Art.exe - Advanced Registry Tracer

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	Art.exe
size	947200 (0xe7400)
md5	4060934c0711275d8635bf8cb503499e

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x50
blocks_in_file	2
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0xf
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0x1a
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	0xa
TimeDateStamp	0x2a425e19
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x818e
Magic	0x10b
LinkerVersion	2.25
SizeOfCode	0x140e00
SizeOfInitializedData	0x8da00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1000
BaseOfCode	0x1000
BaseOfData	0x142000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	1.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x27e000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x4000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

ASProtect 1.33 - 2.1 Registered (Alexey Solodovnikov)

Sections

name	va	vsize	raw size	flags
	0x1000	0x141000	0x70c00	RWX IDATA
	0x142000	0x9000	0x3200	RWX IDATA
	0x14b000	0x68000	0	RWX IDATA
	0x1b3000	0x4000	0x2c00	RWX IDATA
	0x1b7000	0x1000	0	RWX IDATA
	0x1b8000	0x1000	0x200	RWX IDATA
	0x1b9000	0x13000	0	RWX IDATA
.rsrc	0x1cc000	0x70000	0x2fa00	RWX IDATA
.data	0x23c000	0x41000	0x40a00	RWX IDATA
.adata	0x27d000	0x1000	0	RWX IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x23ca50	0x490
RESOURCE	0x1cc000	0x6f800
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x23c9dc	8
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x23c9e4	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0
	0	0x100000

TLS

raw start	raw end	index	callbks	zero fill	flags
0x5b7000	0x5b7010	0x54b4d0	0x5b8010	0	0

show previews

type	name	size
UNICODE	CASE	16784
UNICODE	COMBINE	1772
UNICODE	DECOMPOSE	24300
UNICODE	NUMBERS	3440
UNICODE	TYPE	22052
CURSOR	#1	308
CURSOR	#2	308
CURSOR	#3	308
CURSOR	#4	308
CURSOR	#5	308
CURSOR	#6	308
CURSOR	#7	308
BITMAP	BBABORT	464
BITMAP	BBALL	484
BITMAP	BBCANCEL	464
BITMAP	BBCLOSE	464
BITMAP	BBHELP	464
BITMAP	BBIGNORE	464
BITMAP	BBNO	464
BITMAP	BBOK	464
BITMAP	BBRETRY	464
BITMAP	BBYES	464
BITMAP	CDROM	192
BITMAP	CLOSEDFOLDER	224
BITMAP	CURRENTFOLDER	224
BITMAP	EXECUTABLE	224
BITMAP	FLOPPY	192
BITMAP	HARD	192
BITMAP	KNOWNFILE	224
BITMAP	NETWORK	192
BITMAP	OPENFOLDER	224
BITMAP	RAM	192
BITMAP	TMRUFILELIST	392
BITMAP	UNKNOWNFILE	224
BITMAP	#103	71466
BITMAP	#116	56362
ICON	#1	3752
ICON	#2	2216
ICON	#3	1384
ICON	#4	9640
ICON	#5	4264
ICON	#6	1128
STRING	#4077	84
STRING	#4078	700
STRING	#4079	1216
STRING	#4080	1124
STRING	#4081	1316
STRING	#4082	792
STRING	#4083	860
STRING	#4084	460
STRING	#4085	232
STRING	#4086	696
STRING	#4087	360
STRING	#4088	1072
STRING	#4089	924
STRING	#4090	1068
STRING	#4091	692
STRING	#4092	224
STRING	#4093	188
STRING	#4094	792
STRING	#4095	944
STRING	#4096	724
RCDATA	DVCLAL	16
RCDATA	PACKAGEINFO	1108
RCDATA	TABOUTBOX	73033
RCDATA	TARTSERVICE0	242
RCDATA	TCCFRM	483
RCDATA	TCHOOSFILEF	971
RCDATA	TCMPFORM	6986
RCDATA	TCOMMENTFRM	711
RCDATA	TCOPYV	877
RCDATA	TEXCLUDECHKFRM	3084
RCDATA	TFILTERF	7532
RCDATA	TFINDFORM	6409
RCDATA	TFXPIREDFRM	2322
RCDATA	THEXFRM	1563
RCDATA	TIMPORTFRM	2659
RCDATA	TJUMPTR	2382
RCDATA	TLOGFO	891
RCDATA	TMDFORM	57446
RCDATA	TMULTISTRFRM1	415
RCDATA	TNAMELIST	716
RCDATA	TNETWORKFRM	850
RCDATA	TREDOFRM	1750
RCDATA	TREG_FRM	12964
RCDATA	TSCANPROGRESS	865
RCDATA	TSETTINGS_FRM	8252
RCDATA	TUNDOFRM	1730
RCDATA	TWHATCMP	4535
RCDATA	TWHATNODEFRM	2804
RCDATA	TWHATSCANF	3081
GROUP_CURSOR	#32761	20
GROUP_CURSOR	#32762	20
GROUP_CURSOR	#32763	20
GROUP_CURSOR	#32764	20
GROUP_CURSOR	#32765	20
GROUP_CURSOR	#32766	20
GROUP_CURSOR	#32767	20
GROUP_ICON	MAINICON	90
VERSION	#1	872

