C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 5D 5A 5A 5F 5B 9D 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 59 5B 59 5A 5D 9D 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 9D 59 5F 5D 58 5E 5A 5B C3
ep_only = true
-273-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5B 59 5F 5E 9D 5D 5A 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5B 58 5A 59 5F 9D 5E 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 46 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 46 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 83 C6 01 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5A 5F 58 9D 5E 5B 59 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 59 9D 5A 5E 58 5B 5F 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 9D 58 59 58 5E 5D 5A 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 5D 5E 5F 58 9D 5A 58 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 83 EE FF E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 59 5E 5F 5D 5A 9D 58 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 59 5D 9D 5E 5F 5A 5D 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 8A 04 07 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 9D 5B 5F 5E 5D 58 59 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5F 5D 9D 58 59 59 5B 5E C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
-274-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5E 5D 5B 9D 59 58 58 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5D 59 5D 5F 58 5E 5B 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 8D 76 01 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 83 C6 01 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5B 5F 5E 9D 58 5D 59 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 83 EE FF 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 8D 76 01 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 04 07 83 ED 02 66 89 45 00
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 55 00 83 C5 02 66 89 14 07
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 55 00 83 C5 02 88 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 59 5E 5D 5F 9D 5E 5B 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 58 5B 59 5E 5D 5F 5F 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5F 5B 58 5A 9D 58 5E 5D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5E 5F 5D 5A 5B 58 5A 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5E 5A 5F 5B 9D 5B 58 5D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
-275-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5D 5A 58 9D 5B 5E 5F 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 59 58 5B 5E 5F 5A 9D 5D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5F 5E 5B 59 5D 5A 9D 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5F 5E 59 9D 5D 5B 59 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5A 5E 5F 5B 5B 5D 59 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5A 5B 5E 5F 9D 5D 5F 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5E 5F 5B 5D 58 5A 59 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5E 5A 58 5F 5D 5B 59 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5A 59 5E 5D 5F 5B 5A 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5E 9D 5F 59 5A 5D 58 5B C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5B 9D 5D 5A 5E 58 5A 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5A 59 5D 9D 5E 58 5B 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 59 59 5A 5B 9D 5E 58 5D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 9D 5A 5D 5F 58 5B 59 5B C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5F 58 5B 5A 59 5D 9D 5D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 98 98 83 ED 04 89 45 00 E9
ep_only = true
-276-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5E 5B 58 9D 59 5D 5F 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5E 5A 58 5D 9D 59 5F 5B C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5D 5B 5F 5E 59 58 9D 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5B 5A 58 5D 59 5F 9D 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5A 5F 5B 9D 58 5E 59 5D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5A 5F 59 5B 5D 58 5B 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 9D 5A 5B 59 58 5E 58 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5F 5B 5D 58 5E 5A 59 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5F 5A 5B 5E 58 9D 59 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5E 58 5F 5A 59 5B 5B 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5E 58 5A 9D 5F 59 5B 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 59 5E 5A 58 5B 5F 59 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 8A 04 07 83 ED 02 66 89 45 00 E9
ep_only = true

-277-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 9D 5F 5D 58 5A 5E 59 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5E 59 5F 5D 5D 9D 58 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5D 5F 5E 9D 58 5A 59 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5A 9D 58 5F 5E 5E 59 5D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5A 5F 5E 5D 58 58 59 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 59 9D 5D 5A 5E 58 5F 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5D 5E 5F 9D 5A 59 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5D 58 9D 59 5A 5F 5E C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5A 59 5E 9D 5E 5D 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5F 5E 58 5D 59 5D 5B 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5B 5F 58 5D 5E 5D 59 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5B 5D 5E 58 5F 59 5D 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 59 5F 58 5E 9D 5D 5F 5B C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 59 58 5D 5E 5D 5F 5B 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5F 5F 5E 5D 5A 5B 9D 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5F 5D 9D 5E 5B 5A 5A 58 C3
-278-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5D 5F 5B 5E 9D 58 5A 5B C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5D 5D 5A 5F 5E 58 9D 5B C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5A 5B 9D 58 5E 5F 58 5D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 9D 5B 5E 5A 5D 5F 5F 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5F 5E 5E 5A 5D 5B 59 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5E 5F 5D 5A 58 5B 9D 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5B 5D 5E 5A 5E 59 9D 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 9D 5F 59 5A 5B 5D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 5F 5D 5B 5A 5A 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 5D 5F 5B 9D 5A 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5F 58 5A 5E 5D 5E 5B 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 46 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 98 98 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 55 00 83 C5 02 88 14 07 E9
ep_only = true

-279-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 46 88 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 46 66 89 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 55 00 83 C5 02 66 89 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5D 5A 5B 58 5F 5E 5E 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5B 5D 5A 5F 59 5E 58 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 5F 5D 58 5B 58 59 5E C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 5F 58 5B 59 5B 5D 5E C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 58 5B 5F 59 5D 5E 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 59 5D 5B 5F 58 5E 5A 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 59 5A 5F 5E 5D 5D 58 5B C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5F 5B 5A 9D 5E 5D 59 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5E 9D 59 5A 5A 5B 58 5D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5D 5E 58 5B 9D 59 5A 5B C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5D 58 59 9D 5E 5B 5A 5E C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5A 5B 59 5D 9D 59 5E 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 C6 01 83 ED 02 66 89 45 00 E9
-280-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 46 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 46 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 9D 5A 5D 5F 5E 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 5F 5A 59 5D 9D 5E C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 04 07 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F7 55 00 66 8B 45 00 83 ED 02 66 21 45 04 9C 8F 45
00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 46 83 C5 02 88 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5F 9D 5D 5B 58 5E 5A 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 5A 5F 59 58 9D 5B 5B C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 59 5B 5A 58 5F 9D 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 59 5F 5B 5D 58 5A 9D 5E C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 59 58 5F 5D 58 5B 9D 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 58 5F 5D 5B 5A 59 9D 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 83 C6 01 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 58 5A 5D 5F 5B 5A 59 9D C3
ep_only = true
-281-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 83 EE FF E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 8D 76 01 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 83 C6 01 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 83 EE FF 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 8D 76 01 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 46 83 C5 02 66 89 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 EE FF 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 8D 76 01 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 04 07 83 ED 02 66 89 45 00
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 55 00 83 C5 02 66 89 14 07
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 55 00 83 C5 02 88 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 98 98 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 8A 04 07 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 57 9C 55 52 56 51 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
-282-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 5E 5B 9D 58 5B 59 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 5A 5E 5D 5B 58 9D 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 59 59 5A 5E 5B 9D 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5E 9D 58 5B 5F 59 58 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5D 58 5F 59 5B 9D 5E 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 9D 5A 5F 59 58 5D 5E 5E C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5F 5B 9D 59 5A 5D 58 5E C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5F 58 5A 5E 9D 5D 59 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 9D 58 5D 5F 5A 5D 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 59 5A 58 9D 5D 5B 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 58 5D 5F 9D 5A 59 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 9D 5E 5D 58 5F 5A 59 5B C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 5F 5F 58 5E 5D 9D 59 5B C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 5F 5B 58 59 5D 9D 5D 5E C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5D 58 59 9D 5E 5A 5B 5F C3
ep_only = true

-283-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5B 58 5A 5B 5F 5E 9D 5D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5A 9D 5F 5B 5B 5D 58 5E C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5A 9D 5E 58 5F 5D 59 5B C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 58 5B 5D 5F 5E 5A 5F 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 58 5A 5F 5B 5E 5D 5D 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 9D 5F 5D 5E 5B 59 5A 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 5E 59 5E 5D 5B 5A 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 5B 5D 5E 5B 5A 59 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 59 5A 59 5E 5D 5B 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 9D 5A 5F 5D 5A 5E 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 5A 5F 59 5D 5D 5E 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 9C 53 55 57 52 51 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 06 98
83 ED 04 89 45 00 83 C6 02 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 59 5F 5A 5E 5D 9D 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 53 9C 56 57 56 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75
00 83 C5 04 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 59 59 5E 5D 5F 5A 9D C3
-284-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5A 9D 5D 59 5B 59 5E 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5F 5D 5E 5B 58 59 5A 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5D 5E 58 59 5B 5F 5A 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5D 59 5F 5E 58 58 5A 5B C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 58 5F 5F 5B 5A 59 5D 5E C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 9D 5B 59 5E 5B 5D 58 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 9D 5D 58 5B 5A 5A 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 5D 59 9D 5B 58 5A 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 58 5D 5B 59 9D 5A 5D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5B 5E 5B 5D 59 5A 9D 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5A 5E 5E 59 9D 5D 5B 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5A 5B 5E 5D 5B 9D 59 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5F 5F 9D 59 5D 5A 5B 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5F 5B 59 5D 58 9D 5A 5D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 54 53 56 57 55 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
8B 6D 00 E9
-285-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 57 56 55 53 9C 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 5D 5A 5F 58 59 58 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 9C 50 53 57 55 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75
00 83 C5 04 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 5A 59 5D 58 5F 9D 5D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 52 55 9C 52 57 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
8B 45 00 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 59 5D 5F 9D 5A 58 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 54 57 56 52 55 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8
83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5A 5F 58 58 5D 59 5B 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5A 59 5D 5B 58 5F 9D 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 59 5D 9D 58 5B 5A 5F 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 9C 52 56 55 57 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 06
83 ED 04 89 45 00 83 EE FC E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 8D 76 01 83 ED 02 66 89 45 00
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5F 5E 58 9D 59 5A 5B 5A C3
-286-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 55 53 56 51 57 52 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 55 9C 57 57 56 52 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
89 E8 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 53 53 9C 52 55 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 53 55 57 52 9C 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
89 EC 59 5D 9D 5A 5F 5D 5B 5E 59 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 9D 5F 5B 5A 5B 58 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 5F 58 5B 5A 5A 59 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 EE FF 83 ED 02 66 89 45 00
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 8D 76 01 66 89 45 00
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 55 52 9C 57 53 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 66 8B
6D 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 9C 53 57 55 52 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 8B 55 04 83 C5 08 89 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 53 9C 55 56 53 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45
00 8B 55 04 83 C5 08 89 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 57 56 55 56 53 9C 68 00 00 00 00 8B 74 24
-287-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75
00 83 C5 04 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 9C 56 53 57 51 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 53 53 55 9C 57 51 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 53 56 51 55 9C 51 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 56 53 57 51 9C 52 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 5B 5F 58 5E 59 5A 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 56 9C 53 54 57 55 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 59 9D 5D 58 5B 5E 5A 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 58 5A 5B 5D 9D 5F 5E 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 5E 5A 5E 59 5F 5D 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 57 56 57 9C 51 55 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 59 5E 5D 5D 5F 5A 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 58 5F 5E 59 5D 5D 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5F 5A 59 58 5D 9D 5E 5A C3
ep_only = true

-288-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5E 5A 58 5F 58 59 9D 5D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 57 9C 54 53 55 56 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
8B 75 00 83 C5 04 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 5E 59 5F 58 9D 58 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 59 5F 5E 58 9D 5A 5E C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 58 9D 59 5F 5E 59 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 9C 50 55 53 51 56 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 8A 55 04 83 C5 06 88 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 5D 58 5F 5B 59 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 83 EE FF 66 89 45 00
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 5B 5F 5B 58 5D 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 59 5D 5D 58 5B 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5B 59 5D 5F 58 5E 5E C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5F 58 59 5B 5D 5E 9D 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 9C 55 53 57 51 53 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8
83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 50 9C 51 57 52 55 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06
-289-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

