filenameChew-WGA v0.9.exe
size9458428 (0x9052fc)
md56738d790fc0f3928a8a5f19d829cae4d
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Tool.Wpakill-15 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
0018
19803415
10415
14729927
10896611
109782141
11978287
617351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4a411773
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x2f000
SizeOfInitializedData0x70000
SizeOfUninitializedData0
AddressOfEntryPoint0x173a6
BaseOfCode0x1000
BaseOfData0x30000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xa4000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x2e9060x2f000R-X CODE
.rdata0x300000x842e0x9000R-- IDATA
.data0x390000x9d080x6000RW- IDATA
.rsrc0x430000x609fc0x61000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x36b280xb4
RESOURCE0x430000x609fc
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x300000x4ac
Delay_IAT00
CLR_Header00
typenamesizecp
CURSOR#93081252
CURSOR#101801252
BITMAP#2656715081252
BITMAP#309941841252
BITMAP#309953641252
BITMAP#309963241252
ICON#111281252
ICON#242641252
ICON#396401252
ICON#4169361252
ICON#5676241252
ICON#62703761252
ICON#737521252
ICON#896401252
DIALOG#1021501252
DIALOG#307212321252
STRING#38411301252
STRING#3842421252
STRING#38433301252
STRING#385712501252
STRING#38586741252
STRING#38597321252
STRING#38651721252
STRING#38662221252
STRING#386712201252
STRING#38686121252
STRING#3869441252
GROUP_CURSOR#30977341252
GROUP_ICON#128901252
VERSION#19681252
MANIFEST#19011252
idlangstring
614401033Open
614411033Save As
614421033All Files (*.*)
614431033Untitled
614461033an unnamed file
614571033&Hide
614721033No error message is available.
614731033An unsupported operation was attempted.
614741033A required resource was unavailable.
614751033Out of memory.
614761033An unknown error has occurred.
616961033Invalid filename.
616971033Failed to open document.
616981033Failed to save document.
616991033Save changes to %1?
617001033Failed to create empty document.
617011033The file is too large to open.
617021033Could not start print job.
617031033Failed to launch help.
617041033Internal application error.
617051033Command failed.
617061033Insufficient memory to perform operation.
617071033System registry entries have been removed and the INI file (if any) was deleted.
617081033Not all of the system registry entries (or INI file) were removed.
617091033This program requires the file %s, which was not found on this system.
617101033This program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.
617121033Please enter an integer.
617131033Please enter a number.
617141033Please enter an integer between %1 and %2.
617151033Please enter a number between %1 and %2.
617161033Please enter no more than %1 characters.
617171033Please select a button.
617181033Please enter an integer between 0 and 255.
617191033Please enter a positive integer.
617201033Please enter a date and/or time.
617211033Please enter a currency.
617281033Unexpected file format.
617291033%1 Cannot find this file. Please verify that the correct path and file name are given.
617301033Destination disk drive is full.
617311033Unable to read from %1, it is opened by someone else.
617321033Unable to write to %1, it is read-only or opened by someone else.
617331033An unexpected error occurred while reading %1.
617341033An unexpected error occurred while writing %1.
618361033Unable to read write-only property.
618371033Unable to write read-only property.
618401033Unable to load mail system support.
618411033Mail system DLL is invalid.
618421033Send Mail failed to send message.
618561033No error occurred.
618571033An unknown error occurred while accessing %1.
618581033%1 was not found.
618591033%1 contains an invalid path.
618601033%1 could not be opened because there are too many open files.
618611033Access to %1 was denied.
618621033An invalid file handle was associated with %1.
618631033%1 could not be removed because it is the current directory.
618641033%1 could not be created because the directory is full.
618651033Seek failed on %1
618661033A hardware I/O error was reported while accessing %1.
618671033A sharing violation occurred while accessing %1.
618681033A locking violation occurred while accessing %1.
618691033Disk full while accessing %1.
618701033An attempt was made to access %1 past its end.
618721033No error occurred.
618731033An unknown error occurred while accessing %1.
618741033An attempt was made to write to the reading %1.
618751033An attempt was made to access %1 past its end.
618761033An attempt was made to read from the writing %1.
618771033%1 has a bad format.
