Is Agent.exe safe?
Forty-four of 75 engines flagged this unsigned executable, while completed sandbox analysis recorded evasion-related activity and a malware assessment.
The evidence strongly indicates a generic Windows trojan: 44 of 75 engines detected it, including ten high-trust engines. A completed sandbox also produced a malware assessment and recorded privilege-related and security-impairment techniques, so the file should not be run.
36f394a4f38ceec463…8659529d47ed8eRecommended next actions
Before running
Do not run it. Delete this file from the device, then empty the Recycle Bin or Trash.
If you already ran it
Disconnect from the internet, start a full or offline antivirus scan, then secure important accounts from a clean device.
Intelligence
The saved assessment, checked against the scan evidence and recorded coverage.
The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
The evidence strongly indicates a generic Windows trojan: 44 of 75 engines detected it, including ten high-trust engines. A completed sandbox also produced a malware assessment and recorded privilege-related and security-impairment techniques, so the file should not be run.
Detection is broad, with 44 of 75 engines flagging the file and ten high-trust engines contributing independent malicious votes. Microsoft names Malgent, while BitDefender and Emsisoft converge on GenericKDQ; other labels vary between Wacatac, Agent, and Themida-related findings. One completed sandbox produced a malware assessment and recorded T1548 and T1562.001, which are stronger than static packing labels alone. The executable is unsigned and lacks an established publisher history. The six inspected domains had no cached malicious or suspicious hits, but host-reputation coverage did not include every observed IP address. Taken together, the runtime finding and high-trust detection breadth outweigh the absence of a single agreed malware family.
What We Detected
44 of 75 antivirus engines flagged the executable, including ten high-trust detections. Microsoft reported Trojan:Win32/Malgent, BitDefender and Emsisoft reported GenericKDQ, and TrendMicro reported Wacatac; this label variation supports a generic-trojan assessment rather than a reliable named family.
Threat Behavior
One completed sandbox produced a malware assessment and observed T1548 and T1562.001, covering privilege-related activity and impairment of security controls. The sample also showed environment-detection behavior and wrote AgileDotNetRT64.dll into a temporary directory. Six contacted domains had no cached malicious or suspicious reputation hits, but the observed IP addresses were not fully covered by that host check.
What To Do Now
Do not execute the file. Keep endpoint protection enabled, quarantine or remove the sample, and run a full system scan if it has already been opened. Review security logs for related execution, temporary files, and unexpected security-setting changes.
Where this verdict could be wrong3 caveats
- engines.tier1FamilyConsensus.strong=false; only two tier-1 engines converge on Themida, which is a protector rather than a specific malware family.
- contactedHosts.inspected=6 found no cached malicious or suspicious domain hits, although the four observed IP addresses were not included in that six-host inspection count.
- droppedChildren.hasMaliciousChild=false, and externalIntel.yaraify.ruleCount=0 with no CIRCL or MalwareBazaar hit.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- contactedHosts.inspected=6 found no cached malicious or suspicious domain hits
- droppedChildren.hasMaliciousChild=false
- externalIntel.yaraify.ruleCount=0
- No CIRCL or MalwareBazaar match
- 44/75 antivirus detections
- Ten high-trust engines flagged the file
- Completed sandbox produced a malware assessment
- Observed T1548 privilege-related activity
- Observed T1562.001 security-control impairment
- Unsigned Windows executable
Quarantine or delete the file and keep all endpoint protection enabled. If it was executed, perform a full scan and investigate the affected host for related processes, temporary files, and security-control changes.
Coverage & freshness
Complete means the check returned a usable result. It does not mean the file is safe.
Antivirus
Complete44 of 75 engines flagged the file.
Sandbox
Complete1 isolated runtime environment contributed observations.
Network
Partial6 of 10 contacted hosts were cross-checked; coverage is incomplete.
YARA
CompleteRule evaluation completed with no recorded matches.
External intel
Complete3 of 3 independent reference sources completed.
Behavior
Plain-English impact first, then the observed runtime evidence.
Runtime flight recorder
Capture complete- 1isolated sandbox run
- 9MITRE ATT&CK techniques
- 2spawned processes
- 10network contacts
- 11filesystem & mutex artifacts
What this file does
Observed actions and their security significance
High concern: Attempted to impair or bypass security controls.
Moderate concern: Contained obfuscated or packed code that makes inspection harder.
Moderate concern: Communicated over a common application protocol; malware can use this for command-and-control.
Moderate concern: Checked the environment for virtualisation or analysis tools.
Moderate concern: Checks which security software you have installed.
Note: Collects details about your system.
These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.
Threat context
How trojans work
A trojan disguises itself as something useful or harmless to trick you into running it. Once open, it does its real job in the background — anything from stealing data to opening a back door or downloading more malware.
Bottom line:The disguise is the whole trick, so a trustworthy-looking name or icon means nothing.
Attack story
Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.
Input file
The submitted object
- FileObserved
Agent.exe
36f394a4f38ceec463f37b41cff2a7598a1ab5ebf4f86870e98659529d47ed8e
01Uploaded file
Processes
Runtime execution
- ProcessObserved
Observed process
"C:\Users\user\Desktop\_A_g__e___n___t_3_0_4.exe"
02Isolated runtime analysis - ProcessObserved
Observed process
C:\Windows\System32\SecurityHealthService.exe C:\Windows\system32\SecurityHealthService.exe
03Isolated runtime analysis - +1 more recorded observation in Analyst mode
Files
Created or changed
- Written fileObserved
AgileDotNetRT64.dll
C:\Users\<USER>\AppData\Local\Temp\725acf4d-dc1a-4ea8-93ad-5b39d717e1f3\AgileDotNetRT64.dll
04Isolated runtime analysis - Written fileObserved
Logs
C:\ProgramData\Microsoft\Windows Security Health\Logs
05Isolated runtime analysis - +1 more recorded observation in Analyst mode
Network
Hosts contacted
- Contacted hostObserved
eip-terr-na.cdp1.digicert.com.akahost.net
Contact observed during runtime.