83 EE FC 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5E 5D 9D 5B 58 5F 59 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5B 59 5D 5E 58 5F 9D 5D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5B 58 9D 5E 5F 5D 59 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 51 57 53 9C 52 55 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
8B 45 00 36 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 59 5F 59 58 9D 5E 5D 5B C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 59 5B 5D 5A 5E 9D 5F 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 52 51 55 55 56 57 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
89 E8 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 58 5E 5D 5B 5B 9D 59 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 58 5B 5E 59 5D 9D 5F 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5F 58 5A 9D 5D 5E 5E 5B C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5E 5B 5F 5B 9D 58 5D 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5E 58 5D 5B 9D 5F 5A 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5D 5F 5E 5A 5B 9D 5B 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 9D 5E 5F 5A 58 5D 5D C3
ep_only = true
-290-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 5F 5E 58 9D 5D 5A 5E C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 5E 5A 5F 58 5D 9D 58 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 58 5D 5F 9D 5A 5E 5E C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5A 5E 58 9D 5D 58 5B 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5A 5B 5E 58 5D 5F 9D 5B C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 9D 5B 5D 5E 5F 5A 59 5E C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5F 5B 5F 5D 59 5E 9D 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5E 5A 59 5D 59 9D 5F 5B C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5B 5E 5D 9D 5B 59 5A 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5B 5E 5D 58 5F 9D 59 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5A 5D 5B 9D 59 5F 5F 5E C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5A 5D 5B 5E 59 5A 9D 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 59 5E 5D 5B 9D 5F 5A 5E C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
-291-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 E0 3C 8B 55 00 83 C5 04 89 14 07 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 E0 3C 8B 14 07 83 ED 04 89 55 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 6D 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 8A 4D 02 83 ED 02 66 D3 E8 66 89 45 04
9C 8F 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 8A 4D 02 83 ED 02 66 D3 E0 66 89 45 04
9C 8F 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 83 C6 01 66 89 45 00
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 83 ED 02 66 01 45 04 9C 8F 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 66 8B 55 02 F6 D0 F6 D2 83 ED 02 20 D0
66 89 45 04 9C 8F 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 8D 76 02 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 EE FE 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 8D 76 02 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 8D 76 02 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 EE FE E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 C6 02 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 83 EE FE 89 45 00 E9
ep_only = true
-292-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 83 C6 02 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 C6 02 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 8D 76 02 98 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 8D 76 02 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 EE FE 98 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 8D 76 01
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 54 52 57 51 55 56 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 89 E8
83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 EE FE 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 8D 76 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 52 56 51 9C 55 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 A7 72 45 00 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 83 EE FE 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 83 C6 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 8D 76 02 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 83 EE FE E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
-293-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 83 C6 02 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 C6 02 98 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 C6 02 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 8D 76 02 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 EE FE 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 8D 76 02 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 8D 76 02 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 57 52 55 51 53 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 83 EE FE E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 83 C6 02 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 83 EE FE 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 83 C6 02 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 C6 02 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 8D 76 02 98 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 8D 76 02 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
-294-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 EE FE 98 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 EE FE 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 8D 76 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 83 EE FE 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 83 C6 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 8D 76 02 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 83 EE FE E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 51 56 57 52 55 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 6D
00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 83 C6 02 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 C6 02 98 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 C6 02 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 55 54 52 51 9C 50 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21
89 E8 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 52 53 55 55 9C 51 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21
8B 45 00 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 52 50 51 56 55 53 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21
8B 45 00 8B 00 89 45 00 E9
ep_only = true
-295-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 9C 52 56 53 56 50 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 21 71 45 00 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 52 50 56 9C 51 53 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC
59 5A 5B 59 9D 5E 58 5F 5D 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 51 9C 55 52 53 56 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
8B 45 00 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 54 53 9C 55 52 50 56 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
89 E8 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 56 55 55 9C 50 52 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21
8B 45 00 36 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 52 51 57 55 9C 56 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 83 EE
FC 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 52 52 9C 56 55 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 51 56 52 50 9C 50 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 56 57 55 53 9C 51 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
66 8B 6D 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 56 50 9C 53 50 51 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 01 45 04 9C 8F 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 52 9C 51 56 53 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
-296-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 52 57 51 9C 53 54 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B
6D 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 53 51 57 9C 56 52 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8
83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 53 56 52 57 56 51 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
8B 75 00 83 C5 04 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 56 50 55 51 9C 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45
00 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 54 55 51 50 9C 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75
00 83 C5 04 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 50 9C 56 53 55 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 50 53 51 56 55 51 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21
8B 6D 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 56 9C 56 53 55 52 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 06 8D
76 02 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 56 57 55 52 9C 53 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8A 06
83 ED 02 66 89 45 00 46 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 53 56 55 50 9C 52 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 8B 55 04 83 C5 08 89 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 52 53 51 52 56 57 68 00 00 00 00 8B 74 24
-297-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 8A 55 04 83 C5 06 88 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 53 57 51 52 56 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 53 55 50 55 56 52 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 52 53 56 9C 55 50 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45
00 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 50 52 54 9C 53 55 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 9C 55 53 56 52 53 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC
58 59 5B 5A 5E 58 5D 9D 58 5F C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 56 53 51 55 9C 55 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B
55 04 83 C5 08 36 89 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 56 57 57 51 52 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 66 8B 06 98
83 ED 04 8D 76 02 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 51 51 9C 52 55 57 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 6D
00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 52 53 55 57 9C 51 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8
83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 9C 56 53 51 50 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
-298-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 55 9C 56 52 51 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8A 45 00 83
ED 02 00 45 04 9C 8F 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 52 55 51 53 9C 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 75
00 83 C5 04 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 53 54 51 55 56 9C 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 52 53 56 57 9C 55 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED
02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 53 52 50 51 55 57 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 52 53 55 52 57 51 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 51 55 52 51 57 50 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21
66 8B 6D 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 50 57 55 51 52 51 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 9C 50 55 51 51 53 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 36 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 55 53 52 51 9C 50 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53 50 55 9C 51 52 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 55 52 9C 50 51 53 51 68 00 00 00 00 8B 74 24
-299-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 01 45 04 9C 8F 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 52 53 57 51 55 50 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
8B 75 00 83 C5 04 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 57 51 9C 50 52 55 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45
00 8B 55 04 83 C5 08 89 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 53 9C 57 52 51 55 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 53 50 57 53 9C 51 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 36 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 52 57 50 57 51 9C 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45
00 36 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 51 9C 52 50 53 57 54 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 75 00 83
C5 04 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 51 57 54 53 9C 50 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21
89 E8 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 50 51 57 50 52 53 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45
00 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 9C 55 50 54 51 52 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53 51 55 57 52 53 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
89 E8 83 ED 04 89 45 00 E9
ep_only = true
-300-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 52 53 51 55 9C 52 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83
C5 02 8A 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 53 57 52 56 51 55 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
66 8B 6D 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 55 51 55 9C 56 53 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 52 53 57 51 55 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21
8B 45 00 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 57 52 50 51 51 9C 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 55 52 51 55 57 9C 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 8B 55 04 83 C5 08 89 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 55 51 9C 52 55 50 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06
8D 76 04 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 52 51 55 9C 50 57 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 0F B6
06 83 ED 02 46 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 52 50 9C 51 55 54 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8
83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 9C 51 50 57 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 53 9C 57 52 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 0F B6 06 66
98 98 46 83 ED 04 89 45 00 E9
-301-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 52 9C 57 50 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8A 06 8A 04
07 46 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 52 9C 55 57 51 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21
89 E8 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 50 53 9C 57 52 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED
04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 9C 57 51 55 55 53 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83
C5 02 66 8B 00 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 9C 55 53 51 50 51 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 57 53 57 55 9C 51 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 66 8B
6D 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 55 50 9C 51 57 53 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21
8B 75 00 83 C5 04 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 55 50 57 51 53 9C 54 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8
83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 50 53 51 57 9C 57 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 36 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 9C 57 52 50 50 53 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83
C5 02 66 8B 00 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
-302-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 57 56 52 55 50 53 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 53 51 55 51 56 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 01
45 04 9C 8F 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 53 54 57 55 50 9C 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 53 55 51 56 56 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 06
83 ED 04 89 45 00 83 C6 04 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 51 52 55 57 9C 53 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 57 9C 51 53 52 50 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 55 51 53 50 52 9C 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 55 50 52 51 57 53 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 56 56 53 57 51 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21
8B 75 00 83 C5 04 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 53 9C 51 57 52 57 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 66 8B
6D 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 53 56 53 52 55 51 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 52 9C 52 51 57 53 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B
55 04 83 C5 08 36 89 10 E9
-303-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 51 53 57 52 9C 51 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21
66 8B 6D 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 57 56 50 52 53 51 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8
83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 83 EE FF
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 57 51 50 52 53 56 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 56 50 51 53 52 57 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8
83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 53 50 54 57 51 56 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 36 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 53 50 51 51 57 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 53 57 52 57 56 51 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45
00 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 54 55 56 52 53 51 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 51 57 53 56 54 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06
83 ED 04 8D 76 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 51 50 53 53 56 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45
00 01 45 04 9C 8F 45 00 E9
-304-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 55 52 51 56 57 51 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 55 54 56 52 57 51 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21
8B 6D 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 51 55 56 53 52 50 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 56 53 53 55 57 52 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 01
45 04 9C 8F 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 9C 53 51 50 52 51 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83
C5 04 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 52 9C 53 57 50 55 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
8B 75 00 83 C5 04 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 55 56 50 53 9C 57 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 0F B6 06 46
83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 57 9C 53 53 55 52 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 9C 56 53 57 52 55 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 9C 56 53 57 55 52 54 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 9C 51 56 53 52 50 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8
83 ED 04 89 45 00 E9
ep_only = true
-305-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 51 9C 56 53 55 52 50 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 52 51 9C 53 53 50 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 50 53 56 55 57 9C 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8
83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 51 9C 56 53 51 50 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
89 E8 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 53 55 9C 55 56 57 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 89 E8
83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 50 56 51 52 53 50 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A
55 04 83 C5 06 88 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 55 9C 56 53 52 57 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC
5A 58 5F 5A 5B 5E 9D 5D 59 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 50 52 53 52 51 9C 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
8B 45 00 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 57 53 52 50 51 55 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 57 51 52 53 53 9C 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 8A 55 04 83 C5 06 88 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 52 57 50 55 53 9C 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8A 06
46 83 ED 02 66 89 45 00 E9
-306-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 52 9C 57 56 50 53 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21
8B 75 00 83 C5 04 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 83 C6 01
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 52 50 56 56 9C 51 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 51 51 56 50 52 57 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45
00 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 57 53 55 56 50 9C 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
8B 45 00 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 53 55 50 9C 55 56 57 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 57 51 56 53 57 50 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 57 50 9C 53 56 52 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45
00 8B 55 04 83 C5 08 89 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 56 53 57 51 52 9C 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 57 56 52 50 56 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 36 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 53 56 52 51 50 9C 57 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 66
8B 55 04 83 C5 06 66 89 10 E9
ep_only = true
-307-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 53 56 50 56 57 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 53 51 52 50 56 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 52 56 57 9C 53 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 57 9C 56 50 55 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8
83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 9C 53 56 57 50 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 89 EC
5A 5B 58 5F 5E 5A 9D 5A 5D 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 53 57 50 52 50 9C 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B
6D 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 57 50 9C 56 52 50 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 9C 52 50 57 56 53 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 36 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 53 57 52 57 56 50 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 53 51 56 52 9C 57 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21
89 E8 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 52 53 50 9C 57 56 54 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
89 E8 83 ED 04 89 45 00 E9
ep_only = true

-308-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 52 50 56 53 57 9C 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED
04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 52 9C 57 54 55 53 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 50 53 53 52 57 9C 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 53 53 50 9C 52 57 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
66 8B 6D 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 50 52 57 53 9C 50 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 56 53 55 57 9C 52 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45
00 8A 55 04 83 C5 06 88 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 57 52 55 50 9C 53 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00
E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 57 55 50 52 9C 56 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 8B 55 04 83 C5 08 89 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 9C 56 52 51 53 51 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 57 52 51 9C 53 56 54 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 06
83 ED 04 89 45 00 83 C6 04 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 52 51 9C 57 53 52 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
-309-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 52
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 51 9C 50 57 53 56 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B
55 04 83 C5 08 36 89 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 57 55 53 51 52 50 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 56 51 52 50 55 57 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75
00 83 C5 04 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 53 56 51 57 55 52 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 36 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 52 50 51 57 56 55 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45
00 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 51 56 52 56 55 50 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21
8B 45 00 36 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 9C 56 50 51 55 52 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 56 51 50 9C 52 55 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
89 E8 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 55 56 52 56 51 50 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8
83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 55 56 55 50 51 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 55 50 51 57 56 9C 68 00 00 00 00 8B 74 24
-310-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 51 52 50 51 9C 56 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A
55 04 83 C5 06 36 88 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 9C 52 52 51 55 50 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B
6D 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 51 50 52 55 9C 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 51 9C 57 55 52 50 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 51 55 50 57 9C 52 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 50 56 52 57 9C 51 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 9C 56 57 51 50 52 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 83
C5 02 66 8B 00 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 9C 50 57 57 51 56 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A
55 04 83 C5 06 88 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 55 57 51 56 50 9C 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06
83 ED 04 83 C6 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 52 57 57 50 9C 56 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 51 9C 56 50 57 51 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
-311-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 50 52 57 56 51 9C 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 9C 56 50 53 57 51 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45
00 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 9C 55 57 50 51 55 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 89 E8
83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 55 56 51 55 9C 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 55 51 9C 56 50 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 50 55 51 9C 56 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45
00 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 56 9C 57 50 51 55 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 8B 55 04 83 C5 08 89 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 55 9C 57 56 51 50 54 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 EC
5A 5E 58 59 5E 5F 9D 5D 5A 5B C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 9C 50 55 53 54 52 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 59 5E 5F 5D 5A 9D C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 50 56 51 57 56 55 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8A 06 8A 04
07 83 ED 02 66 89 45 00 46 E9
ep_only = true

-312-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 9C 52 57 55 50 56 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
8B 45 00 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 56 50 57 55 52 9C 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 55 56 52 9C 57 50 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 36
8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 52 55 56 56 9C 57 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 52 55 56 55 57 50 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 50 9C 55 52 50 57 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 8D 76
04 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 50 52 52 57 55 56 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8
83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 55 56 54 57 52 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 54 51 57 52 56 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 50 56 57 51 52 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 89 E8
83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 9C 56 51 52 55 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21
8B 6D 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
-313-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 56 9C 55 52 51 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8
83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 56 55 51 9C 51 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 53 9C 52 51 55 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 57 53 52 9C 56 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B
6D 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 52 51 9C 52 57 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
66 8B 6D 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 50 51 9C 52 56 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 54 9C 51 56 55 57 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 51 53 52 57 55 9C 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 51 51 9C 52 57 55 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED
04 83 EE FC 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 9C 56 53 55 57 54 50 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 56 51 50 9C 55 57 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21
89 E8 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 53 9C 54 55 51 56 50 68 00 00 00 00 8B 74 24
-314-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45
00 01 45 04 9C 8F 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 53 9C 50 50 56 55 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 50 53 51 56 55 9C 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 9C 57 50 53 55 57 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8
83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 56 57 55 53 9C 50 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75
00 83 C5 04 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 55 9C 56 57 50 51 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 53 51 50 9C 57 50 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 53 50 55 9C 57 51 54 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 9C 55 56 57 51 53 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 9C 50 51 57 53 51 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 9C 57 51 50 53 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 51 9C 53 57 51 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06
83 C6 04 83 ED 04 89 45 00 E9
ep_only = true
-315-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 51 53 50 9C 53 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45
00 8B 55 04 83 C5 08 89 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 53 50 56 53 51 57 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 36 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 50 57 53 56 9C 57 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21
89 E8 83 ED 02 66 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 50 53 56 51 9C 50 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 8B 55 04 83 C5 08 89 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 56 50 9C 55 53 57 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B
6D 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 53 57 51 55 56 9C 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 51 50 55 53 56 9C 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 8A 55 04 83 C5 06 88 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 9C 50 56 51 55 57 54 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 9C 50 56 51 55 54 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 57 55 56 51 50 9C 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 56 55 56 9C 57 51 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 75
00 83 C5 04 E9
ep_only = true
-316-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 55 50 9C 56 54 57 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 53 9C 57 55 51 50 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 8B 55 04 83 C5 08 89 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 50 56 53 57 9C 55 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC
58 59 5D 9D 5F 5A 5E 58 5B 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 50 55 51 56 9C 55 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
8B 6D 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 52 50 56 57 51 9C 53 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 6D
00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 56 9C 56 53 57 50 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21
8B 75 00 83 C5 04 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 56 53 55 57 9C 50 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06
83 ED 04 83 EE FC 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 55 57 53 9C 50 52 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 53 50 57 9C 55 54 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 EC
5B 5E 5D 5D 9D 5F 58 5B 59 5A C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 50 56 55 53 57 50 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
89 E8 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 50 55 57 56 57 53 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
-317-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 9C 55 53 51 56 57 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 01
45 04 9C 8F 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 56 57 53 9C 57 55 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 9C 54 56 53 57 51 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 9C 51 56 51 53 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
89 E8 83 ED 04 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 56 9C 57 53 51 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 53 9C 55 51 54 56 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75
00 83 C5 04 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 50 55 56 53 9C 56 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45
00 01 45 04 9C 8F 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 52 56 53 50 55 9C 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06
83 ED 04 83 EE FC 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 53 51 9C 55 54 57 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 53 50 55 51 52 56 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 50 55 52 56 53 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D
00 E9
ep_only = true
-318-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect v1:25 -> PolyTech]

signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 50 50 56 53 52 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
66 8B 6D 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 56 52 53 55 53 50 9C 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D
00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 56 50 52 57 57 55 53 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 66
8B 55 04 83 C5 06 66 89 10 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 53 53 56 50 52 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45
00 36 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 53 50 52 53 56 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 50 57 53 56 52 52 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21
8B 45 00 36 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 52 57 50 53 55 56 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 6D
00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 56 52 9C 50 53 55 57 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21
89 EC 59 5F 5D 5B 58 9D 5A 5E 59 59 C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 52 53 50 56 57 55 50 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 9C 50 53 56 51 52 55 68 00 00 00 00 8B 74 24
2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45
00 8B 00 89 45 00 E9
ep_only = true
[VMProtect v1:25 -> PolyTech]
signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 5A 58 59 5B 5A 5F 9D C3
ep_only = true
-319-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VMProtect V1:X -> PolyTech]

signature = 9C 60 68 00 00 00 00 8B 74 24 28 BF ?? ?? ?? ?? FC 89 F3 03 34 24 AC 00 D8
ep_only = false
[VOB ProtectCD 5]
signature = 36 3E 26 8A C0 60 E8
ep_only = true
[VOB ProtectCD]
signature = 5F 81 EF ?? ?? ?? ?? BE ?? ?? 40 ?? 8B 87 ?? ?? ?? ?? 03 C6 57 56 8C A7 ?? ?? ??
?? FF 10 89 87 ?? ?? ?? ?? 5E 5F
ep_only = true
[VPacker -> ttui > Sign
signature = 89 C6 C7 45
F8 89 07 8B C3 E8 ?? FE
8B D8 83 C7 04 FF 45 E0
C2 20 89 02 68 00 80 00
D8 83 C3 14 8D 45 E0 50
ep_only = false

by
E0
FF
4E
00
6A

fly]
01 00
FF 8B
75 C4
6A 00
40 68

00
D8
8B
8B
00

00
EB
F3
45
10

F7
13
83
D4
00

03
53
3E
50
00

00
8B
00
FF
52

00
45
75
55
FF

FF
D8
88
EC
55

FF
50
8B
8B
E8

75
FF
45
55
8D

18
55
E4
DC
43

0F
F8
8B
8B
60

B7
89
40
42

03
07
10
3C

50
8B
03
03

8B
C3
45
45

45
E8
DC
DC

D8
??
8B
83

50
FE
55
C0

FF
FF
14
04

55
FF
83
8B

[VPacker -> ttui]

signature = 89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55
F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF
8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC
ep_only = true
[VProtector -> vcasm
signature = 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 4B
00 00 00 00 00 08 00
00 00 00 00 00 00 08
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
00 00 00 00 00 00 00
ep_only = false