618781033%1 contained an unexpected object.
618791033%1 contains an incorrect schema.
618881033pixels
module_namehintordfunction_name
KERNEL32.dll741WritePrivateProfileStringA
KERNEL32.dll325GetProcessVersion
KERNEL32.dll661SizeofResource
KERNEL32.dll191GetCPInfo
KERNEL32.dll305GetOEMCP
KERNEL32.dll559RtlUnwind
KERNEL32.dll125ExitProcess
KERNEL32.dll670TerminateProcess
KERNEL32.dll415HeapFree
KERNEL32.dll409HeapAlloc
KERNEL32.dll523RaiseException
KERNEL32.dll368GetTimeZoneInformation
KERNEL32.dll349GetSystemTime
KERNEL32.dll283GetLocalTime
KERNEL32.dll418HeapReAlloc
KERNEL32.dll610SetEnvironmentVariableA
KERNEL32.dll605SetCurrentDirectoryA
KERNEL32.dll336GetStartupInfoA
KERNEL32.dll202GetCommandLineA
KERNEL32.dll185GetACP
KERNEL32.dll419HeapSize
KERNEL32.dll447LCMapStringA
KERNEL32.dll448LCMapStringW
KERNEL32.dll265GetEnvironmentVariableA
KERNEL32.dll373GetVersionExA
KERNEL32.dll413HeapDestroy
KERNEL32.dll703VirtualFree
KERNEL32.dll699VirtualAlloc
KERNEL32.dll440IsBadWritePtr
KERNEL32.dll651SetUnhandledExceptionFilter
KERNEL32.dll33CompareStringA
KERNEL32.dll34CompareStringW
KERNEL32.dll277GetFileType
KERNEL32.dll636SetStdHandle
KERNEL32.dll685UnhandledExceptionFilter
KERNEL32.dll178FreeEnvironmentStringsA
KERNEL32.dll179FreeEnvironmentStringsW
KERNEL32.dll262GetEnvironmentStrings
KERNEL32.dll264GetEnvironmentStringsW
KERNEL32.dll621SetHandleCount
KERNEL32.dll338GetStdHandle
KERNEL32.dll339GetStringTypeA
KERNEL32.dll342GetStringTypeW
KERNEL32.dll437IsBadReadPtr
KERNEL32.dll434IsBadCodePtr
KERNEL32.dll391GlobalFlags
KERNEL32.dll612SetErrorMode
KERNEL32.dll676TlsGetValue
KERNEL32.dll331GetProfileStringA
KERNEL32.dll463LocalReAlloc
KERNEL32.dll677TlsSetValue
KERNEL32.dll399GlobalReAlloc
KERNEL32.dll675TlsFree
KERNEL32.dll395GlobalHandle
KERNEL32.dll674TlsAlloc
KERNEL32.dll456LocalAlloc
KERNEL32.dll102EnterCriticalSection
KERNEL32.dll449LeaveCriticalSection
KERNEL32.dll85DeleteCriticalSection
KERNEL32.dll426InitializeCriticalSection
KERNEL32.dll620SetFileTime
KERNEL32.dll667SystemTimeToFileTime
KERNEL32.dll458LocalFileTimeToFileTime
KERNEL32.dll276GetFileTime
KERNEL32.dll483MulDiv
KERNEL32.dll625SetLastError
KERNEL32.dll180FreeLibrary
KERNEL32.dll372GetVersion
KERNEL32.dll761lstrcatA
KERNEL32.dll393GlobalGetAtomNameA
KERNEL32.dll383GlobalAddAtomA
KERNEL32.dll388GlobalFindAtomA
KERNEL32.dll294GetModuleHandleA
KERNEL32.dll403GlobalUnlock
KERNEL32.dll392GlobalFree
KERNEL32.dll469LockResource
KERNEL32.dll163FindResourceA
KERNEL32.dll455LoadResource
KERNEL32.dll396GlobalLock
KERNEL32.dll385GlobalAlloc
KERNEL32.dll387GlobalDeleteAtom
KERNEL32.dll249GetCurrentThread
KERNEL32.dll250GetCurrentThreadId
KERNEL32.dll767lstrcmpiA
KERNEL32.dll450LoadLibraryA
KERNEL32.dll318GetProcAddress
KERNEL32.dll609SetEndOfFile
KERNEL32.dll686UnlockFile
KERNEL32.dll467LockFile
KERNEL32.dll170FlushFileBuffers
KERNEL32.dll735WriteFile
