home

IPWatcher.exe

IP Watcher

Gear Box Computers

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘IPWatcher’.
Publisher:
Gear Box Computers  (signed and verified)

Product:
IP Watcher

Version:
3.00.0030

MD5:
db94c9c5fc1242fda298a9ca7b69f310

SHA-1:
371aeb70a24ace9cc052682bde2d4d780949a475

SHA-256:
75d6b4630a13439a734f84a8a3eddce5719135189a6e04c5cbdfede82835ce9c

Scanner detections:
2 / 68

Status:
Clean  (2 probable false positive detections)

Explanation:
These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:
12/30/2024 9:28:30 PM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Trojan.VbCrypt.250
9.0.1.0224

Vba32 AntiVirus
Trojan.VB.Acid
3.12.26.4

File size:
1.5 MB (1,589,992 bytes)

Product version:
3.00.0030

Copyright:
Gear Box Computers

Trademarks:
IP Watcher

Original file name:
IPWatcher.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\ip watcher\ipwatcher.exe

Digital Signature
Signed by:
Gear Box Computers

Authority:
The USERTRUST Network

Valid from:
7/28/2009 5:00:00 PM

Valid to:
7/29/2010 4:59:59 PM

Subject:
CN=Gear Box Computers, O=Gear Box Computers, STREET=18324 Sheldon Rd, L=Brook Park, S=OH, PostalCode=44142, C=US

Issuer:
CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, S=UT, C=US

Serial number:
1D3B23F14ED23E6B8F5650FCABBBA99A

File PE Metadata
Compilation timestamp:
11/13/2009 1:39:12 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
24576:Jdyryiy641wjjEuTH0ZYLdmkLbOkEXjr/n4+mCgoCGJgfyyf4fQ6e9Lde/B:Jy141wjQC0ZYz+/D4+xgdEY6V

Entry address:
0x319E15

Entry point:
E8, 3B, FF, FF, FF, 05, 0A, 08, 00, 00, FF, E0, E8, 2F, FF, FF, FF, 05, 6D, 09, 00, 00, FF, E0, E8, 04, 00, 00, 00, FF, FF, FF, FF, 5E, C3, 00, 72, 29, 44, E1, C3, D0, 1B, C3, A2, F4, 46, 04, 9C, 85, 0E, 5E, 07, 22, F0, 31, 0D, BE, 42, 6C, 09, 90, 67, 4B, F4, 27, 07, 43, C7, A3, 27, B9, 19, 55, BA, 8D, 32, E1, FB, 6E, F3, 81, 15, 58, AA, B3, 3A, FB, B2, 15, 1E, 64, 00, 28, AD, C4, 78, 84, 5D, B1, 21, A8, 06, 0F, 7A, 88, 7E, 5D, 1B, 83, B9, 63, 4B, 8D, 93, B3, A5, 0C, 3F, 28, 8A, 6C, E7, 63, 11, 61, 3C, AC...
 
[+]

Entropy:
7.9502  (probably packed)

Code size:
112 KB (114,688 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
IPWatcher

Command:
"C:\Program Files\ip watcher\ipwatcher.exe" systray


Scan IPWatcher.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.