* Sign:By:fly]
00 55 73 65 72
47 64 69 33 32
65 72 6E 65 6C
44 65 66 57 69
00 52 65 67 69
08 00 43 72 65
00 08 00 47 65
00 00 08 00 53
00 00 00 08 00
00 00 00 00 08
00 00 00 00 00
00 00 00 00 00

33
2E
33
6E
73
61
74
68
47
00
08
00

32
64
32
64
74
74
53
6F
65
52
00
00

2E
6C
2E
6F
65
65
79
77
74
65
46
00

64
6C
64
77
72
57
73
57
44
6C
69
47

6C
00
6C
50
43
69
74
69
43
65
6E
65

6C
00
6C
72
6C
6E
65
6E
00
61
64
74

00
00
00
6F
61
64
6D
64
00
73
57
4D

00
00
00
63
73
6F
4D
6F
00
65
69
65

00
00
00
41
73
77
65
77
00
44
6E
73

00
00
00
00
45
45
74
00
00
43
64
73

00
00
00
00
78
78
72
00
00
00
6F
61

00
00
00
00
41
41
69
00
00
00
77
67

00
00
00
00
00
00
63
00
00
00
41
65

00
00
00
00
00
00
73
00
00
00
00
41

00
00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00

00
00
00
00
00
00
00
00
00
00
00

[VProtector -> vcasm

signature = 00 00 00
6C 00 00 47 44 49 33
65 73 73 00 00 00 47
62 72 61 72 79 41 00
65 74 43 6F 6D 6D 61
41 00 00 00 47 65 74
57 69 6E 64 6F 77 50
00 00 43 72 65 61 74
74 72 69 63 73 00 00
6C 65 61 73 65 44 43
61 67 65 41 00 00 00
00 00 00 00
ep_only = false

* Sign:By:fly]
00 4B 45 52 4E
32 2E 64 6C 6C
65 74 4D 6F 64
00 00 53 6C 65
6E 64 4C 69 6E
41 43 50 00 00
72 6F 63 41 00
65 57 69 6E 64
00 53 68 6F 77
00 00 00 46 69
44 65 73 74 72

45
00
75
65
65
00
00
6F
57
6E
6F

4C
00
6C
70
41
43
00
77
69
64
79

33
00
65
00
00
72
52
45
6E
57
57

32
00
48
00
00
65
65
78
64
69
69

2E
00
61
00
00
61
67
41
6F
6E
6E

64
00
6E
47
47
74
69
00
77
64
64

6C
00
64
65
65
65
73
00
00
6F
6F

6C
00
6C
74
74
54
74
00
00
77
77

00
47
65
56
53
68
65
47
00
41
00

00
65
41
65
74
72
72
65
47
00
00

55
74
00
72
61
65
43
74
65
00
00

53
50
00
73
72
61
6C
53
74
00
53

45
72
00
69
74
64
61
79
44
47
65

52
6F
4C
6F
75
00
73
73
43
65
74

33
63
6F
6E
70
00
73
74
00
74
50

32
41
61
00
49
00
45
65
00
4D
69

2E
64
64
00
6E
44
78
6D
00
65
78

64
64
4C
00
66
65
41
4D
52
73
65

6C
72
69
47
6F
66
00
65
65
73
6C

[VProtector
signature =
6F 74 65 63
00 00 00 00

->
00
74
00

vcasm]
00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72
5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00
-320-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[VProtector -> vcasm]
signature = 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C
6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72
65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F
ep_only = false
[VProtector 1:0X -> vcasm]
signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB
01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83
ep_only = true
[vprotector 1:2 -> vcasm (h)]
signature = EB 0B 5B 56 50 72
00 80 75 08 8B 64 24 08 EB 04
00 00 00 EB 12 FF 9C 74 03 75
E6 E8 16 00 00 00 8B 5C 24 0C
00 00 00 00 64 89 25 00 00 00
07 50 C3 FF 35 E8 16 00 00 00
14 64 FF 35 00 00 00 00 64 89
01 E9 83 C0 07 50 C3 FF 35 33
83 64 FF 35 00 00 00 00 64 89
00 83 C4 04 E8 08 00 00 00 0F
ep_only = true

6F
58
01
8B
00
8B
25
F6
25
01

74
EB
E9
A3
33
5C
00
E8
00
83

65
0C
81
C4
C9
24
00
10
00
C0

63
E9
0C
00
99
0C
00
00
00

74
64
24
00
F7
8B
00
00
00

5D
8F
00
00
F1
A3
33
00
AD

00
05
01
64
E9
C4
C9
8B
CD

E8
00
00
8F
E8
00
99
64
20

24
00
00
05
03
00
F7
24
E8

00
00
9D
00
00
00
F1
08
05

00
00
90
00
00
64
E9
64
00

00
74
EB
00
00
8F
E8
8F
00

8B
F3
F4
00
C7
05
03
05
00

44
75
64
83
84
00
00
00
0F

24
F1
89
C4
00
00
00
00
01

04
EB
25
04
58
00
00
00
EB

8B
24
00
EB
EB
00
C7
00
05

00
64
00
14
01
83
84
58
E8

3D
FF
00
64
E9
C4
00
EB
EB

04
35
00
FF
83
04
58
13
FB

00
00
EB
35
C0
EB
EB
C7
00

[vprotector 1:2 -> vcasm]

signature = EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00
00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00
00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00
ep_only = false
[vprotector 1:3 -> vcasm]
signature = E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68
ep_only = true
[VProtector V0:X-V1:2X -> vcasm * Sign:By:fly]
signature = 00 00 56 69 72 74 75 61 6C 41 6C 6C
6F 74 65 63 74 5F ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00
C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00
09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8
00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1
C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50
ep_only = false

6F
00
00
AD
1F
EB
C3

63
00
8B
CD
00
05

00
00
64
20
00
EB

00
00
24
EB
00
F9

00
00
08
01
EB
EB

00
00
64
0F
FA
F0

00
00
8F
31
E8
D6

76
00
05
F0
16
E8

63
00
00
EB
00
07

61
00
00
0C
00
00

73
00
00
33
00
00

6D
00
00
C8
E9
00

5F
00
58
EB
EB
C7

70
00
EB
03
F8
83

72
00
13
EB
00
83

[VProtector V1:0 [Build 2004:12:13]

signature = 55 8B EC 6A FF 68 1A 89 40 00 68 56 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50
ep_only = true
[VProtector V1:0A -> vcasm]
signature = 55 8B EC 6A FF 68 8A 8E 40 00 68 C6 8E 40 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50
ep_only = true
[VProtector V1:0B -> vcasm]
signature = 55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50
ep_only = true

-321-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[VProtector V1:0D -> vcasm]

signature = 55 8B EC 6A FF 68 CA 31 41 00 68 06 32 41 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50
ep_only = true
[VProtector V1:0E -> vcasm]
signature = EB 0A 5B 56 50 72 6F 74 65 63 74 5D E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00
80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00
00 00
ep_only = true
[VProtector V1:0X
signature = 55 8B
00 00 E8 03 00 00
01 E9 83 C0 07 50
E9 50 C3 E8 B9 04
E8 F2 FF FF FF 0F
59 74 05 75 F8 51
C4 04 EB 14 64 FF
ep_only = true

->
EC
00
C3
00
B9
EB
35

vcasm
6A FF
C7 84
FF 35
00 00
49 75
F1 E8
00 00

* Sign:By:fly]
68 ?? ?? ?? ??
00 58 EB 01 E9
E8 07 00 00 00
E8 1F 00 00 00
F1 EB 05 EB F9
16 00 00 00 8B
00 00 64 89 25

68
83
C7
EB
EB
5C
00

??
C0
83
FA
F0
24
00

??
07
83
E8
D6
0C
00

??
50
C0
16
EB
8B
00

??
C3
13
00
01
A3
33

64
FF
EB
00
0F
C4
C9

A1
35
0B
00
31
00
99

00
E8
58
E9
F0
00
F7

00
03
EB
EB
EB
00
F1

00
00
02
F8
0C
64
E9

00
00
CD
00
33
8F
E8

50
00
20
00
C8
05
05

64
C7
83
58
EB
00
00

89
84
C0
EB
03
00
00

25
00
02
09
EB
00

00
58
EB
0F
09
00

00
EB
01
25
0F
83

[VProtector V1:1 -> vcasm]

signature = B8 1A ED 41 00 B9 EC EB 41 00 50 51 E8 74 00 00 00 E8 51 6A 00 00 58 83 E8 10 B9
B3 00 00 00
ep_only = true
[VProtector V1:1A -> vcasm]
signature = EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00
00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00
ep_only = true
[VProtector V1:1A-V1:2 -> vcasm * Sign:By:fly]
signature = 00 00 56 69 72 74 75 61 6C 41 6C 6C
6F 74 65 63 74 5F 32 30 30 35 5F 33 5F 31 38 00
00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00
83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD
0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F
58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB
13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3
ep_only = false

6F
00
8B
CD
00
05

63
00
64
20
00
EB

00
00
24
EB
00
F9

00
00
08
01
EB
EB

00
00
64
0F
FA
F0

00
00
8F
31
E8
D6

00
00
05
F0
16
E8

76
00
00
EB
00
07

63
00
00
0C
00
00

61
00
00
33
00
00

73
00
00
C8
E9
00

6D
00
58
EB
EB
C7

5F
00
EB
03
F8
83

70
00
13
EB
00
83

72
00
C7
09
00
C0

[VProtector V1:1A-V1:2 -> vcasm]

signature = 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72
6F 74 65 63 74 5F 32 30 30 35 5F 33 5F 31 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00
ep_only = true
[VProtector V1:1X
signature = EB 0B
00 80 75 08 8B 64
00 00 00 EB 12 FF
E6 E8 16 00 00 00
00 00 00 00 64 89
07 50 C3 FF 35 E8
14 64 FF 35 00 00
01 E9 83 C0 07 50
ep_only = true

->
5B
24
9C
8B
25
16
00
C3

vcasm
56 50
08 EB
74 03
5C 24
00 00
00 00
00 64

* Sign:By:fly]
72 6F 74 65 63
04 58 EB 0C E9
75 01 E9 81 0C
0C 8B A3 C4 00
00 00 33 C9 99
00 8B 5C 24 0C
89 25 00 00 00

[VProtector
signature =
00 00 00 00
00 00 00 6B

->
00
00
6E

vcasm
00 00
00 00
65 6C

* Sign:By:fly]
?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00
00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00
33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65

V1:3X
00 00
00 00
65 72

74
64
24
00
F7
8B
00

5D
8F
00
00
F1
A3
33

00
05
01
64
E9
C4
C9

-322-

E8
00
00
8F
E8
00
99

24
00
00
05
03
00
F7

00
00
9D
00
00
00
F1

00
00
90
00
00
64
E9

00
74
EB
00
00
8F
E8

8B
F3
F4
00
C7
05
03

44
75
64
83
84
00
00

24
F1
89
C4
00
00
00

04
EB
25
04
58
00
00

8B
24
00
EB
EB
00
C7

00
64
00
14
01
83
84

3D
FF
00
64
E9
C4
00

04
35
00
FF
83
04
58

00
00
EB
35
C0
EB
EB

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

4D
B4
FF
02

04 August 2015 15:14

73 73 00 00 00 47
72 61 72 79 41 00
E8 A9 00 00 00 0F
0F 83 37 00 00 00
ep_only = false

65
60
83
C6

74
8B
F1
C3

6F
24
FF
41

64
24
FF
C6

75
00
33
C0

6C
00
C9
10

65
00
E8
E8

48
8B
9C
7D

61
BC
00
00

6E
24
00
00

64
28
00
00

6C
00
0F
10

65
00
83
C0

41
00
2D
0F

00
FC
00
83

00
C6
00
F3

00
C2
00
FF

4C
80
33
FF

6F 61 64 4C 69 62
33 DB A4 C6 C3 02
C0 E8 8F 00 00 00
FF

[VProtector V1:3X
signature = E9 B9
FF 00 00 68 ?? ??
00 00 C2 10 68 ??
68 ?? ?? ?? ?? 9C
10 68 ?? ?? ?? ??
?? ?? 9C 81 ?? ??
FF 00 00 68 ?? ??
?? ?? ?? ?? 9C 81
ep_only = true

->
16
??
??
81
9C
??
??
??

vcasm
00 00
?? 9C
?? ??
?? ??
81 ??
?? ??
?? 9C
?? ??

* Sign:By:fly]
55 8B EC 81 EC
81 ?? ?? ?? ??
9C 81 ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
?? ?? ?? ?? ??
81 ?? ?? ?? ??
?? ?? ?? ?? ??

74
??
??
??
??
9D
??
??

04
??
??
??
??
54
??
??

00
??
??
??
??
FF
??
9D

00
??
??
9D
??
14
??
54

57
??
??
54
9D
24
??
FF

68
??
??
FF
54
68
??
14

00
9D
??
14
FF
00
9D
24

00
54
9D
24
14
00
54
68

00
FF
54
68
24
00
FF
00

00
14
FF
00
68
00
14
00

68
24
14
00
00
68
24
00

00
68
24
00
00
00
68
00

[VProtector V1:3X
signature = E9 B9
FF 00 00 68 ?? ??
00 00 C2 10 68 ??
ep_only = true

->
16
??
??

vcasm]
00 00 55 8B EC 81 EC 74 04 00 00 57 68 00 00 00 00 68 00 00 C2 14 68 FF
?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68 00 00 00 00 68
?? ?? 9C 81 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9D 54 FF 14 24 68

[VProtector V1:3X
signature = 00 00
00 00 00 00 00 00
00 00 00 00 00 00
ep_only = false

->
00
00
4B

vcasm]
00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00
47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00