KERNEL32.dll247GetCurrentProcess
KERNEL32.dll99DuplicateHandle
KERNEL32.dll764lstrcmpA
KERNEL32.dll138FileTimeToSystemTime
KERNEL32.dll484MultiByteToWideChar
KERNEL32.dll722WideCharToMultiByte
KERNEL32.dll429InterlockedDecrement
KERNEL32.dll45CreateDirectoryA
KERNEL32.dll477MoveFileA
KERNEL32.dll653SetVolumeLabelA
KERNEL32.dll260GetDriveTypeA
KERNEL32.dll245GetCurrentDirectoryA
KERNEL32.dll274GetFileSize
KERNEL32.dll256GetDiskFreeSpaceA
KERNEL32.dll175FormatMessageA
KERNEL32.dll460LocalFree
KERNEL32.dll53CreateFileMappingA
KERNEL32.dll470MapViewOfFile
KERNEL32.dll688UnmapViewOfFile
KERNEL32.dll776lstrlenA
KERNEL32.dll68CreateProcessA
KERNEL32.dll282GetLastError
KERNEL32.dll267GetExitCodeProcess
KERNEL32.dll357GetTempPathA
KERNEL32.dll292GetModuleFileNameA
KERNEL32.dll551RemoveDirectoryA
KERNEL32.dll616SetFileAttributesA
KERNEL32.dll87DeleteFileA
KERNEL32.dll432InterlockedIncrement
KERNEL32.dll157FindNextFileA
KERNEL32.dll52CreateFileA
KERNEL32.dll618SetFilePointer
KERNEL32.dll536ReadFile
KERNEL32.dll27CloseHandle
KERNEL32.dll278GetFullPathNameA
KERNEL32.dll773lstrcpynA
KERNEL32.dll375GetVolumeInformationA
KERNEL32.dll269GetFileAttributesA
KERNEL32.dll770lstrcpyA
KERNEL32.dll148FindFirstFileA
KERNEL32.dll144FindClose
KERNEL32.dll137FileTimeToLocalFileTime
KERNEL32.dll411HeapCreate
USER32.dll522ScreenToClient
USER32.dll2AdjustWindowRectEx
USER32.dll323GetSysColor
USER32.dll441MapWindowPoints
USER32.dll657UpdateWindow
USER32.dll58ClientToScreen
USER32.dll340GetWindowDC
USER32.dll12BeginPaint
USER32.dll187EndPaint
USER32.dll627TabbedTextOutA
USER32.dll175DrawTextA
USER32.dll356GrayStringA
USER32.dll427LoadStringA
USER32.dll237GetClassNameA
USER32.dll490PtInRect
USER32.dll324GetSysColorBrush
USER32.dll369InflateRect
USER32.dll141DestroyMenu
USER32.dll378InvalidateRect
USER32.dll678WinHelpA
USER32.dll231GetClassInfoA
USER32.dll498RegisterClassA
USER32.dll284GetMenu
USER32.dll290GetMenuItemCount
USER32.dll322GetSubMenu
USER32.dll291GetMenuItemID
USER32.dll89CreateWindowExA
USER32.dll235GetClassLongA
USER32.dll578SetPropA
USER32.dll314GetPropA
USER32.dll22CallWindowProcA
USER32.dll517RemovePropA
USER32.dll132DefWindowProcA
USER32.dll301GetMessageTime
USER32.dll300GetMessagePos
USER32.dll264GetForegroundWindow
USER32.dll560SetForegroundWindow
USER32.dll338GetWindow
USER32.dll466OffsetRect
USER32.dll377IntersectRect
USER32.dll625SystemParametersInfoA
USER32.dll347GetWindowPlacement
USER32.dll348GetWindowRect
USER32.dll68CopyRect
USER32.dll253GetDC
USER32.dll515ReleaseDC
USER32.dll185EndDialog
USER32.dll540SetActiveWindow
USER32.dll76CreateDialogIndirectParamA
USER32.dll142DestroyWindow
USER32.dll286GetMenuCheckMarkDimensions
USER32.dll408LoadBitmapA
USER32.dll295GetMenuState
USER32.dll452ModifyMenuA
USER32.dll569SetMenuItemBitmaps
USER32.dll52CheckMenuItem
USER32.dll181EnableMenuItem
USER32.dll307GetNextDlgTabItem
