comments powered byDisqus

MZ Header

Rich Header

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 000004b0

VS_FIXEDFILEINFO

offsetsizetypecomment
051200EXE02/24/2012 19:20:04#
8d7d825818BMP(150 x 57)#
93cb6400384DLL03/11/2016 14:19:02#
f58ba6144DLL02/24/2012 19:19:32#
f70be9728DLL02/24/2012 19:19:32#
f96c211264DLL02/24/2012 19:19:35#
17e8d0a579GIF(56 x 20)#
5e6e18c5120DLL02/24/2012 19:19:29#
5e6f5906144DLL07/11/2011 23:07:56#
5e70d94218624EXE02/03/2016 19:38:25#
5ea639430811RARPassword Protected:Encrypted Headers!#
5eadc0454614BMP(165 x 110)#
5ebb15e54614BMP(165 x 110)#
5ec86b819558BMP(165 x 110)#
5ecd32219558BMP(165 x 110)#
5ed1f8c4608DLL06/28/2011 07:48:44#
5ed318c4BINoverlay data past EOF#
Type = Nsis
Method = Copy
Solid = -

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2016-08-24 19:38:28 .....        25818        25818  /modern-header.bmp
                    .....       400384       400384  /SVP14//nsis7z.dll
                    .....         6144         6144  /SVP14//nsExec.dll
                    .....         9728         9728  /SVP14//nsDialogs.dll
                    .....        11264        11264  /SVP14//System.dll
2016-12-24 20:52:28 .....     97984194     97984194  /SVP14//MAGIX.Vegas.Pro.v14.0.211.pkg
                    .....         5120         5120  /SVP14//LangDLL.dll
                    .....         6144         6144  /SVP14//Aero.dll
2016-10-20 19:38:58 .....       249452       249452  /SVP14//HiRu.exe
2011-10-09 22:34:00 .....        54614        54614  /SVP14//ru.bmp
2011-10-09 22:34:52 .....        54614        54614  /SVP14//en.bmp
2012-07-28 05:31:56 .....        19558        19558  /SVP14//ruS.bmp
2012-07-28 05:31:42 .....        19558        19558  /SVP14//enS.bmp
                    .....         4608         4608  /SVP14//nsProcess.dll
------------------- ----- ------------ ------------  ------------------------
                              98851200     98851200  14 files, 0 folders
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

[?] can't find file_offset of VA 0x86000