00
00
68
00
00
00
00

C2
00
00
68
00
C2
00

14
00
00
FF
68
14
00

68
00
00
FF
??
68
00

FF
68
00
C2
??
FF
68

[Vterminal V1:0X -> Lei Peng]

signature = E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C 50 C2 04 00
ep_only = true
[Vx< ACME (Clonewar Mutant)]
signature = FC AD 3D FF FF 74 20 E6 42 8A C4 E6 42 E4 61 0C 03 E6 61 AD B9 40 1F E2 FE
ep_only = true
[Vx< Agiplan:1536]
signature = E9 J1 J1 50 B0 ?? BA ?? ?? EE BA ?? ?? EC 3C ?? 76 ?? E9 ?? ?? B8 ?? ?? CD 21 8C
D8 8E C0 83 ?? ?? 75 ?? E9 ?? ?? BA ?? ?? B8 ?? ?? CD 21 B8 ?? ?? CD 21
ep_only = true
[Vx< ARCV:4]
signature = E8 00 00 5D 81 ED 06 01 81 FC 4F 50 74 0B 8D B6 86 01 BF 00 01 57 A4 EB 11 1E 06
ep_only = true
[Vx< August 16th (Iron Maiden)]
signature = BA 79 02 03 D7 B4 1A CD 21 B8 24 35 CD 21 5F 57 89 9D 4E 02 8C 85 50 02
ep_only = true
[Vx< Backfont:900]
signature = E8 ?? ?? B4 30 CD 21 3C 03 ?? ?? B8 ?? ?? BA ?? ?? CD 21 81 FA ?? ?? ?? ?? BA ??
?? 8C C0 48 8E C0 8E D8 80 ?? ?? ?? 5A ?? ?? 03 ?? ?? ?? 40 8E D8 80 ?? ?? ?? 5A ?? ?? 83
ep_only = true
[Vx< Caterpillar:1575]
signature = EB J3 06 1E 8C C0 0E 1F 0E 07 A3 ?? ?? 8C D0 A3 ?? ?? B0 ?? E6 20 FC ?? C0 8E D8
?? F6 BF ?? ?? B9 ?? ?? F2 A4 1E 17
ep_only = true
[Vx< Caz:1204]
signature = E8 ?? ?? 5E 83 EE 03 1E 06 B8 FF FF CD 2F 3C 10
-323-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[Vx< CIH Version 1:2 TTIT (> WIN95CIH >)]
signature = 55 8D ?? ?? ?? 33 DB 64 87 03 E8 ?? ?? ?? ?? 5B 8D
ep_only = true
[Vx< Compiler]
signature = 8C C3 83 C3 10 2E 01 1E ?? 02 2E 03 1E ?? 02 53 1E
ep_only = true
[Vx< Danish tiny]
signature = 33 C9 B4 4E CD 21 73 02 FF ?? BA ?? 00 B8 ?? 3D CD 21
ep_only = true
[Vx< Doom:666]
signature = E8 ?? ?? ?? 5E 83 EE ?? B8 CF 7B CD 21 3D CF 7B ?? ?? 0E 1F 81 C6 ?? ?? BF ?? ??
B9 ?? ?? FC F3 A4 06 1F 06 B8 ?? ?? 50 CB B4 48 BB 2C 00 CD 21
ep_only = true
[Vx< Eddie:1028]
signature = E8 ?? ?? 5E FC 83 ?? ?? 81 ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ??
?? ?? ?? 50 06 56 1E B8 FE 4B CD 21 81 FF BB 55 ?? ?? 07 ?? ?? ?? 07 B4 49 CD 21 BB FF FF B4
48 CD 21
ep_only = true
[Vx< Eddie:1530]
signature = E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B
?? ?? ?? ?? ?? 2E ?? ?? ?? ?? 50 06 56 1E 33 C0 50 1F C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E
ep_only = true
[Vx< Eddie:1800]
signature = E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B
?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E
ep_only = true
[Vx< Eddie:2000]
signature = E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81
C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C5 ?? ?? ?? B4 30 CD 21
ep_only = true
[Vx< Eddie:2100]
signature = E8 ?? ?? 4F 4F 0E E8 ?? ?? 47 47 1E FF ?? ?? CB E8 ?? ?? 84 C0 ?? ?? 50 53 56 57
1E 06 B4 51 CD 21 8E C3 ?? ?? ?? ?? ?? ?? ?? 8B F2 B4 2F CD 21 AC
ep_only = true
[Vx< Eddie:based:1745]
signature = E8 ?? ?? 5E 81 EE ?? ?? FC ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA ?? 8B E6 81 ?? ?? ??
FB ?? 3B ?? ?? ?? ?? ?? 50 06 ?? 56 1E 8B FE 33 C0 ?? 50 8E D8
ep_only = true
[Vx< Einstein]
signature = 00 42 CD 21 72 31 B9 6E 03 33 D2 B4 40 CD 21 72 19 3B C1 75 15 B8 00 42
ep_only = true
[Vx< EVC:161]
signature = E9 J1 J1 06 FA 33 DB 8E C3 26 ?? ?? ?? ?? 8F ?? ?? ?? 26 ?? ?? ?? ?? 8F ?? ?? ??
B8 21 25 BA ?? ?? CD 21 FB 07 BA ?? ?? CD 27
ep_only = true
[Vx< Explosion:1000]
signature = E8 ?? ?? 5E 1E 06 50 81 ?? ?? ?? 56 FC B8 21 35 CD 21 2E ?? ?? ?? ?? 2E ?? ?? ??
?? 26 ?? ?? ?? ?? ?? ?? 74 ?? 8C D8 48 8E D8
-324-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[Vx< FaxFree:Topo]
signature = FA 06 33 C0 8E C0 B8 ?? ?? 26 ?? ?? ?? ?? 50 8C C8 26 ?? ?? ?? ?? 50 CC 58 9D 58
26 ?? ?? ?? ?? 58 26 ?? ?? ?? ?? 07 FB
ep_only = true
[Vx< Gotcha:879]
signature = E8 ?? ?? 5B 81 EB ?? ?? 9C FC 2E ?? ?? ?? ?? ?? ?? ?? 8C D8 05 ?? ?? 2E ?? ?? ??
?? 50 2E ?? ?? ?? ?? ?? ?? 8B C3 05 ?? ?? 8B F0 BF 00 01 B9 20 00 F3 A4 0E B8 00 01 50 B8 DA
DA CD 21
ep_only = true
[Vx< Grazie:883]
signature = 1E 0E 1F 50 06 BF 70 03 B4 1A BA 70 03 CD 21 B4 47 B2 00 BE 32 04 CD 21
ep_only = true
[Vx< GRUNT:1:Family]
signature = 01 B9 ?? 00 31 17
ep_only = true
[Vx< GRUNT:2:Family]
signature = 48 E2 F7 C3 51 53 52 E8 DD FF 5A 5B 59 C3 B9 00 00 E2 FE C3
ep_only = true
[Vx< GRUNT:4:Family]
signature = E8 1C 00 8D 9E 41 01 40 3E 8B 96 14 03 B9 EA 00 87 DB F7 D0 31 17 83 C3 02 E2 F7
C3
ep_only = true
[Vx< Hafen:1641]
signature = E8 ?? ?? 01 ?? ?? ?? CE CC 25 ?? ?? 25 ?? ?? 25 ?? ?? 40 51 D4 ?? ?? ?? CC 47 CA
?? ?? 46 8A CC 44 88 CC
ep_only = true
[Vx< Hafen:809]
signature = E8 ?? ?? 1C ?? 81 EE ?? ?? 50 1E 06 8C C8 8E D8 06 33 C0 8E C0 26 ?? ?? ?? 07 3D
ep_only = true
[Vx< Haryanto]
signature = 81 EB 2A 01 8B 0F 1E 5B 03 CB 0E 51 B9 10 01 51 CB
ep_only = true
[Vx< Heloween:1172]
signature = E8 ?? ?? 5E 81 EE ?? ?? 56 50 06 0E 1F 8C C0 01 ?? ?? 01 ?? ?? 80 ?? ?? ?? ?? 8B
?? ?? A3 ?? ?? 8A ?? ?? A2 ?? ?? B8 ?? ?? CD 21 3D
ep_only = true
[Vx< Horse:1776]
signature = E8 ?? ?? 5D 83 ?? ?? 06 1E 26 ?? ?? ?? ?? BF ?? ?? 1E 0E 1F 8B F7 01 EE B9 ?? ??
FC F3 A6 1F 1E 07
ep_only = true
[Vx< Hymn:1865]
signature = E8 ?? ?? 5E 83 EE 4C FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 ?? ?? ?? FB 3B ??
?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 50 06 56 1E 0E 1F B8 00 C5 CD 21
ep_only = true
[Vx< Igor]
signature = 1E B8 CD 7B CD 21 81 FB CD 7B 75 03 E9 87 00 33 DB 0E 1F 8C
ep_only = true

-325-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Vx< Involuntary:1349]
signature = ?? BA ?? ?? B9 ?? ?? 8C DD ?? 8C C8 ?? 8E D8 8E C0 33 F6 8B FE FC ?? ?? AD ?? 33
C2 AB
ep_only = true
[Vx< KBDflags:1024]
signature = 8B EC 2E 89 2E 24 03 BC 00 04 8C D5 2E 89 2E 22
ep_only = true
[Vx< Keypress:1212]
signature = E8 ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EA ?? ??
?? ?? 1E 33 DB 8E DB BB
ep_only = true
[Vx< Kuku:448]
signature = AE 75 ED E2 F8 89 3E ?? ?? BA ?? ?? 0E 07 BF ?? ?? EB
ep_only = true
[Vx< Kuku:886]
signature = 06 1E 50 8C C8 8E D8 BA 70 03 B8 24 25 CD 21 ?? ?? ?? ?? ?? 90 B4 2F CD 21 53
ep_only = true
[Vx< Lehigh:555]
signature = E9 J1 J1 E8 ?? ?? 5E 83 ?? ?? 8B DE 81 ?? ?? ?? 53 81 ?? ?? ?? B4 19 CD 21 ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B4 4A CD 21
ep_only = true
[Vx< Lucee:1888]
signature = E9 J1 J1 E8 ?? ?? 5E 83 ?? ?? FC 50 53 B8 ?? ?? CD 21 3D ?? ?? 75 ?? E9
ep_only = true
[Vx< Manuel:based]
signature = E9 J1 J1 0E B8 ?? ?? 50 06 1E 55 E8 ?? ?? 43 60 14 ?? 02 E9 53 0C 00 ?? ?? ?? ??
?? ?? 5D 83 ?? ?? 8D ?? ?? ?? BF ?? ?? A5 A4 B4 ?? CD 21
ep_only = true
[Vx< Mh:757]
signature = E9 J1 J1 B8 ?? ?? CD 21 3C 07 75 ?? FB B8 ?? ?? CD 21 8C C8 48 8E C0 26 ?? ?? ??
?? ?? 74 ?? B4 ?? BB ?? ?? CD 21 81 ?? ?? ?? 72 ?? B4 ?? CD 21 72 ?? 48 8E C0 FA
ep_only = true
[Vx< Modification of Hi:924]
signature = 50 53 51 52 1E 06 9C B8 21 35 CD 21 53 BB ?? ?? 26 ?? ?? 49 48 5B
ep_only = true
[Vx< MTE (non-encrypted)]
signature = F7 D9 80 E1 FE 75 02 49 49 97 A3 ?? ?? 03 C1 24 FE 75 02 48
ep_only = true
[Vx< Ncu-Li:1688]
signature = 0E 1E B8 55 AA CD 21 3D 49 4C 74 ?? 0E 0E 1F 07 E8
ep_only = true
[Vx< Necropolis:1963]
signature = B4 30 CD 21 3C 03 ?? ?? B8 00 12 CD 2F 3C FF B8 ?? ?? ?? ?? B4 4A BB 40 01 CD 21
?? ?? FA 0E 17 BC ?? ?? E8 ?? ?? FB A1 ?? ?? 0B C0
ep_only = true
[Vx< Necropolis]
signature = 50 FC AD 33 C2 AB 8B D0 E2 F8
ep_only = true

-326-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Vx< Noon:1163]
signature = E8 ?? ?? 5B 50 56 B4 CB CD 21 3C 07 ?? ?? 81 ?? ?? ?? 2E ?? ?? 4D 5A ?? ?? BF 00
01 89 DE FC
ep_only = true
[Vx< November 17:768]
signature = E8 ?? ?? 5E 81 EE ?? ?? 50 33 C0 8E D8 80 3E ?? ?? ?? 0E 1F ?? ?? FC
ep_only = true
[Vx< Number One]
signature = F9 07 3C 53 6D 69 6C 65 3E E8
ep_only = true
[Vx< Payback:dropper]
signature = E9 J1 J1 B9 ?? ?? B8 ?? ?? BE ?? ?? 49 78 ?? 30 04 86 E0 D3 C8 4E EB
ep_only = true
[Vx< Phoenix:927]
signature = E8 00 00 5E 81 C6 ?? ?? BF 00 01 B9 04 00 F3 A4 E8
ep_only = true
[Vx< Predator:2448]
signature = 0E 1F BF ?? ?? B8 ?? ?? B9 ?? ?? 49 ?? ?? ?? ?? 2A C1 4F 4F ?? ?? F9 CC
ep_only = true
[Vx< Quake:518]
signature = 1E 06 8C C8 8E D8 ?? ?? ?? ?? ?? ?? ?? B8 21 35 CD 21 81
ep_only = true
[Vx< Raubkopie:2219]
signature = E9 J1 J1 8C D0 2E ?? ?? ?? 2E ?? ?? ?? ?? 8C C8 8E D0 BC ?? ?? 1E 8E D8 58 A3 ??
?? E8 ?? ?? 8C C8 8E C0 E8 ?? ?? BA ?? ?? B4 1A CD 21
ep_only = true
[Vx< SK]
signature = CD 20 B8 03 00 CD 10 51 E8 00 00 5E 83 EE 09
ep_only = true
[Vx< Slowload]
signature = 03 D6 B4 40 CD 21 B8 02 42 33 D2 33 C9 CD 21 8B D6 B9 78 01
ep_only = true
[Vx< Sonik Youth]
signature = 8A 16 02 00 8A 07 32 C2 88 07 43 FE C2 81 FB
ep_only = true
[Vx< Spanz]
signature = E8 00 00 5E 81 EE ?? ?? 8D 94 ?? ?? B4 1A CD 21 C7 84
ep_only = true
[Vx< SYP]
signature = 47 8B C2 05 1E 00 52 8B D0 B8 02 3D CD 21 8B D8 5A
ep_only = true
[Vx< TravJack:883]
signature = EB ?? 9C 9E 26 ?? ?? 51 04 ?? 7D ?? 00 ?? 2E ?? ?? ?? ?? 8C C8 8E C0 8E D8 80 ??
?? ?? ?? 74 ?? 8A ?? ?? ?? BB ?? ?? 8A ?? 32 C2 88 ?? FE C2 43 81
ep_only = true
[Vx< Trivial:25]
signature = B4 4E FE C6 CD 21 B8 ?? 3D BA ?? 00 CD 21 93 B4 40 CD
ep_only = true
-327-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[Vx< Trivial:46]
signature = B4 4E B1 20 BA ?? ?? CD 21 BA ?? ?? B8 ?? 3D CD 21
ep_only = true
[Vx< Trojan:Format]
signature = E9 J1 J1 B4 2A CD 21 81 F9 ?? ?? 72 ?? 80 FE ?? 72 ?? 80 FA ?? 72 ?? B8 ?? ?? BB
ep_only = true
[Vx< Trojan:Shock]
signature = E9 J1 J1 BE ?? ?? E8 ?? ?? B2 00 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? BE ?? ?? E8 ?? ??
B8 00 4C CD 21 ?? 50 52 AC
ep_only = true
[Vx< Trojan:Surprice]
signature = E9 J1 J1 BF ?? ?? 8B ?? ?? 8D ?? ?? ?? B9 ?? ?? 81 ?? ?? ?? AD E2
ep_only = true
[Vx< Trojan:Telefoon]
signature = 60 1E E8 3B 01 BF CC 01 2E 03 3E CA 01 2E C7 05
ep_only = true
[Vx< Uddy:2617]
signature = 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? 8C C8 8E D8 8C ?? ?? ?? 2B ?? ??
?? 03 ?? ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? 8C C8 2B ?? ?? ?? 03 ?? ?? ?? A3
?? ?? B8 AB 9C CD 2F 3D 76 98
ep_only = true
[Vx< VCL (encrypted)]
signature = 01 B9 ?? ?? 81 34 ?? ?? 46 46 E2 F8 C3
ep_only = true
[Vx< VCL (encrypted)]
signature = 01 B9 ?? ?? 81 35 ?? ?? 47 47 E2 F8 C3
ep_only = true
[Vx< VCL]
signature = AC B9 00 80 F2 AE B9 04 00 AC AE 75 ?? E2 FA 89
ep_only = true
[Vx< VirusConstructor(IVP):based]
signature = E9 ?? ?? E8 ?? ?? 5D ?? ?? ?? ?? ?? 81 ED ?? ?? ?? ?? ?? ?? E8 ?? ?? 81 FC ?? ??
?? ?? 8D ?? ?? ?? BF ?? ?? 57 A4 A5
ep_only = true
[Vx< VirusConstructor:based]
signature = E8 ?? ?? 5D 81 ?? ?? ?? 06 1E E8 ?? ?? E8 ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B4 4A
BB FF FF CD 21 83 ?? ?? B4 4A CD 21
ep_only = true
[Vx< VirusConstructor:based]
signature = BB ?? ?? B9 ?? ?? 2E ?? ?? ?? ?? 43 43 ?? ?? 8B EC CC 8B ?? ?? 81 ?? ?? ?? 06 1E
B8 ?? ?? CD 21 3D ?? ?? ?? ?? 8C D8 48 8E D8
ep_only = true
[Vx< XPEH:4768]
signature = E8 ?? ?? 5B 81 ?? ?? ?? 50 56 57 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B8 01 00
50 B8 ?? ?? 50 E8
ep_only = true
[Vx< XRCV:1015]
signature = E8 ?? ?? 5E 83 ?? ?? 53 51 1E 06 B4 99 CD 21 80 FC 21 ?? ?? ?? ?? ?? 33 C0 50 8C
-328-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