USER32.dll298GetMessageA
USER32.dll221GetActiveWindow
USER32.dll274GetKeyState
USER32.dll21CallNextHookEx
USER32.dll666ValidateRect
USER32.dll402IsWindowVisible
USER32.dll252GetCursorPos
USER32.dll610SetWindowsHookExA
USER32.dll281GetLastActivePopup
USER32.dll646UnhookWindowsHookEx
USER32.dll309GetParent
USER32.dll559SetFocus
USER32.dll400IsWindowEnabled
USER32.dll618ShowWindow
USER32.dll603SetWindowPos
USER32.dll600SetWindowLongA
USER32.dll257GetDlgCtrlID
USER32.dll351GetWindowTextLengthA
USER32.dll350GetWindowTextA
USER32.dll606SetWindowTextA
USER32.dll342GetWindowLongA
USER32.dll392IsDialogMessageA
USER32.dll527SendDlgItemMessageA
USER32.dll258GetDlgItem
USER32.dll47CharUpperA
USER32.dll399IsWindow
USER32.dll480PostQuitMessage
USER32.dll651UnregisterClassA
USER32.dll358HideCaret
USER32.dll613ShowCaret
USER32.dll44CharToOemBuffA
USER32.dll463OemToCharBuffA
USER32.dll684wsprintfA
USER32.dll458MsgWaitForMultipleObjects
USER32.dll642TranslateMessage
USER32.dll149DispatchMessageA
USER32.dll446MessageBoxA
USER32.dll332GetTopWindow
USER32.dll512RegisterWindowMessageA
USER32.dll228GetCapture
USER32.dll183EnableWindow
USER32.dll410LoadCursorA
USER32.dll550SetCursor
USER32.dll396IsIconic
USER32.dll326GetSystemMetrics
USER32.dll240GetClientRect
USER32.dll169DrawIcon
USER32.dll478PostMessageA
USER32.dll414LoadIconA
USER32.dll532SendMessageA
USER32.dll476PeekMessageA
USER32.dll401IsWindowUnicode
USER32.dll37CharNextA
USER32.dll126DefDlgProcA
USER32.dll166DrawFocusRect
USER32.dll210ExcludeUpdateRgn
USER32.dll263GetFocus
GDI32.dll482SetMapMode
GDI32.dll502SetViewportOrgEx
GDI32.dll396OffsetViewportOrgEx
GDI32.dll501SetViewportExtEx
GDI32.dll449ScaleViewportExtEx
GDI32.dll505SetWindowExtEx
GDI32.dll450ScaleWindowExtEx
GDI32.dll384IntersectClipRect
GDI32.dll83DeleteObject
GDI32.dll293GetDeviceCaps
GDI32.dll77CreateSolidBrush
GDI32.dll426PtVisible
GDI32.dll430RectVisible
GDI32.dll517TextOutA
GDI32.dll158ExtTextOutA
GDI32.dll149Escape
GDI32.dll462SetBkMode
GDI32.dll351GetStockObject
GDI32.dll455SelectObject
GDI32.dll441RestoreDC
GDI32.dll448SaveDC
GDI32.dll80DeleteDC
GDI32.dll335GetObjectA
GDI32.dll461SetBkColor
GDI32.dll499SetTextColor
GDI32.dll282GetClipBox
GDI32.dll404PatBlt
GDI32.dll48CreateDIBitmap
GDI32.dll368GetTextExtentPointA
GDI32.dll17BitBlt
GDI32.dll42CreateCompatibleDC
GDI32.dll36CreateBitmap
comdlg32.dll7GetFileTitleA
WINSPOOL.DRV71DocumentPropertiesA
WINSPOOL.DRV28ClosePrinter
WINSPOOL.DRV124OpenPrinterA
ADVAPI32.dll347RegCloseKey
ADVAPI32.dll351RegCreateKeyExA
ADVAPI32.dll370RegOpenKeyExA
ADVAPI32.dll390RegSetValueExA
SHELL32.dll63SHFileOperationA
COMCTL32.dll17

StringTable 04090000

CommentsCreated with AutoPlay Media Studio (www.indigorose.com)
CompanyNameAnemeros Software
FileDescriptionThe Perpetuation Endeavor
FileVersion0.9.0.0
InternalNameams60_launch
LegalCopyrightCopyright (c) 2009 - Anemeros Software