module_name	hint	ord	function_name
kernel32.dll			GetProcAddress
kernel32.dll			GetModuleHandleA
kernel32.dll			LoadLibraryA
user32.dll			GetKeyboardType
advapi32.dll			RegQueryValueExA
oleaut32.dll			VariantChangeTypeEx
advapi32.dll			ReportEventA
mpr.dll			WNetGetConnectionA
version.dll			VerQueryValueA
gdi32.dll			UnrealizeObject
user32.dll			WindowFromPoint
ole32.dll			IsEqualGUID
comctl32.dll			ImageList_SetIconSize
winspool.drv			OpenPrinterA
shell32.dll			ShellExecuteA
wininet.dll			InternetGetCookieA
shell32.dll			SHGetSpecialFolderLocation
comdlg32.dll			GetSaveFileNameA
winmm.dll			timeGetTime
advapi32.dll			StartServiceCtrlDispatcherA
oleaut32.dll			VariantChangeTypeEx
kernel32.dll			RaiseException

StringTable 040904E4

CompanyName	Elcomsoft Co. Ltd.
FileDescription	Advanced Registry Tracer
FileVersion	2.11.0.0
InternalName	ART
LegalCopyright	Copyright(c) 1999-2006 Elcomsoft Co. Ltd. All rights reserved.
LegalTrademarks
OriginalFilename	art.exe
ProductName	Advanced Registry Tracer
ProductVersion	2.11

VS_FIXEDFILEINFO

FileVersion	2.11.0.0
ProductVersion	2.11.0.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	947200	EXE	06/19/1992 22:22:17	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x2052cc

[?] can't find file_offset of VA 0x205320

[?] can't find file_offset of VA 0x2055dc

[?] can't find file_offset of VA 0x205a9c

[?] can't find file_offset of VA 0x205f00

[?] can't find file_offset of VA 0x206424

[?] can't find file_offset of VA 0x20673c

[?] can't find file_offset of VA 0x206a98

[?] can't find file_offset of VA 0x206c64

[?] can't find file_offset of VA 0x206d4c

[?] can't find file_offset of VA 0x207004

[?] can't find file_offset of VA 0x20716c

[?] can't find file_offset of VA 0x20759c

[?] can't find file_offset of VA 0x207938

[?] can't find file_offset of VA 0x207d64

[?] can't find file_offset of VA 0x208018

[?] can't find file_offset of VA 0x2080f8

[?] can't find file_offset of VA 0x2081b4

[?] can't find file_offset of VA 0x2084cc

[?] can't find file_offset of VA 0x20887c

[?] can't find file_offset of VA 0x208b50

[?] can't find file_offset of VA 0x208b60

[?] can't find file_offset of VA 0x208fb4

[?] can't find file_offset of VA 0x21ad00

[?] can't find file_offset of VA 0x21adf4

[?] can't find file_offset of VA 0x21afd8

[?] can't find file_offset of VA 0x21b3a4

[?] can't find file_offset of VA 0x21cef0

[?] can't find file_offset of VA 0x21d1b8

[?] can't find file_offset of VA 0x21d528

[?] can't find file_offset of VA 0x21e134

[?] can't find file_offset of VA 0x21fea0

[?] can't find file_offset of VA 0x2217ac

[?] can't find file_offset of VA 0x2220c0

[?] can't find file_offset of VA 0x2226dc

[?] can't find file_offset of VA 0x223140

[?] can't find file_offset of VA 0x223a90

[?] can't find file_offset of VA 0x223e0c

[?] can't find file_offset of VA 0x231e74

[?] can't find file_offset of VA 0x232014

[?] can't find file_offset of VA 0x2322e0

[?] can't find file_offset of VA 0x232634

[?] can't find file_offset of VA 0x232d0c

[?] can't find file_offset of VA 0x235fb0

[?] can't find file_offset of VA 0x236314

[?] can't find file_offset of VA 0x238350

[?] can't find file_offset of VA 0x238a14

[?] can't find file_offset of VA 0x239bcc

[?] can't find file_offset of VA 0x23a6c0

[?] can't find file_offset of VA 0x23b2cc

[?] can't find file_offset of VA 0x23b2e0

[?] can't find file_offset of VA 0x23b2f4

[?] can't find file_offset of VA 0x23b308

[?] can't find file_offset of VA 0x23b31c

[?] can't find file_offset of VA 0x23b330

[?] can't find file_offset of VA 0x23b344

[?] can't find file_offset of VA 0x14b4d0

[?] can't find file_offset of VA 0x0

Art.exe- Advanced Registry Tracer