D8 48 8E C0 1F A1 ?? ?? 8B
ep_only = true
[Vx< Zherkov:2968]
signature = E9 J1 J1 EB ?? ?? ?? ?? 53 51 52 57 06 1E E8 ?? ?? 5E 2E ?? ?? ?? 3C 00 74 ?? 8B
FE 83
ep_only = true
[W32:Jeefo (PE File Infector)]
signature = 55 89 E5 83 EC 08 83 C4 F4 6A 02 A1 C8 ?? ?? ?? FF D0 E8 ?? ?? ?? ?? C9 C3
ep_only = true
[WARNING -> TROJAN -> ADinjector]
signature = 90 61 BE 00 20 44 00 8D BE 00 F0 FB FF C7 87 9C E0 04 00 6A F0 8A 5E 57 83 CD FF
EB 0E
ep_only = true
[WARNING -> TROJAN -> HuiGeZi]
signature = 55 8B EC 81 C4 ?? FE FF FF 53 56 57 33 C0 89 85 ?? FE FF FF
ep_only = true
[WARNING -> TROJAN -> RobinPE]
signature = 60 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00
ep_only = true
[WARNING -> TROJAN -> XiaoHui]
signature = 60 9C E8 00 00 00 00 5D B8 ?? 85 40 00 2D ?? 85 40 00
ep_only = true
[Warning> may be SimbyOZ polycryptor by 3xpl01t ver 2:xx (25:03:2007 22<00)]
signature = 57 57 8D 7C 24 04 50 B8 00 D0 17 13 AB 58 5F C3 00 00
ep_only = true
[WATCOM C 1988; 1989; 1990]
signature = E9 J1 J1 FB 8C C9 BB ?? ?? 8E C1 26 ?? ?? ?? ?? 26 ?? ?? ?? 3D ?? ?? 73 ?? B8 ??
?? 03 D8 8E D1 8B E3 26 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 8B D3 D1 EA D1 EA D1 EA D1 EA 8B ?? ??
?? 8C C0 2B C8 3B D1
ep_only = true
[WATCOM C 1991]
signature = E9 J1 J1 FB B9 ?? ?? 8E C1 BB ?? ?? 83 ?? ?? 83 E3 ?? 26 89 1E ?? ?? 26 8C 1E ??
?? 03 DC
ep_only = true
[WATCOM C Protected Mode (386; 486) 1988-92]
signature = E9 J1 J1 FB B9 ?? ?? 8E C1 BB ?? ?? 83 ?? ?? 80 ?? ?? 26 89 ?? ?? ?? 26 8C ?? ??
?? 03 DC
ep_only = true
[WATCOM C Protected Mode (386; 486) 1988-92]
signature = E9 J1 J1 FB B9 ?? ?? 8E C1 BB ?? ?? 83 ?? ?? 8? ?? ?? 26 89 ?? ?? ?? 26 8C ?? ??
?? 03 DC
ep_only = true
[WATCOM C/C++ 16 1994]
signature = E9 J1 J1 FB B9 ?? ?? 8E C1 26 BB ?? ?? 83 ?? ?? 80 E3 ?? 26 89 1E ?? ?? 26 8C 1E
?? ?? 01 E3
ep_only = true
[WATCOM C/C++ 32 Run-Time System 1988-1994]
signature = FB 83 ?? ?? 89 E3 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ??
?? BB ?? ?? ?? ?? 29 C0 B4 30 CD 21
-329-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[WATCOM C/C++ 32 Run-Time System 1988-1995]
signature = E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D ?? 43 2F 43 2B 2B 33 32 ?? 52 75
ep_only = true
[WATCOM C/C++ 32 Run-Time System 1988-1995]
signature = E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E
2D 54
ep_only = true
[WATCOM C/C++ 32 Run-Time System 1989; 1994]
signature = 0E 1F 8C C6 B4 ?? 50 BB ?? ?? CD 21 73 ?? 58 CD 21 72
ep_only = true
[WATCOM C/C++ DLL]
signature = 53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87
ep_only = true
[WATCOM C/C++ Run-Time system+DOS4GW DOS Extender 1988-93]
signature = BF ?? ?? 8E D7 81 C4 ?? ?? BE ?? ?? 2B F7 8B C6 B1 ?? D3
ep_only = true
[WATCOM C/C++]
signature = E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41
ep_only = true
[Watcom C/C++]
signature = E9 ?? ?? 00 00 03 10 40 00 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E
2D 54 69 6D 65 20 73 79 73 74 65 6D 2E 20 28 63 29 20 43 6F 70 79 72 69 67 68 74 20 62 79 20
57 41 54 43 4F 4D 20 49 6E 74 65 72 6E 61 74 69 6F 6E 61 6C 20 43 6F 72 70 2E 20
ep_only = false
[Watcom C/C++]
signature = E9 ??
2D 54 69 6D 65 20
57 41 54 43 4F 4D
2D 31 39 39 35 2E
00 00
ep_only = false

??
73
20
20

00
79
49
41

00
73
6E
6C

03
74
74
6C

10
65
65
20

40
6D
72
72

00
2E
6E
69

57
20
61
67

41
28
74
68

54
63
69
74

43
29
6F
73

4F
20
6E
20

4D
43
61
72

20
6F
6C
65

43
70
20
73

2F
79
43
65

43
72
6F
72

2B
69
72
76

2B
67
70
65

33
68
2E
64

32
74
20
2E

20
20
31
00

52
62
39
00

75
79
38
00

6E
20
38
00

00
40
00
00

00
00
FF
00

00
FF
25
00

FF
25
A8
00

[WebCops [DLL]
signature = A8 BE 58 DC D6 CC C4 63 4A 0F E0 02 BB CE F3 5C 50 23 FB 62 E7 3D 2B
ep_only = true
[WebCops [EXE]
signature = EB 03 05 EB 02 EB FC 55 EB 03 EB 04 05 EB FB EB 53 E8 04 00 00 00 72
ep_only = true
[Werus Crypter 1:0 -> Kas]
signature = 68 98 11 40 00
25 80 10 40 00 FF 25 84 10
94 10 40 00 FF 25 98 10 40
10 40 00 FF 25 B0 10 40 00
00 00 00 00 00 00 00 00 00
ep_only = false

6A
40
00
00
00

00
00
FF
00
00

E8
FF
25
00
00

50
25
9C
00
BB

00
88
10
00
E8

00
10
40
00
12

00
40
00
00
40

C9
00
FF
00
00

C3
FF
25
00
80

ED
25
A0
00
33

B3
8C
10
00
05

FE
10
40
00
E9

FF
40
00
00
7D

FF
00
FF
00
FF

6A
FF
25
00
FF

00
25
A4
00
FF

E8
90
10
00

0C
10
40
00

[Werus Crypter 1:0 -> Kas]

signature = 68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF
25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25
94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40
ep_only = false
-330-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[WIBU-Key V4:10A -> WIBU-SYSTEMS AG > Sign by fly]

signature = F7 05 ?? ?? ?? ?? FF 00 00 00 75 12
ep_only = true
[Wind of Crypt
signature = 55
68 CE 51 00 10
EC 33 C0 E8 F6
ep_only = true

1:0 8B EC
64 ??
DB FF

by
83
??
FF

DarkPressure]
C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 64 40 00 10 E8 28 EA FF FF 33 C0 55
?? ?? 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55
8B 45 EC E8 12 E7 FF FF 50 E8 3C EA FF FF 8B D8 83 FB FF

[Windows Animation format]

signature = 52 49 46 46 ?? ?? ?? ?? 41 43 4F 4E 4C 49 53 54
ep_only = false
[Windows Type 1 font metric file]
signature = 00 01 ?? ?? 00 00 43 6F 70 79 72 69 67 68 74 20
ep_only = false
[WinKript 1:0 -> Mr:
signature = 33 C0 8B
C8 04 34 1B 88 04 39
00 00 00 00 00 00 00
ep_only = false
[WinKript v1:0
signature = 33
C8 04 34 1B 88
00 00 00 00 00
ep_only = true

->
C0
04
00

Crimson (h)]
B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0
41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Mr: Crimson
8B B8 00 ??
39 41 3B CA
00 00 00 00

(h)]
?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0
72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

[Winkript v1:0]
signature = 33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0
C8 04 34 1B 88 04 39 41 3B CA 72 F0 58
ep_only = true
[WinRAR 32-bit SFX Module]
signature = E9 ?? ?? 00 00 00 00 00 00 90 90 90 ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? FF
ep_only = true
[WinUpack v0:30 beta -> By Dwing (h)]
signature = E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00
ep_only = false
[WinUpack v0:30 beta -> By Dwing]
signature = E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02
ep_only = false
[WinUpack v0:39 final (relocated
signature = 60 E8 09 00 00 00 ??
2B D8 AD 03 C3 50 97 AD 91 F3 A5
?? F3 AB 5E AD 53 50 51 97 58 8D
0F B6 5F FF C1 E3 ?? B3 00 8D 1C
D2 84 E9 0F 95 C6 52 FE C6 8A D0
33 C9 B5 01 FF 56 08 33 C9 FF 66
FF 16 72 29 3C 07 B0 09 72 02 B0
73 0C 03 D1 FF 16 87 5D 14 73 03
0C
ep_only = true

image
?? ??
5E AD
54 85
5B 8D
8D 14
1C B1
0B 50
87 5D

base)
00 E9
56 91
5C FF
9C 9D
93 FF
30 8B
8B C7
18 3C

->
06
01
16
0C
16
5D
2B
07

By
02
1E
72
10
5A
0C
45
B0

Dwing
00 00
AD E2
57 2C
00 00
9F 12
03 D1
0C 8A
08 72

(c)2005 (h2)]
33 C9 5E 87 0E
FB AD 8D 6E 10
03 73 02 B0 00
B0 01 E3 29 8B
C0 D0 E9 74 0E
FF 16 73 4C 03
00 FF 66 18 83
02 B0 0B 50 53

E3
01
3C
D7
9E
D1
C2
8B

F4
5D
07
2B
1A
FF
60
D5

2B
00
72
55
F2
16
FF
03

F1
8D
02
0C
74
72
16
56

8B
7D
2C
8A
E4
19
87
38

DE
1C
03
2A
B4
03
5D
FF

AD
B5
50
33
00
D1
10
56

[WinUpack v0:39 final -> By Dwing (c)2005 (h1)]

signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61
-331-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

72 79 41 00 00 18 10
00 00 00 00 39 00 04
00 ?? 00 00 ?? ?? 00
EE ?? ?? ?? 14 00 00
F3 A5 FF 76 04 83 C8
00 00 ?? ?? ?? ?? ??
?? ?? ?? 56 10 E2 E3
D1 E8 13 D2 E2 FA 5D
AC FE FF FF 58 5F 59
2B C7 AB E2 E5 5E 5D
7E P_ ON LY = T RU E
ep_only = true

00
00
00
00
FF
00
B1
03
E3
59

00
00
00
00
8B
00
04
EA
1B
46

04 August 2015 15:14

10
00
10
??
DF
00
D3
45
8A
AD

00
00
00
??
AB
40
E0
59
07
85

00
00
00
??
EB
AB
03
89
47
C0

00
00
10
??
1C
40
E8
6B
04
74

00
00
00
??
00
B1
8D
08
18
1F

??
00
00
??
00
04
53
56
3C
51

??
??
00
00
00
F3
18
8B
02
56

??
??
00
FF
00
AB
33
F7
73
97

00
??
00
76
47
C1
C0
2B
F7
FF

00
00
00
38
65
E0
55
F5
8B
D1

??
02
0A
AD
74
0A
40
F3
07
93

??
00
00
50
50
B5
51
A4
3C
AC

00
00
00
8B
72
??
D3
AC
??
84

10
00
00
3E
6F
F3
E0
5E
75
C0

00
00
00
BE
63
AB
8B
B1
F3
75

00
00
00
F0
41
8B
EA
80
B0
FB

00
00
00
??
64
7E
91
AA
00
38

02
??
00
??
64
0C
FF
3B
0F
06

00
00
00
??
72
57
56
7E
C8
74

00
00
00
6A
65
51
4C
34
03
EA

04
??
00
27
73
E9
99
0F
46
8B

00
00
00
59
73
??
59
82
38
C6

[WinUpack v0:39 final -> By Dwing (c)2005

signature = BE B0 11 ?? ?? AD 50 FF 76 34
72 79 41 00 00 18 10 00 00 10 00 00 00 ??
00 00 00 00 39 00 04 00 00 00 00 00 00 00
ep_only = false

(h1)]
EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61
?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00
00 ?? ?? ?? 00 02 00 00 00 00 00 00

[WinUpack v0:39 final -> By Dwing (c)2005

signature = BE B0 11 ?? ?? AD 50 FF 76 34
72 79 41 00 00 18 10 00 00 10 00 00 00 00
00 00 00 00 39 00 04 00 00 00 00 00 00 00
00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00
EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ??
F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00
00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1
?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D
D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08
AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18
2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F
79 05 46 33 C0 66 AD 50
ep_only = true

(h1)]
EB 7C
?? ??
00 ??
00 00
?? 00
00 00
04 F3
53 18
56 8B
3C 02
51 56

48
??
??
00
FF
00
AB
33
F7
73
97

01
00
??
00
76
47
C1
C0
2B
F7
FF

??
00
00
00
38
65
E0
55
F5
8B
D1

??
??
02
0A
AD
74
0A
40
F3
07
93

0B
??
00
00
50
50
B5
51
A4
3C
AC

01
00
00
00
8B
72
??
D3
AC
??
84

4C
10
00
00
3E
6F
F3
E0
5E
75
C0

6F
00
00
00
BE
63
AB
8B
B1
F3
75

61
00
00
00
F0
41
8B
EA
80
B0
FB

64
00
00
00
??
64
7E
91
AA
00
38

4C
02
??
00
??
64
0C
FF
3B
0F
06

69
00
00
00
??
72
57
56
7E
C8
74

62
00
00
00
6A
65
51
4C
34
03
EA

72
04
??
00
27
73
E9
99
0F
46
8B

61
00
00
00
59
73
??
59
82
38
C6

[WinUpack v0:39 final -> By Dwing (c)2005

signature = BE B0 11 ?? ?? AD 50 FF 76 34
72 79 41 00 00 18 10 00 00 10 00 00 00 00
00 00 00 00 39 00 04 00 00 00 00 00 00 00
00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00
EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ??
F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00
00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1
?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D
D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08
AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18
2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F
ep_only = true

(h1)]
EB 7C
?? ??
00 ??
00 00
?? 00
00 00
04 F3
53 18
56 8B
3C 02
51 56

48
??
??
00
FF
00
AB
33
F7
73
97

01
00
??
00
76
47
C1
C0
2B
F7
FF

??
00
00
00
38
65
E0
55
F5
8B
D1

??
??
02
0A
AD
74
0A
40
F3
07
93

0B
??
00
00
50
50
B5
51
A4
3C
AC

01
00
00
00
8B
72
??
D3
AC
??
84

4C
10
00
00
3E
6F
F3
E0
5E
75
C0

6F
00
00
00
BE
63
AB
8B
B1
F3
75

61
00
00
00
F0
41
8B
EA
80
B0
FB

64
00
00
00
??
64
7E
91
AA
00
38

4C
02
??
00
??
64
0C
FF
3B
0F
06

69
00
00
00
??
72
57
56
7E
C8
74

62
00
00
00
6A
65
51
4C
34
03
EA

72
04
??
00
27
73
E9
99
0F
46
8B

61
00
00
00
59
73
??
59
82
38
C6 7

[WinUpack v0:39 final -> By Dwing (c)2005

signature = BE B0 11 ?? ?? AD 50 FF 76 34
72 79 41 00 00 18 10 00 00 10 00 00 00 ??
00 00 00 00 39 00 04 00 00 00 00 00 00 00
00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00
EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ??
F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00
00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1
?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D
D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08
AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18
2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F
79 05 46 33 C0 66 AD 50
ep_only = true