LegalTrademarksChew-WGA
OriginalFilenamecw.exe
ProductNameChew-WGA v0.9
ProductVersion0.9.0.0

VS_FIXEDFILEINFO

FileVersion0.9.0.0
ProductVersion0.9.0.0
StrucVersion0
FileFlagsMask0
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
0655360EXE06/23/2009 17:57:07#
15c115HTM#
a00bf8802877ZIP#
Scanning the drive for archives:
1 file, 9458428 bytes (9237 KiB)


--
Type = zip
Offset = 655551
Physical Size = 8802877

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2003-05-27 19:27:00 ....A         3872         3078  AutoPlay/Audio/Click1.ogg
2003-05-27 19:27:00 ....A         3833         3042  AutoPlay/Audio/High1.ogg
2007-02-16 09:46:00 ....A         4407         3810  AutoPlay/Audio/Shekere.ogg
2009-10-15 14:18:22 ....A      1763879      1764393  AutoPlay/autorun.cdd
2008-05-30 23:02:42 ....A        16178        15661  AutoPlay/Buttons/Baslat.Btn
2009-09-12 13:08:28 ....A        17784        14589  AutoPlay/Buttons/button.btn
2008-04-04 12:05:22 ....A         5093         4693  AutoPlay/Buttons/Cik11.Btn
2008-04-19 12:09:28 ....A         5301         4911  AutoPlay/Buttons/Cik-2.Btn
2008-03-27 09:16:08 ....A         3485         3270  AutoPlay/Buttons/Home2.Btn
2008-04-19 12:19:38 ....A         4963         4579  AutoPlay/Buttons/Sol-4.Btn
2009-08-27 16:42:38 ....A       370070       159962  AutoPlay/Icons/mainicon.ico
2009-09-22 11:10:22 ....A        43576        20260  AutoPlay/Images/credits-screen.jpg
2009-09-12 16:00:24 ....A       139978       121274  AutoPlay/Images/done-install.jpg
2009-09-13 10:17:34 ....A       144876       123350  AutoPlay/Images/done-uninstall.jpg
2009-10-06 06:29:52 ....A        23694        14303  AutoPlay/Images/genuine-chew.jpg
2009-10-01 16:03:04 ....A       154253       127948  AutoPlay/Images/install-error.jpg
2009-09-22 11:57:58 ....A       174138       150896  AutoPlay/Images/main-screen.jpg
2009-10-01 16:05:50 ....A       156028       129729  AutoPlay/Images/uninstall-error.jpg
2009-10-01 16:09:44 ....A       167196       142010  AutoPlay/Images/wait-install.jpg
2009-10-01 16:10:40 ....A       169337       143878  AutoPlay/Images/wait-uninstall.jpg
2009-09-12 15:29:08 ....A         4169         3974  AutoPlay/Images/win7-logo.jpg
2009-09-21 12:49:02 ....A        16521        16397  AutoPlay/Images/Win7VistaLogo.png
2005-08-26 10:50:46 ....A       139264        59463  AutoPlay/Plugins/IRDissolveTransition.tns
2009-10-14 21:20:12 ....A      4134376      4135653  AutoPlay/Scripts/chew.enc
2009-10-15 14:18:22 ....A      3190784      1466183  autorun.exe
2009-10-15 13:24:44 ....A          228          180  autorun.exe.mbxcfg
2009-08-27 16:42:38 ....A       370070       159962  mainicon.ico
------------------- ----- ------------ ------------  ------------------------
2009-10-15 14:18:22           11227353      8797448  27 files
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK