CmdID

CmdID / Files

ReAgentc.exe

Microsoft Windows Recovery Agent file version info

Program on Windows 15 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real ReAgentc.exe?

file version info and known copies
Installed inC:\Windows\SysWOW64\
C:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Windows Recovery Agent

15 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\ReAgentc.exe · signed by Microsoft Windows

5517a4d7a5fd8ca91ec0065c3374616443a16dc2db818089075a6ee3fed335c2

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ReAgentc.exe · signed by Microsoft Windows

7f5ba727c557a2ae96b82e00644c098212629a60739bc498d4bd7d374bdbec75

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ReAgentc.exe · signed by Microsoft Windows

94d0026cf4d5ae83628dbda51b9fbc720c91b5ea7e180428877b8c95f5998af6

10.0.19041.572 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ReAgentc.exe · signed by Microsoft Windows

82b0a8ea592c68ca1f913e716a82d2bbe32a5a34654a836c35b1e7adc77c9342

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\ReAgentc.exe · signed by Microsoft Windows

125ee07fc9d013aa89a80b742326318e30eaef40c5edff283c5ffdf41f93616b

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\ReAgentc.exe · signed by Microsoft Windows

6ed3121e5a6299ee1030f52d800f3f1f2ee1aab5c73c99e0dd34034a23f7d44c

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ReAgentc.exe · signed by Microsoft Windows

fa698e4b50cc76abfbf99e5d27c81d19c26f2af529ef4d2568a2f9aba436e455

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ReAgentc.exe · signed by Microsoft Windows

1a7cf3a53fe82b426d93cfbb9fd00a7876fcaf0dc09a5675aff945d30c83db0d

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\ReAgentc.exe · signed by Microsoft Windows

1b95011af72411c08909c8db18f53dd6ff0246380944bad2af7c5599f9287cf0

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\ReAgentc.exe · signed by Microsoft Windows

93cd96077494331129e20718a8e9b21e7bad04da6ce563fcc56d03ae986dc800

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ReAgentc.exe · signed by Microsoft Windows

ef577d51307e12c4315c0504199b8a01175bf7e742d1ce4c4d41cae4543d6ac4

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\ReAgentc.exe · signed by Microsoft Windows

3216bd1b40815df22678ec7e7e5a0f9651e5c890bce82ec29c6a2f1a6f38e878

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\ReAgentc.exe · signed by Microsoft Windows

f0ea6baaf9db83115d4ce8a4f9d3bbc8a1bc495d60c2a98d9846a963864e1261

6.3.9600.17031 (winblue_gdr.140221-1952) · C:\windows\SysWOW64\ReAgentc.exe · not signed

9d097860d075865216c42702302493389bb4d102e4a9b26acf1f56c0df71f595

6.3.9600.17031 (winblue_gdr.140221-1952) · C:\windows\system32\ReAgentc.exe · not signed

b91a2c822bc561230378a81b2e8e3704735fa274d4f13eb116f6abe7779a42b2

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name ReAgentc.exe
mediumWindows Recovery Environment Disabled Via ReagentcDaniel Koifman (KoifSec), Michael Vilshin