(h1)]
EB 7C
?? ??
00 ??
00 00
?? 00
00 00
04 F3
53 18
56 8B
3C 02
51 56

48
??
??
00
FF
00
AB
33
F7
73
97

01
00
??
00
76
47
C1
C0
2B
F7
FF

??
00
00
00
38
65
E0
55
F5
8B
D1

??
??
02
0A
AD
74
0A
40
F3
07
93

0B
??
00
00
50
50
B5
51
A4
3C
AC

01
00
00
00
8B
72
??
D3
AC
??
84

4C
10
00
00
3E
6F
F3
E0
5E
75
C0

6F
00
00
00
BE
63
AB
8B
B1
F3
75

61
00
00
00
F0
41
8B
EA
80
B0
FB

64
00
00
00
??
64
7E
91
AA
00
38

4C
02
??
00
??
64
0C
FF
3B
0F
06

69
00
00
00
??
72
57
56
7E
C8
74

62
00
00
00
6A
65
51
4C
34
03
EA

72
04
??
00
27
73
E9
99
0F
46
8B

61
00
00
00
59
73
??
59
82
38
C6

-332-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[WinUpack v0:39 final -> By Dwing (c)2005

signature = BE B0 11 ?? ?? AD 50 FF 76 34
72 79 41 00 00 18 10 00 00 10 00 00 00 ??
00 00 00 00 39 00 04 00 00 00 00 00 00 00
00 ?? 00 00 ?? ?? 00 00 00 10 00 00 ?? 00
EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ??
F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00
00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1
?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D
D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08
AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18
2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F
79 05 46 33
ep_only = true
[WinUpack v0:39 final -> By Dwing c)2005]
signature = BE B0 11 ?? ?? AD 50 FF 76 34
72 79 41 00 00 18 10 00 00 10 00 00 00 00
00 00 00 00 39 00 04 00 00 00 00 00 00 00
00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00
EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ??
F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00
00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1
?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D
D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08
AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18
2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F
ep_only = true

(h1)]
EB 7C
?? ??
00 ??
00 00
?? 00
00 00
04 F3
53 18
56 8B
3C 02
51 56

EB
??
00
00
??
00
04
53
56
3C
51

7C
??
??
00
00
00
F3
18
8B
02

48
??
??
00
FF
00
AB
33
F7
73
97

01
00
??
00
76
47
C1
C0
2B
F7
FF

??
00
00
00
38
65
E0
55
F5
8B
D1

??
??
02
0A
AD
74
0A
40
F3
07
93

0B
??
00
00
50
50
B5
51
A4
3C
AC

01
00
00
00
8B
72
??
D3
AC
??
84

4C
10
00
00
3E
6F
F3
E0
5E
75
C0

6F
00
00
00
BE
63
AB
8B
B1
F3
75

61
00
00
00
F0
41
8B
EA
80
B0
FB

64
00
00
00
??
64
7E
91
AA
00
38

4C
02
??
00
??
64
0C
FF
3B
0F
06

69
00
00
00
??
72
57
56
7E
C8
74

62
00
00
00
6A
65
51
4C
34
03
EA

72
04
??
00
27
73
E9
99
0F
46
8B

61
00
00
00
59
73
??
59
82
38
C6

48
??
??
00
FF
00
AB
33
F7
73

01
00
??
00
76
47
C1
C0
2B
F7

??
00
00
00
38
65
E0
55
F5
8B

??
??
02
0A
AD
74
0A
40
F3
07

0B
??
00
00
50
50
B5
51
A4
3C

01
00
00
00
8B
72
??
D3
AC
??

4C
10
00
00
3E
6F
F3
E0
5E
75

6F
00
00
00
BE
63
AB
8B
B1
F3

61
00
00
00
F0
41
8B
EA
80
B0

64
00
00
00
??
64
7E
91
AA
00

4C
02
??
00
??
64
0C
FF
3B
0F

69
00
00
00
??
72
57
56
7E
C8

62
00
00
00
6A
65
51
4C
34
03

72
04
??
00
27
73
E9
99
0F
46

61
00
00
00
59
73
??
59
82
38

[WinZip (32-bit) 6:x]

signature = FF 15 FC 81 40 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10
ep_only = true
[WinZip 32-bit SFX v6:x module]
signature = FF 15 ?? ?? ?? 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 38 08 74 06 40 80 38
00 75 F6 80 38 00 74 01 40 33 C9 ?? ?? ?? ?? FF 15
ep_only = true
[WinZip 32-bit SFX v8:x module]
signature = 53 FF 15 ?? ?? ?? 00 B3 22 38 18 74 03 80 C3 FE 8A 48 01 40 33 D2 3A CA 74 0A 3A
CB 74 06 8A 48 01 40 EB F2 38 10 74 01 40 ?? ?? ?? ?? FF 15
ep_only = true
[WinZip Self-Extractor 2:2 personal edition -> WinZip Computing (h)]
signature = 53 FF 15 58 70 40 00 B3 22 38 18 74 03 80 C3 FE 40 33 D2 8A 08 3A CA 74 10 3A CB
74 07 40 8A 08 3A CA 75 F5 38 10 74 01 40 52 50 52 52 FF 15 5C 70 40 00 50 E8 15 FB FF FF 50
FF 15 8C 70 40 00 5B
ep_only = true
[Wise Installer Stub
signature = 55 8B EC
08 89 45 E8 80 F9 22
89 45 E8 EB EE 80 38
ep_only = false

1:10:1029:1]
81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A
75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40
22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45

[Wise Installer Stub

signature = 55 8B EC
08 89 45 E8 80 F9 22
89 45 E8 EB EE 80 38
F9 2F 74 2B 84 C9 74
ep_only = true

v1:10:1029:1]
81 EC 40 0F 00
75 48 8A 48 01
22 75 04 40 89
1F 80 F9 3D 74

00
40
45
1A

53
89
E8
8A

56
45
80
48

57
E8
38
01

6A
33
20
40

-333-

04
F6
75
EB

FF
84
09
F1

15
C9
40
33

F4
74
80
F6

30
0E
38
84

40
80
20
C9

00
F9
74
74

FF
22
FA
D6

15
74
89
80

74
09
45
F9

30
8A
E8
20

40 00 8A
48 01 40
8A 08 80
74

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

[Wise Installer Stub]

signature = 55 8B EC 81
15 ?? 40 40 00 8B F8 89
74 0D 3C 22 74 09 8A 47
3F 20 74 FA 89 7D ?? 53
75 06 89 35
ep_only = false

04 August 2015 15:14

EC
7D
01
FF

??
??
47
15

??
8A
89
??

00
07
7D
40

00
3C
??
40

53
22
EB
00

56
0F
EF
80

57
85
80
3F

6A
??
3F
2F

01
00
22
89

5E
00
75
45

6A
00
04
??

04
8A
47
75

89
47
89
??

75
01
7D
8A

E8
47
??
47

FF
89
80
01

15
7D
3F
3C

??
??
20
53

40
33
75
74

40
DB
09
04

00
3A
47
3C

FF
C3
80
73

[Wise Installer Stub]

signature = 55 8B EC 81
?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ??
ep_only = true

EC
??
??
??
??
??
??

??
??
??
??
??
00
??

04
??
??
??
??
??
??

00
??
??
??
??
??
??

00
??
??
??
??
??
??

53
??
??
??
??
??
74

56
??
??
??
??
??

57
??
??
??
??
??

6A
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

??
??
??
??
??
??

FF
??
80
??
??
??

15
??
??
??
??
??

??
??
20
??
??
??

??
??
??
??
??
??

40
??
??
??
??
??

00
??
??
??
??
??

??
??
??
??
00
??

[Wise Installer Stub]

signature = 55 8B EC 81
53 FF 15 34 20 40 00 8D
20 40 00 53 53 6A 03 53
84 7B 01 00 00 8D 85 90
FF FF 68 10 30 40 00 50
00 00 00 40 50 FF D7 83
20 40 00 53 53 53 6A 04
08 81 F9 4D 5A 9A 00 74
80 00 00 7C DB 8D 4D F0
ep_only = true

EC
85
6A
FC
FF
F8
50
08
53

78
94
01
FF
15
FF
89
81
51

05
FD
8D
FF
24
89
45
F9
68

00
FF
85
50
20
45
F8
4D

00
FF
94
56
40
F4
FF
5A

53
56
FD
FF
00
0F
15
90

56
50
FF
15
53
84
1C
00

BE
8D
FF
28
68
2F
20
75

04
85
68
20
80
01
40
06

01
94
00
40
00
00
00
80

00
FD
00
00
00
00
8B
78

00
FF
00
8D
00
53
F8
04

57
FF
80
85
6A
53
C7
03

8D
50
50
98
02
53
45
74

85
FF
FF
FE
53
6A
FC
0D

94
15
D7
FF
53
02
01
FF

FD
30
83
FF
8D
53
00
45

FF
20
F8
50
85
FF
00
FC

FF
40
FF
53
98
75
00
40

56
00
89
8D
FE
FC
8D
81

33
8B
45
85
FF
FF
47
7D

DB
3D
FC
90
FF
15
01
FC

50
2C
0F
FC
68
00
8B
00

[Wise Installer Stub]

signature = 55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50
53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C
20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF
ep_only = true
[Wise Installer Stub]
signature = 55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF
15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3
74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20
ep_only = false
[Wise Installer Stub]
signature = 55 8B EC 81 EC ?? 04 00 00 53 56 57 6A ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? 40 00 ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 ?? 20
ep_only = true
[with added 'PK' signature]
signature = C7 ?? ?? ?? ?? ?? 8C D8 05
ep_only = true
[WWPACK v3:00; v3:01 (Extractable)]
signature = B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 6A ?? 06 06 8C D3 83 ?? ?? 53 6A ?? FC
ep_only = true
[WWPACK v3:00; v3:01 (Relocations pack)]
signature = BE ?? ?? BA ?? ?? BF ?? ?? B9 ?? ?? 8C CD 8E DD 81 ED ?? ?? 06 06 8B DD 2B DA 8B
D3 FC
ep_only = true

-334-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

[WWPACK v3:02; v3:02a (Extractable)]

signature = B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 33 C9 B1 ?? 51 06 06 BB ?? ?? 53 8C D3
ep_only = true
[WWPACK v3:02; v3:02a; v3:04 (Relocations pack)]
signature = BE ?? ?? BF ?? ?? B9 ?? ?? 8C CD 81 ED ?? ?? 8B DD 81 EB ?? ?? 8B D3 FC FA 1E 8E
DB 01 15 33 C0 2E AC
ep_only = true
[WWPACK v3:03]
signature = B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 BB ?? ?? 53
ep_only = true
[WWPACK v3:05c4 (Extr: Passw:check: Vir: shield)]
signature = 03 05 C0 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51
8C D3
ep_only = true
[WWPACK v3:05c4 (Extractable + Password checking)]
signature = 03 05 80 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51
8C D3
ep_only = true
[WWPACK v3:05c4 (Extractable + Virus Shield)]
signature = 03 05 40 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51
8C D3
ep_only = true
[WWPACK v3:05c4 (Extractable)]
signature = 03 05 00 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51
8C D3
ep_only = true
[WWPACK v3:05c4 (Modified)]
signature = B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3
ep_only = true
[WWPACK v3:05c4 (Unextr: Passw:check: Vir: shield)]
signature = 03 05 C0 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51
8C D3
ep_only = true
[WWPACK v3:05c4 (Unextractable + Password checking)]
signature = 03 05 80 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51
8C D3
ep_only = true
[WWPACK v3:05c4 (Unextractable + Virus Shield)]
signature = 03 05 40 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51
8C D3
ep_only = true
[WWPACK v3:05c4 (Unextractable)]
signature = 03 05 00 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51
8C D3
ep_only = true
[WWPack32 v1:00; v1:11; v1:12; v1:20]
signature = 53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32
ep_only = true
[WWPack32 v1:x]
-335-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = 53 55 8B E8 33 DB EB 60
ep_only = true
[X-Pack v1:4:2]
signature = 72 ?? C3 8B DE 83 ?? ?? C1 ?? ?? 8C D8 03 C3 8E D8 8B DF 83 ?? ?? C1 ?? ?? 8C C0
03 C3 8E C0 C3
ep_only = false
[X-PEOR v0:99b]
signature = E8 ?? ?? ?? ?? 5D 8B CD 81 ED 7A 29 40 ?? 89 AD 0F 6D 40
ep_only = true
[X-PEOR v0:99b]
signature = E8 00 00 00 00 5D 8B CD 81 ED 7A 29 40 00 89 AD 0F 6D 40 00
ep_only = true
[XCF File Format by Adeline Software]
signature = 46 72 61 6D 65 4C 65 6E F4 0F
ep_only = false
[XcomOR v0:99i]
signature = ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? ?? EB ?? D3 ?? ?? C2 ?? ?? B9 ?? ?? EB J3 0F 23
F8 0F 23 D8 0F 23 F8 0F 23 C8 E2
ep_only = true
[XCR v0:11]
signature = 60 8B F0 33 DB 83 C3 01 83 C0 01
ep_only = true
[XCR v0:12]
signature = 60 9C E8 ?? ?? ?? ?? 8B DD 5D 81 ED ?? ?? ?? ?? 89 9D
ep_only = true
[XCR v0:13]
signature = 93 71 08 ?? ?? ?? ?? ?? ?? ?? ?? 8B D8 78 E2 ?? ?? ?? ?? 9C 33 C3 ?? ?? ?? ?? 60
79 CE ?? ?? ?? ?? E8 01 ?? ?? ?? ?? 83 C4 04 E8 AB FF FF FF ?? ?? ?? ?? 2B E8 ?? ?? ?? ?? 03
C5 FF 30 ?? ?? ?? ?? C6 ?? EB
ep_only = true
[XJ / XPAL -> LiNSoN]
signature = 55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00
00 00 83 EC 44 53 56 57 66 9C
ep_only = true
[XM music file]
signature = 45 78 74 65 6E 64 65 64 20 4D 6F 64 75 6C 65 3A
ep_only = false
[XMI music file]
signature = 46 4F 52 4D ?? ?? ?? ?? 58 4D 49 44
ep_only = false
[XorCom v1:0]
signature = E9 J1 J1 FC BE ?? ?? BF ?? ?? 57 B9 ?? ?? AC 34 ?? AA E2 ?? C3
ep_only = true
[XorCopy v1:0]
signature = E9 J1 J1 B8 ?? ?? BB ?? ?? BA ?? ?? 31 07 43 40 39 D3 75 ?? C6 ?? ?? ?? ?? C6 ??
?? ?? ?? C6 ?? ?? ?? ?? 31 C0 31 DB 31 D2 E9
ep_only = true
[Xorer v1:0]
-336-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

signature = E9 J1 J1 BE ?? ?? 8B FE B9 ?? ?? 33 DB 80 ?? ?? AC 32 C3 AA E2
ep_only = true
[Xorer v2:1]
signature = E9 J1 J1 BA ?? ?? B9 ?? ?? 51 B0 ?? E6 60 FA B4 30 CD 21 3C 02 73 ?? 33 C0 06 50
CB
ep_only = true
[XPack 1:52 - 1:64]
signature = 8B EC FA 33 C0 8E D0 BC ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? EB
ep_only = true
[XPack 1:67 [com]
signature = E9 53 00 FF FD FF FB FF F9 FF BC 03 00 8B E5 4C 4C C3
ep_only = true
[XPack 1:67]
signature = B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB
ep_only = true
[xPEP 0:3x -> xIkUg]
signature = 55 53 56 51 52 57 E8 16 00 00 00
ep_only = true
[Xtreme-Protector
signature = B8 ??
8B 7C 24 28 FC B2
75 05 8A 16 46 12
ep_only = false

1:06]
?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24
80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2
D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02

