home

twagent.exe

Beehive Software Ltd.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘ChildWebGuardian PRO Agent’.
Publisher:
Beehive Software Ltd.  (signed and verified)

MD5:
8e0b1062901182dcc1254e4e701f98e0

SHA-1:
592743e0108496e2e82b6afa4c861759eefdcaed

SHA-256:
44ad398df6d7ff5da33e7b5beccad43339cbf72e6d498682f76d6a001dabb3f8

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/19/2024 12:16:43 AM UTC  (today)

File size:
1.6 MB (1,722,264 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\childwebguardian pro\twagent.exe

Digital Signature
Signed by:
Beehive Software Ltd.

Authority:
VeriSign, Inc.

Valid from:
1/14/2010 2:00:00 AM

Valid to:
1/16/2011 1:59:59 AM

Subject:
CN=Beehive Software Ltd., OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Beehive Software Ltd., L=Murom, S=Vladimir rgn., C=RU

Issuer:
CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
56A53D14620AA8D9A5FEBDE5EA879613

File PE Metadata
Compilation timestamp:
1/12/2011 3:11:53 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:2yWjWDA2HACg2hBESg1OwvgqNeQO9skZoQO8Lr8qaT3ToGqzE3:x1h+XO9TNr8XT3ToTzE3

Entry address:
0x14BCD0

Entry point:
55, 8B, EC, 83, C4, EC, 33, C0, 89, 45, EC, B8, 5C, 90, 54, 00, E8, B3, CC, EB, FF, 33, C0, 55, 68, 17, BE, 54, 00, 64, FF, 30, 64, 89, 20, E8, D4, 11, F4, FF, 8B, 15, 24, 61, 55, 00, 8B, 12, 8D, 45, EC, B9, 30, BE, 54, 00, E8, 53, A7, EB, FF, 8B, 45, EC, E8, 9F, 12, EC, FF, 84, C0, 0F, 85, E4, 00, 00, 00, A1, 28, 61, 55, 00, 80, 38, 07, 77, 0F, E8, 9C, 08, F4, FF, E8, 1F, 09, F4, FF, E8, A2, 09, F4, FF, E8, 8D, 0A, F4, FF, 84, C0, 0F, 85, BE, 00, 00, 00, 68, 50, BE, 54, 00, 6A, 01, 6A, 00, 6A, 00, E8, 21...
 
[+]

Entropy:
6.7120

Developed / compiled with:
Microsoft Visual C++

Code size:
1.3 MB (1,353,728 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
ChildWebGuardian PRO Agent

Command:
"C:\Program Files\childwebguardian pro\twagent.exe"


Scan twagent.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.