home

ickgw32i.dll

KidsWatch

Computer Business Solutions, Inc.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘drkly16j’.
Publisher:
Computer Business Solutions, Inc.  (signed and verified)

Product:
KidsWatch

Description:
KW NT Service Module

Version:
8, 64, 201, 136

MD5:
8af27497d17b30853972eb8e7e4b3823

SHA-1:
e4d4ff2c84d021e41e343740c566df1b0b1b1ba4

SHA-256:
ca5a867d785e3cc01cbbbaeddee820a53faa056e6d79a3c3b425add636af728a

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/5/2024 10:16:52 AM UTC  (today)

File size:
1.7 MB (1,785,216 bytes)

Product version:
8, 64, 201, 136

Copyright:
Copyright © 2002 - 2013 Computer Business Solutions, Inc.

File type:
Dynamic link library (Win64 DLL)

Language:
English (United States)

Common path:
C:\Windows\System32\ickgw32i.dll

Digital Signature
Signed by:
Computer Business Solutions, Inc.

Authority:
GlobalSign nv-sa

Valid from:
3/12/2014 8:41:04 AM

Valid to:
5/23/2015 7:21:54 AM

Subject:
E=zarla01@cbsits.com, CN="Computer Business Solutions, Inc.", O="Computer Business Solutions, Inc.", L=Garden City, S=NY, C=US

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121317E9F85981C6E3D86F054456177EA40

File PE Metadata
Compilation timestamp:
5/20/2014 6:37:29 AM

OS version:
4.0

OS bitness:
Win64

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
49152:FfPR9F2hmhLQthMPzWSqejIbIzk0UUdeWP:JDNuWP

Entry address:
0xFB1C0

Entry point:
48, 89, 5C, 24, 08, 48, 89, 74, 24, 10, 57, 48, 83, EC, 20, 83, FA, 01, 49, 8B, F8, 8B, DA, 48, 8B, F1, 75, 05, E8, 8F, 8E, 01, 00, 4C, 8B, C7, 8B, D3, 48, 8B, CE, 48, 8B, 5C, 24, 30, 48, 8B, 74, 24, 38, 48, 83, C4, 20, 5F, E9, 83, FE, FF, FF, CC, CC, CC, 48, 89, 5C, 24, 08, 57, 48, 83, EC, 30, 48, 85, C9, 49, 8B, F8, 48, 8B, DA, 74, 41, 33, D2, 48, C7, C0, E0, FF, FF, FF, 48, F7, F1, 48, 3B, C3, 73, 30, E8, 15, 77, FF, FF, 45, 33, C9, 45, 33, C0, 33, D2, 33, C9, 48, C7, 44, 24, 20, 00, 00, 00, 00, C7, 00...
 
[+]

Entropy:
6.4612

Code size:
1.2 MB (1,279,488 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
drkly16j

Command:
rundll32.exe drkly16j.dll,servicecheck


Scan ickgw32i.dll - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.