[Xtreme-Protector v1:05]
signature = E9 ?? ?? 00 00 00 00 00 00 00 00
ep_only = true
[Xtreme-Protector
signature = B8 ??
8B 7C 24 28 FC B2
75 05 8A 16 46 12
16 46 12 D2 13 C0
05 8A 16 46 12 D2
02 D2 75 05 8A 16
B9 01 00 00 00 02
F5 F3 A4 5E E9 4F
D2 13 C9 02 D2 75
F7 2B F0 F3 A4 5E
FF 8A 06 46 33 C9
ep_only = true

v1:06]
?? ?? 00
80 8A 06
D2 73 4F
02 D2 75
13 C0 74
46 12 D2
D2 75 05
FF FF FF
05 8A 16
E9 0F FF
C0 E8 01

[Xtreme-Protector v1:06]
signature = B8 ?? ?? ?? 00
8B 7C 24 28 FC B2 80 8A 06
75 05 8A 16 46 12 D2 73 4F
16 46 12 D2 13 C0 02 D2 75
05 8A 16 46 12 D2 13 C0 74
02 D2 75 05 8A 16 46 12 D2
B9 01 00 00 00 02 D2 75 05
F5 F3 A4 5E E9 4F FF FF FF
D2 13 C9 02 D2 75 05 8A 16
F7 2B F0 F3 A4 5E E9 0F FF
FF 8A 06 46 33 C9 C0 E8 01
FE P_ ON LY = T RU E
ep_only = true

B9
46
33
05
06
13
8A
48
46
FF
74

75
88
C0
8A
57
C0
16
C1
12
FF
17

??
07
02
16
2B
02
46
E0
D2
83
83

??
47
D2
46
F8
D2
12
08
72
F8
D1

00
BB
75
12
8A
75
D2
8A
EA
7F
02

50
02
05
D2
07
05
13
06
3D
77
8B

51
00
8A
13
5F
8A
C9
46
00
03
E8

E8
00
16
C0
88
16
02
8B
7D
83
56

05
00
46
02
07
46
D2
E8
00
C1
8B

00
02
12
D2
47
12
75
B9
00
02
F7

00
D2
D2
75
BB
D2
05
01
73
56
2B

00
75
0F
05
02
72
8A
00
1A
8B
F0

E9
05
83
8A
00
EA
16
00
3D
F7
F3

4A
8A
DF
16
00
2B
46
00
00
2B
A4

01
16
00
46
00
C3
12
02
05
F0
5E

00
46
00
12
EB
BB
D2
D2
00
F3
BB

00
12
00
D2
9B
01
72
75
00
A4
01

60
D2
02
13
B8
00
EA
05
72
5E
00

8B
73
D2
C0
01
00
56
8A
0E
E9
00

74
EA
75
02
00
00
8B
16
41
FA
00

24
02
05
D2
00
75
F7
46
56
FE
E9

24
D2
8A
75
00
28
2B
12
8B
FF
D9 F

B9
46
33
05
06
13
8A
48
46
FF
74

75
88
C0
8A
57
C0
16
C1
12
FF
17

??
07
02
16
2B
02
46
E0
D2
83
83

??
47
D2
46
F8
D2
12
08
72
F8
D1

00
BB
75
12
8A
75
D2
8A
EA
7F
02

50
02
05
D2
07
05
13
06
3D
77
8B

51
00
8A
13
5F
8A
C9
46
00
03
E8

E8
00
16
C0
88
16
02
8B
7D
83
56

05
00
46
02
07
46
D2
E8
00
C1
8B

00
02
12
D2
47
12
75
B9
00
02
F7

00
D2
D2
75
BB
D2
05
01
73
56
2B

00
75
0F
05
02
72
8A
00
1A
8B
F0

E9
05
83
8A
00
EA
16
00
3D
F7
F3

4A
8A
DF
16
00
2B
46
00
00
2B
A4

01
16
00
46
00
C3
12
02
05
F0
5E

00
46
00
12
EB
BB
D2
D2
00
F3
BB

00
12
00
D2
9B
01
72
75
00
A4
01

60
D2
02
13
B8
00
EA
05
72
5E
00

8B
73
D2
C0
01
00
56
8A
0E
E9
00

74
EA
75
02
00
00
8B
16
41
FA
00

24
02
05
D2
00
75
F7
46
56
FE
E9

24
D2
8A
75
00
28
2B
12
8B
FF
D9

-337-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

[Xtreme-Protector
signature = B8 ??
8B 7C 24 28 FC B2
75 05 8A 16 46 12
16 46 12 D2 13 C0
05 8A 16 46 12 D2
02 D2 75 05 8A 16
B9 01 00 00 00 02
F5 F3 A4 5E E9 4F
D2 13 C9 02 D2 75
F7 2B F0 F3 A4 5E
FF 8A 06 46 33 C9
FE FF FF 2B 7C 24
ep_only = true

v1:06]
?? ?? 00
80 8A 06
D2 73 4F
02 D2 75
13 C0 74
46 12 D2
D2 75 05
FF FF FF
05 8A 16
E9 0F FF
C0 E8 01
28 89 7C

04 August 2015 15:14

B9
46
33
05
06
13
8A
48
46
FF
74
24

75
88
C0
8A
57
C0
16
C1
12
FF
17
1C

??
07
02
16
2B
02
46
E0
D2
83
83
61

??
47
D2
46
F8
D2
12
08
72
F8
D1
C2

00
BB
75
12
8A
75
D2
8A
EA
7F
02
08

50
02
05
D2
07
05
13
06
3D
77
8B
00

51
00
8A
13
5F
8A
C9
46
00
03
E8
E9

E8
00
16
C0
88
16
02
8B
7D
83
56
??

05
00
46
02
07
46
D2
E8
00
C1
8B
??

00
02
12
D2
47
12
75
B9
00
02
F7
??

00
D2
D2
75
BB
D2
05
01
73
56
2B
00

00
75
0F
05
02
72
8A
00
1A
8B
F0
E9

E9
05
83
8A
00
EA
16
00
3D
F7
F3
38

4A
8A
DF
16
00
2B
46
00
00
2B
A4
??

01
16
00
46
00
C3
12
02
05
F0
5E
??

00
46
00
12
EB
BB
D2
D2
00
F3
BB
??

00
12
00
D2
9B
01
72
75
00
A4
01
01

60
D2
02
13
B8
00
EA
05
72
5E
00

8B
73
D2
C0
01
00
56
8A
0E
E9
00

74
EA
75
02
00
00
8B
16
41
FA
00

24
02
05
D2
00
75
F7
46
56
FE
E9

24
D2
8A
75
00
28
2B
12
8B
FF
D9

[XWD graphics format]

signature = 00 00 00 71 00 00 00 07 00 00 00 02 00 00 00
ep_only = false
[y0da's Crypter v1:0]
signature = 60 E8 00 00 00 00 5D 81 ED E7 1A 40 00 E8 A1 00 00 00 E8 D1 00 00 00 E8 85 01 00
00 F7 85
ep_only = true
[y0da's Crypter v1:1]
signature = 60 E8 00 00 00 00 5D 81 ED 8A 1C 40 00 B9 9E 00 00 00 8D BD 4C 23 40 00 8B F7 33
ep_only = true
[y0da's Crypter v1:2]
signature = 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC
ep_only = true
[y0da's Crypter v1:x / Modified]
signature = 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 ?? ?? 00 00 8D BD ?? ?? ?? ?? 8B F7 AC
ep_only = true
[yC 1:3 by Ashkbiz Danehkar]
signature = 55 8B EC 81 EC C0 00 00 00 53 56 57 8D BD 40 FF FF FF B9 30 00 00 00 B8 CC CC CC
CC F3 AB 60 E8 00 00 00 00 5D 81 ED 84 52 41 00 B9 75 5E 41 00 81 E9 DE 52 41 00 8B D5 81 C2
DE 52 41 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC
ep_only = false
[yoda's Crypter 1:3 -> Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 81 E9 C6
28 40 00 8B D5 81 C2 C6 28 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC
ep_only = true
[yoda's Crypter 1:3 -> Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00
ep_only = true
[yoda's Protector 1:0 beta -> Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ??
B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90
EB 01 ?? E8 03 00
ep_only = true
[yoda's Protector 1:01 -> Ashkbiz Danehkar (h)]
signature = 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ??
-338-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00
E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00
ep_only = false
[yoda's Protector
signature = E8 03
03 00 00 00 EB 01
01 ?? E8 AB 00 00
ep_only = false

1:02 (:exe;:scr;:com) -> Ashkbiz

00 00 00 EB 01 ?? BB 55 00 00 00
?? E8 82 00 00 00 E8 03 00 00 00
00 E8 03 00 00 00 EB 01 ?? 83 FB

Danehkar
E8 03 00
EB 01 ??
55 E8 03

(h)]
00 00 EB 01 ?? E8 8F 00 00 00 E8
E8 B8 00 00 00 E8 03 00 00 00 EB
00 00 00 EB 01 ?? 75

[yoda's Protector 1:02 - 1:03 -> Ashkbiz Danehkar]

signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8
03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB
01 ?? E8 AB 00 00
ep_only = true
[yoda's Protector
signature = E8 03
03 00 00 00 EB 01
01 ?? E8 AB 00 00
00 00 EB 01 ?? C3
00 00 C3 C3 E8 03
33 C0 64 FF 30 64
00 00 00 EB 01 ??
33 C0 E8 03 00 00
43 CC C3 90 EB 01
ep_only = true

1:02 -> Ashkibiz Danehlar]

00 00 00 EB 01 ?? BB 55 00
?? E8 82 00 00 00 E8 03 00
00 E8 03 00 00 00 EB 01 ??
60 E8 00 00 00 00 5D 81 ED
00 00 00 EB 01 ?? E8 0E 00
89 20 CC C3 E8 03 00 00 00
33 DB B9 3A 66 42 00 81 E9
00 EB 01 ?? E8 17 00 00 00
?? AC

00
00
83
23
00
EB
1D
90

00
00
FB
3F
00
01
40
90

E8
EB
55
42
E8
??
42
90

03
01
E8
00
D1
33
00
E9

00
??
03
8B
FF
C0
8B
C3

00
E8
00
D5
FF
64
D5
1F

00
B8
00
81
FF
FF
81
00

EB
00
00
C2
C3
30
C2
00

01
00
EB
72
E8
64
1D
33

??
00
01
3F
03
89
40
C0

E8
E8
??
42
00
20
42
64

8F
03
75
00
00
4B
00
FF

00
00
2E
52
00
CC
8D
30

00
00
E8
E8
EB
C3
3A
64

00
00
03
01
01
E8
8B
89

E8
EB
00
00
??
03
F7
20

[yoda's Protector
signature = E8 03
03 00 00 00 EB 01
01 ?? E8 AB 00 00
00 00 EB 01 ?? C3
00 00 C3 C3 E8 03
33 C0 64 FF 30 64
00 00 00 EB 01 ??
33 C0 E8 03 00 00
43 CC C3 90 EB 01
ep_only = true

1:03:1 -> Ashkibiz Danehlar]

00 00 00 EB 01 ?? BB 55 00 00
?? E8 82 00 00 00 E8 03 00 00
00 E8 03 00 00 00 EB 01 ?? 83
60 E8 00 00 00 00 5D 81 ED 74
00 00 00 EB 01 ?? E8 0E 00 00
89 20 CC C3 E8 03 00 00 00 EB
33 DB B9 3F A9 42 00 81 E9 6E
00 EB 01 ?? E8 17 00 00 00 90
?? AC

00
00
FB
72
00
01
73
90

E8
EB
55
42
E8
??
42
90

03
01
E8
00
D1
33
00
E9

00
??
03
8B
FF
C0
8B
98

00
E8
00
D5
FF
64
D5
2E

00
B8
00
81
FF
FF
81
00

EB
00
00
C2
C3
30
C2
00

01
00
EB
C3
E8
64
6E
33

??
00
01
72
03
89
73
C0

E8
E8
??
42
00
20
42
64

8F
03
75
00
00
4B
00
FF

00
00
2E
52
00
CC
8D
30

00
00
E8
E8
EB
C3
3A
64

00
00
03
01
01
E8
8B
89

E8
EB
00
00
??
03
F7
20

[yoda's Protector
signature = 55 8B
B9 EA 47 40 00 81
EB 01 ?? E8 03 00
ep_only = false

1:0b -> Ashkbiz Danehkar (h)]

EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ??
E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90
00 00 EB 01

[yoda's Protector 1:0b -> Ashkbiz Danehkar]

signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01
ep_only = false
[yoda's Protector 1:0x -> Ashkbiz Danehkar]
signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03
ep_only = true
[yoda's Protector 1:0x -> Ashkbiz Danehkar]
signature = 55 8B EC 53 56 57 E8 03 00 00 00 EB 01
ep_only = true
[yoda's Protector
signature = 55 8B
E8 79 00 00 00 E8
E8 03 00 00 00 EB

V1:01
EC 53
03 00
01 ??

->
56
00
E8

Ashkbiz Danehkar > Sign

57 E8 03 00 00 00 EB 01
00 EB 01 ?? E8 A4 00 00
2D 00 00 00 E8 03 00 00
-339-

by
??
00
00

fly]
E8 86 00 00 00 E8 03 00 00 00 EB 01 ??
E8 03 00 00 00 EB 01 ?? E8 97 00 00 00
EB 01 ?? 60 E8 00 00 00 00 5D 81 ED D5

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

E4 41 00 8B D5 81 C2 23 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00
00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB
01 ?? 33 C0 64 FF 30 64 89 20 CC C3
ep_only = true
[yoda's Protector
signature = E8 03
03 00 00 00 EB 01
01 ?? E8 AB 00 00
00 00 EB 01 ?? C3
00 00 C3 C3 E8 03
33 C0 64 FF 30 64
00 00 00 EB 01 ??
33 C0 E8 03 00 00
43 CC C3 90 EB 01
ep_only = true

v1:02
00 00
?? E8
00 E8
60 E8
00 00
89 20
33 DB
00 EB
?? AC

(:exe;:scr;:com) -> Ashkbiz Danehkar (h)]

00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00
82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8
03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00
00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81
00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF
CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF
B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81
01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00

EB
00
00
C2
C3
30
C2
00

01
00
EB
72
E8
64
1D
33

??
00
01
3F
03
89
40
C0

E8
E8
??
42
00
20
42
64

8F
03
75
00
00
4B
00
FF

00
00
2E
52
00
CC
8D
30

00
00
E8
E8
EB
C3
3A
64

00
00
03
01
01
E8
8B
89

E8
EB
00
00
??
03
F7
20

[yoda's Protector
signature = E8 03
03 00 00 00 EB 01
01 ?? E8 AB 00 00
00 00 EB 01 ?? C3
00 00 C3 C3 E8 03
33 C0 64 FF 30 64
00 00 00 EB 01 ??
33 C0 E8 03 00 00
43 CC C3
ep_only = true

V1:02
00 00
?? E8
00 E8
60 E8
00 00
89 20
33 DB
00 EB

->
00
82
03
00
00
CC
B9
01

Ashkbiz Danehkar > Sign

EB 01 ?? BB 55 00 00 00
00 00 00 E8 03 00 00 00
00 00 00 EB 01 ?? 83 FB
00 00 00 5D 81 ED 23 3F
EB 01 ?? E8 0E 00 00 00
C3 E8 03 00 00 00 EB 01
3A 66 42 00 81 E9 1D 40
?? E8 17 00 00 00 90 90

by
E8
EB
55
42
E8
??
42
90

fly]
03 00
01 ??
E8 03
00 8B
D1 FF
33 C0
00 8B
E9 C3

00
E8
00
D5
FF
64
D5
1F

00
B8
00
81
FF
FF
81
00

EB
00
00
C2
C3
30
C2
00

01
00
EB
72
E8
64
1D
33

??
00
01
3F
03
89
40
C0

E8
E8
??
42
00
20
42
64

8F
03
75
00
00
4B
00
FF

00
00
2E
52
00
CC
8D
30

00
00
E8
E8
EB
C3
3A
64

00
00
03
01
01
E8
8B
89

E8
EB
00
00
??
03
F7
20

Sign by fly]
00 E8 03 00 00
00 EB 01 ?? E8
FB 55 E8 03 00
72 42 00 8B D5
00 E8 D1 FF FF
01 ?? 33 C0 64
73 42 00 8B D5
90 90 E9 98 2E