06Isolated runtime analysis - Contacted hostObserved
www.msn.com
Contact observed during runtime.
07Isolated runtime analysis - +1 more recorded observation in Analyst mode
7 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.
What this file did when executed
This file was detonated in 1 sandbox; 1 returned "malicious".
Adversary techniques mapped to the MITRE ATT&CK framework.
- eip-terr-na.cdp1.digicert.com.akahost.net
- www.msn.com
- www.msn.com.edgekey.net
- e592.d.akamaiedge.net
- assets.msn.com
- nexusrules.officeapps.live.com
- 8.8.8.8
- 92.223.96.6
- 23.15.3.87
- 23.219.5.163
- HKEY_USERS\S-1-5-21-4270068108-2931534202-3907561125-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids\exefile
- C:\Users\<USER>\AppData\Local\Temp\725acf4d-dc1a-4ea8-93ad-5b39d717e1f3\AgileDotNetRT64.dll
- C:\ProgramData\Microsoft\Windows Security Health\Logs
- C:\Users\user\AppData\Local\Temp\725acf4d-dc1a-4ea8-93ad-5b39d717e1f3
- C:\Users\user\AppData\Local\Temp\725acf4d-dc1a-4ea8-93ad-5b39d717e1f3\AgileDotNetRT64.dll
- C:\Users\user\AppData\Roaming
- WZAgent
- \Sessions\1\BaseNamedObjects\W???Z?A?g??e???n???t
- \BaseNamedObjects\Local\SM0:6552:304:WilStaging_02
- \BaseNamedObjects\Local\SM0:6552:120:WilError_03
- \BaseNamedObjects\Local\ZonesCacheCounterMutex
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache.
- 1f2489fcd11f85db723f…19a011Never scannednever seen before
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Evidence integrity
Chain of custody for the facts preserved in this report.
- 0rule hits recorded
- 44 / 75engines flagged
- 12sources in submission history
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
1 isolated runtime environment classified the observed behavior as malicious.
Verdict inputView chapterProvenanceObservedSourceIsolated runtime analysisObserved at - 02
44 of 75 antivirus engines flagged the file, including AhnLab-V3 and Alibaba.
Verdict inputView chapterProvenanceObservedSourceAntivirus analysisObserved at - 03
A sandbox classified the observed runtime behaviour as malicious.
ProvenanceDerivedSourceSaved report factsObserved at - 04
Scanned file: Agent.exe — 36f394a4f38ceec463f37b41cff2a7598a1ab5ebf4f86870e98659529d47ed8e
ProvenanceObservedSourceUploaded fileObserved at - 05
Observed process — "C:\Users\user\Desktop\_A_g__e___n___t_3_0_4.exe"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 06
Observed process — C:\Windows\System32\SecurityHealthService.exe C:\Windows\system32\SecurityHealthService.exe
ProvenanceObservedSourceIsolated runtime analysisObserved at - 07
File written: AgileDotNetRT64.dll — C:\Users\<USER>\AppData\Local\Temp\725acf4d-dc1a-4ea8-93ad-5b39d717e1f3\AgileDotNetRT64.dll
ProvenanceObservedSourceIsolated runtime analysisObserved at - 08
File written: Logs — C:\ProgramData\Microsoft\Windows Security Health\Logs
ProvenanceObservedSourceIsolated runtime analysisObserved at - 09
Contacted host: eip-terr-na.cdp1.digicert.com.akahost.net — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at - 10
Contacted host: www.msn.com — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at
Detection sources at a glance
Category: generic-trojan
MalwareBazaar, YARAify, and CIRCL hashlookup completed and returned no entries for this hash.
YARA rules
No matchesThe rule pass completed without a saved public match.
44 of 75 engines flagged this file
View all 75 engine results
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Fingerprint and provenance
- File name
- Agent.exe
- Format
- Win32 EXE
- Code signing
- No verified publisher
- Size
- 22.4 MB
- Last analyzed
- Sep 28, 2026, 5:17 PM UTC
36f394a4f38ceec463f37b41cff2a7598a1ab5ebf4f86870e98659529d47ed8eSafety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
This file is dangerous. Treat it as harmful and remove it.
- Recovery step 01
Don't run this file. Delete this file from the device, then empty the Recycle Bin or Trash.
- Recovery step 02
If you already ran it, disconnect from the internet and start with a full antivirus scan or Microsoft Defender Offline scan. If compromise is suspected or the problem persists, use a reputable second-opinion scanner and follow incident-recovery or clean-reinstall guidance.
- Recovery step 03
If you typed any passwords while it was open, change them from a device you trust.
- Recovery step 04
Get a fresh copy from the developer's official site or an official app store.
Safety FAQ
Direct answers grounded in the saved verdict and evidence in this report.
Is Agent.exe malware?
What is Agent.exe?
How many antivirus engines detected Agent.exe?
I already downloaded and ran Agent.exe — what should I do?
How do I remove Agent.exe?
What kind of malware is Agent.exe?
What is the SHA-256 hash of Agent.exe?
How up to date is this analysis of Agent.exe?
Community
Member reviews and reports for this exact file hash.