00
B8
00
81
FF
FF
81
00

EB
00
00
C2
C3
30
C2
00

01
00
EB
C3
E8
64
6E
33

??
00
01
72
03
89
73
C0

E8
E8
??
42
00
20
42
64

8F
03
75
00
00
4B
00
FF

00
00
2E
52
00
CC
8D
30

00
00
E8
E8
EB
C3
3A
64

00
00
03
01
01
E8
8B
89

E8
EB
00
00
??
03
F7
20

(h)]
00 EB
B8 00
00 00
81 C2
FF C3
FF 30
81 C2
00 00

01
00
EB
E3
E8
64
8E
33

??
00
01
73
03
89
74
C0

E8
E8
??
42
00
20
42
64

8F
03
75
00
00
4B
00
FF

00
00
2E
52
00
CC
8D
30

00
00
E8
E8
EB
C3
3A
64

00
00
03
01
01
E8
8B
89

E8
EB
00
00
??
03
F7
20

00
B8
00
81

01
00
EB
E3

??
00
01
73

E8
E8
??
42

8F
03
75
00

00
00
2E
52

00
00
E8
E8

00
00
03
01

E8
EB
00
00

[yoda's Protector v1:02b-> Ashkbiz Danehkar]

signature = E8 03 00 00 00 EB 01
ep_only = true
[yoda's Protector
signature = E8 03
03 00 00 00 EB 01
01 ?? E8 AB 00 00
00 00 EB 01 ?? C3
00 00 C3 C3 E8 03
33 C0 64 FF 30 64
00 00 00 EB 01 ??
33 C0 E8 03 00 00
43 CC C3
ep_only = true

V1:03:1 -> Ashkbiz Danehkar >

00 00 00 EB 01 ?? BB 55 00 00
?? E8 82 00 00 00 E8 03 00 00
00 E8 03 00 00 00 EB 01 ?? 83
60 E8 00 00 00 00 5D 81 ED 74
00 00 00 EB 01 ?? E8 0E 00 00
89 20 CC C3 E8 03 00 00 00 EB
33 DB B9 3F A9 42 00 81 E9 6E
00 EB 01 ?? E8 17 00 00 00 90

[yoda's Protector
signature = E8 03
03 00 00 00 EB 01
01 ?? E8 AB 00 00
00 00 EB 01 ?? C3
00 00 C3 C3 E8 03
33 C0 64 FF 30 64
00 00 00 EB 01 ??
33 C0 E8 03 00 00
43 CC C3 90 EB 01
ep_only = true

v1:03:2 (:exe;:scr;:com) -> Ashkbiz

00 00 00 EB 01 ?? BB 55 00 00 00 E8
?? E8 82 00 00 00 E8 03 00 00 00 EB
00 E8 03 00 00 00 EB 01 ?? 83 FB 55
60 E8 00 00 00 00 5D 81 ED 94 73 42
00 00 00 EB 01 ?? E8 0E 00 00 00 E8
89 20 CC C3 E8 03 00 00 00 EB 01 ??
33 DB B9 BF A4 42 00 81 E9 8E 74 42
00 EB 01 ?? E8 17 00 00 00 90 90 90
?? AC

[yoda's Protector
signature = E8 03
03 00 00 00 EB 01
01 ?? E8 AB 00 00
00 00 EB 01 ?? C3

V1:03:2 -> Ashkbiz Danehkar >

00 00 00 EB 01 ?? BB 55 00 00
?? E8 82 00 00 00 E8 03 00 00
00 E8 03 00 00 00 EB 01 ?? 83
60 E8 00 00 00 00 5D 81 ED 94

Danehkar
03 00 00
01 ?? E8
E8 03 00
00 8B D5
D1 FF FF
33 C0 64
00 8B D5
E9 63 29

Sign by fly]
00 E8 03 00 00
00 EB 01 ?? E8
FB 55 E8 03 00
73 42 00 8B D5

-340-

EB
00
00
C2

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

00 00 C3 C3 E8
33 C0 64 FF 30
00 00 00 EB 01
33 C0 E8 03 00
43 CC C3
ep_only = true

03
64
??
00

00
89
33
00

00
20
DB
EB

00
CC
B9
01

04 August 2015 15:14

EB
C3
BF
??

01
E8
A4
E8

??
03
42
17

E8
00
00
00

0E
00
81
00

00
00
E9
00

00
EB
8E
90

00
01
74
90

E8
??
42
90

D1
33
00
E9

FF
C0
8B
63

FF
64
D5
29

FF
FF
81
00

C3
30
C2
00

E8
64
8E
33

03
89
74
C0

00
20
42
64

00
4B
00
FF

00
CC
8D
30

EB
C3
3A
64

01
E8
8B
89

??
03
F7
20

[Yoda's Protector v1:03:2 Beta2 -> Ashkbiz Danehkar]

signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8
03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00
ep_only = true
[yoda's Protector
signature = E8 03
03 00 00 00 EB 01
01 ?? E8 AB 00 00
00 00 EB 01 ?? C3
00 00 C3 C3 E8 03
ep_only = false

v1:03:2 by Ashkbiz Danehkar]

00 00 00 EB 01 ?? BB 55 00 00
?? E8 82 00 00 00 E8 03 00 00
00 E8 03 00 00 00 EB 01 ?? 83
60 E8 00 00 00 00 5D 81 ED 94
00 00

[yoda's Protector
signature = E8 03
03 00 00 00 EB 01
01 ?? E8 AA 00 00
00 00 EB 01 ?? 60
00 C3 C3 E8 03 00
C0 64 FF 30 64 89
00 00 EB 01 ?? 33
C0 E8 03 00 00 00
CC C3 CC CC CC CC
ep_only = true

v1:03:3 (:exe;:scr;:com) -> Ashkbiz

00 00 00 EB 01 ?? BB 55 00 00 00 E8
?? E8 81 00 00 00 E8 03 00 00 00 EB
00 E8 03 00 00 00 EB 01 ?? 83 FB 55
E8 00 00 00 00 5D 81 ED 07 E2 40 00
00 00 EB 01 ?? E8 0E 00 00 00 E8 D1
20 CC C3 E8 03 00 00 00 EB 01 ?? 33
DB B9 4B 0C 41 00 81 E9 01 E3 40 00
EB 01 ?? E8 17 00 00 00 90 90 90 E9
AC

[yoda's Protector
signature = E8 03
03 00 00 00 EB 01
01 ?? E8 AA 00 00
00 00 EB 01 ?? 60
00 C3 C3 E8 03 00
C0 64 FF 30 64 89
ep_only = true

V1:03:3 -> Ashkbiz Danehkar >

00 00 00 EB 01 ?? BB 55 00 00
?? E8 81 00 00 00 E8 03 00 00
00 E8 03 00 00 00 EB 01 ?? 83
E8 00 00 00 00 5D 81 ED 07 E2
00 00 EB 01 ?? E8 0E 00 00 00
20 CC C3 E8 03 00 00 00 EB 01

[yoda's Protector
signature = 55 8B
B9 EA 47 40 00 81
EB 01 ?? E8 03 00
ep_only = true

V1:0b
EC 53
E9 E9
00 00

->
56
32
EB

00
00
FB
73

E8
EB
55
42

03
01
E8
00

00
??
03
8B

00
E8
00
D5

Danehkar
03 00 00
01 ?? E8
E8 03 00
8B D5 81
FF FF FF
C0 64 FF
8B D5 81
9C 22 00

Sign by fly]
00 E8 03 00 00
00 EB 01 ?? E8
FB 55 E8 03 00
40 00 8B D5 81
E8 D1 FF FF FF
?? 33 C0 64 FF

00
B8
00
81

EB
00
00
C2

01
00
EB
E3

??
00
01
73

E8
E8
??
42

8F
03
75
00

00
00
2E
52

00
00
E8
E8

00
00
03
01

E8
EB
00
00

(h)]
00 EB
B7 00
00 00
C2 56
C3 E8
30 64
C2 01
00 33

01
00
EB
E2
03
89
E3
C0

??
00
01
40
00
20
40
64

E8
E8
??
00
00
4B
00
FF

8E
03
75
52
00
CC
8D
30

00
00
2D
E8
EB
C3
3A
64

00
00
E8
01
01
E8
8B
89

00
00
03
00
??
03
F7
20

E8
EB
00
00
33
00
33
43

00
B7
00
C2
C3
30

01
00
EB
E2
03
89

??
00
01
40
00
20

E8
E8
??
00
00
4B

8E
03
75
52
00
CC

00
00
2D
E8
EB
C3

00
00
E8
01
01

00
00
03
00
??

E8
EB
00
00
33

EB
00
00
56
E8
64

Ashkbiz Danehkar > Sign by fly]

57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ??
40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90
01 ?? AC

[yP 1:0b by Ashkbiz Danehkar]

signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ??
B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90
EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8
ep_only = false
[yzPack 1:0 -> UsAr]
signature = 60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C
ep_only = true
[YZPack 1:2 -> UsAr]
signature = 4D 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD
8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9
ep_only = true

-341-

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

[yzpack V1:1 -> UsAr

signature = 60 33 C0
EB 09 8B 40 34 8D 40
F3 56 8B 76 20 03 F3
ep_only = true

04 August 2015 15:14

> Sign by fly]

8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08
7C 8B 40 3C 89 45 04 E8 F3 07 00 00 60 8B 5D 04 8B 73 3C 8B 74 33 78 03
33 C9 49 92 41 AD 03 C3 52 33 FF 0F B6 10 38 F2

[yzpack V1:12 -> UsAr >

signature = 5A 52 45 60
40 08 EB 09 8B 40 34 83
21 40 00 00 00 50 45 00
?? ?? ?? ?? 00 00
ep_only = true

Sign by fly]
83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B
C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD
00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00 ?? ?? 0B 01

[yzpack V1:12 -> UsAr]

signature = 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B
40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD
21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00
ep_only = true
[yzpack V2:0 -> UsAr
signature = 25 ?? ??
33 C9 FF 14 24 73 18
FF 54 24 04 2B CB 75
24 08 3D 00 7D 00 00
F3 A4 5E EB 99 BD ??
ep_only = true

> Sign by fly]

?? ?? 61 87 CC
33 C0 FF 14 24
0F FF 54 24 08
73 0A 80 FC 05
?? ?? ?? FF 65

55
73
EB
73
28

45
1F
27
06

45
B3
AC
83

55
02
D1
F8

81
41
E8
7F

ED
B0
74
77

CA
10
30
02

00
FF
13
41

00
14
C9
41

00
24
EB
95

55
12
1B
8B

A4
C0
91
C5

B3
73
48
B3

02
F9
C1
01

FF
75
E0
56

14
3C
08
8B

24
AA
AC
F7

73
EB
FF
2B

F8
DC
54
F0

[yzpack V2:0 -> UsAr]

signature = 25 ?? ?? ?? ?? 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8
33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC
FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0
ep_only = true
[ZCode Win32/PE Protector v1:01]
signature = E9 12 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 FB FF FF FF C3 68 ?? ?? ??
?? 64 FF 35
ep_only = true
[ZealPack 1:0 -> Zeal]
signature = C7 45 F4 00 00 40 00 C7 45 F0 ?? ?? ?? ?? 8B 45 F4 05 ?? ?? ?? ?? 89 45 F4 C7 45
FC 00 00 00 00 EB 09 8B 4D FC 83 C1 01 89 4D FC 8B 55 FC 3B 55 F0 7D 22 8B 45 F4 03 45 FC 8A
08 88 4D F8 0F BE 55 F8 83 F2 0F 88 55 F8 8B 45 F4 03 45 FC 8A 4D F8 88 08 EB CD FF 65 F4
ep_only = true
[ZipWorxSecureEXE
signature = E9 B8
?? ?? ?? ?? ?? 00
20 50 72 6F 74 65
ep_only = false

2:5 -> ZipWORX

00 00 00 ?? ??
53 65 63 75 72
63 74 6F 72 0D

Technologies LLC (h)]

?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ??
65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65
0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30

[ZipWorxSecureEXE
signature = E9 B8
?? ?? ?? ?? ?? 00
20 50 72 6F 74 65
30 30 37 20 5A 69
50 6F 72 74 69 6F
31 20 4C 65 65 20
65 64 2E 0D 0A 00
?? 0B C0 74 02 FF
83 C4 04 58 FE 05
00 B8 93 90 9D 9E
8B B2 90

v2:5 -> ZipWORX Technologies LLC

00 00 00 ?? ?? ?? ?? ?? ?? ?? ??
53 65 63 75 72 65 45 58 45 20 45
63 74 6F 72 0D 0A 43 6F 70 79 72
70 57 4F 52 58 20 54 65 63 68 6E
6E 73 20 43 6F 70 79 72 69 67 68
48 61 73 69 75 6B 0D 0A 41 6C 6C
00 8B 44 24 04 23 05 ?? ?? ?? ??
E0 8B E5 5D C2 0C 00 80 3D ?? ??
?? ?? ?? ?? ?? 94 9A 8D 91 9A 93
93 B9 8D 9A 9A 00 B8 9A 8B B2 90

-342-

(h)]
?? ??
78 65
69 67
6F 6C
74 20
20 52
?? ??
?? ??
CC CD
9B 8A

??
63
68
6F
28
69
??
00
00
93

??
75
74
67
63
67
??
75
B8
9A

00
74
28
69
29
68
00
13
93
B7

00
61
63
65
20
74
00
50
90
9E

00
62
29
73
31
73
83
2B
9D
91

00
6C
20
2C
39
20
C4
C0
9E
9B

00
65
32
20
39
52
04
50
93
93

??
20
30
4C
37
65
FE
E8
BE
9A

??
46
30
4C
2D
73
05
??
93
BE

??
69
34
43
32
65
??
??
93
00

??
6C
2D
0D
30
72
??
00
90
B8

??
65
32
0A
30
76
??
00
9C
9A

C:\Portable\PEiD v0.95 With Plugins\userdb.txt

04 August 2015 15:14

ep_only = true
[Zortech C v2:00 1988; 1989]
signature = FA B8 ?? ?? 8E D8 8C ?? ?? ?? 26 8B ?? ?? ?? 89 1E ?? ?? 8B D8 2B 1E ?? ?? 89 1E
ep_only = true
[Zortech C v3:0]
signature = FA FC B8 ?? ?? ?? 8C C8 8E D8
ep_only = true
[Zortech C]
signature = E8 ?? ?? 2E FF ?? ?? ?? FC 06
ep_only = true
[Zurenava DOS Extender v0:45; v0:49]
signature = BE ?? ?? BF ?? ?? B9 ?? ?? 56 FC F3 A5 5F E9
ep_only = true
[EXE -> ]
signature = 55 8B EC 83 C4 E4 53 56 57 33 C0 89 45 E4 89 45
ep_only = true
[EXE v1:0 -> ]
signature = 55 8B EC 6A FF 68 08 4B 40 00 68 36 3A 40 00 64 A1
ep_only = true
[ v1:0 -> Li-Jianjun]
signature = 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44
ep_only = true
[ v1:0 -> ]
signature = 64 A1 00 00 00 00 55 89 E5 6A FF 68 1C 30 40 00
ep_only = true
[EXE -> yy66]
signature = 68 78 18 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30
ep_only = true
[ 2:2b -> Shoooo]
signature = 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 14 80 0E 03 E8 D1 09 00 0A
57 33 D2 FF 75 18 B9 E8 1F DE 16 81 C0 8D BD EE 7F FB F8
ep_only = true
[ 2:2b Anti -> xiaohui]
signature = EB F4 11 55 07 8B EC B8 14 80 0E 03 E8 D1 09 00 0A 57 33 D2 FF 75 18 B9 E8 1F DE
16 81 C0 8D BD EE 7F FB F8
ep_only = true

-343-