Should I block it?

No, this file is 100% safe to run.

Additional versions

4.9.2.8	60.00%
4.9.0.33	20.00%
4.8.2.3	20.00%

Relationships

PE file structure

Show functions

Import table

advapi32.dll

RegisterEventSourceW, CloseServiceHandle, DeleteService, OpenSCManagerW, StartServiceCtrlDispatcherW, OpenServiceW, DeregisterEventSource, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, ChangeServiceConfig2W, StartServiceW, SetServiceStatus, QueryServiceStatusEx, RegisterServiceCtrlHandlerW, ReportEventW, ControlService, RegQueryValueExA, RegOpenKeyExA, RegDeleteValueA, RegCloseKey, RegEnumKeyExA, RegEnumValueA, RegCreateKeyExW, RevertToSelf, ImpersonateLoggedOnUser, GetSidSubAuthorityCount, SetThreadToken, GetSidSubAuthority, GetSidIdentifierAuthority, CryptHashData, CryptDestroyHash, CryptCreateHash, CryptReleaseContext, CryptAcquireContextW, CryptGetHashParam, CreateServiceW, FreeSid, AllocateAndInitializeSid, EqualSid, GetTokenInformation, OpenThreadToken, AdjustTokenPrivileges, DuplicateTokenEx, LookupPrivilegeValueW, SetTokenInformation, CreateProcessAsUserW, OpenProcessToken, RegSetValueExW, RegOpenKeyExW, RegOpenCurrentUser, RegQueryInfoKeyW, RegQueryValueExW

crypt32.dll

CertFindCertificateInStore, CryptMsgGetParam, CertCloseStore, CryptMsgClose, CertFreeCertificateContext, CertGetNameStringW, CryptQueryObject

iphlpapi.dll

GetIfEntry, NotifyRouteChange, NotifyAddrChange, GetIfTable, GetBestRoute, SendARP, DeleteIpNetEntry, GetIpNetTable, IpRenewAddress, IpReleaseAddress, GetAdaptersInfo, GetInterfaceInfo

kernel32.dll

WideCharToMultiByte, GetTickCount, SystemTimeToFileTime, ResetEvent, RaiseException, DebugBreak, WaitForSingleObject, SetEvent, GetLocaleInfoW, GetUserDefaultLangID, GlobalFree, GlobalAlloc, GetCurrentThread, SetFileAttributesW, RemoveDirectoryW, SetCurrentDirectoryW, SetFileApisToOEM, MoveFileW, GetCurrentDirectoryW, GetTempPathW, MultiByteToWideChar, CopyFileW, CreateDirectoryW, GetCommandLineW, DuplicateHandle, Process32NextW, ProcessIdToSessionId, Process32FirstW, SetLastError, TerminateProcess, CreateProcessW, OpenProcess, GetSystemTime, GetCurrentProcessId, DeleteFileW, ReleaseMutex, GetCurrentThreadId, FindNextFileW, FindClose, CreateFileW, GetFileAttributesW, LoadLibraryW, GetCurrentProcess, SetUnhandledExceptionFilter, SetErrorMode, FindFirstFileW, CreateMutexW, GetFullPathNameW, ExpandEnvironmentStringsW, LoadLibraryA, FormatMessageW, FreeLibrary, GetModuleHandleA, GetSystemInfo, GetProcAddress, GetVersionExW, GetModuleHandleW, FormatMessageA, Sleep, GetModuleFileNameW, GetLastError, LocalAlloc, CreateEventW, OpenEventW, CloseHandle, LocalFree, LeaveCriticalSection, EnterCriticalSection, InterlockedDecrement, GetSystemDirectoryA, InterlockedExchange, InterlockedCompareExchange, GetStartupInfoA, UnhandledExceptionFilter, IsDebuggerPresent, QueryPerformanceCounter, GetTimeZoneInformation, GetLocalTime, GetLocaleInfoA, GetUserDefaultLCID, GetSystemTimeAsFileTime, GetComputerNameW, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, lstrlenA, HeapAlloc, HeapFree, GetProcessHeap, GetVersionExA, VirtualQuery

msvcp90.dll

DllMain

msvcr90.dll

DllMain

ole32.dll

CoInitialize, CoUninitialize, CoCreateGuid, CoCreateInstance

shell32.dll

ShellExecuteExA, CommandLineToArgvW, SHGetFolderPathW, ShellExecuteA

user32.dll

wsprintfW, SetWindowPos, GetSystemMetrics, FindWindowW

userenv.dll

ExpandEnvironmentStringsForUserW, CreateEnvironmentBlock

version.dll

VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW

winhttp.dll

WinHttpSetDefaultProxyConfiguration, WinHttpGetIEProxyConfigForCurrentUser

wintrust.dll

WinVerifyTrust

ws2_32.dll

WSAEventSelect, WSAEnumNetworkEvents, WSACloseEvent, WSAResetEvent, WSACreateEvent, WSAWaitForMultipleEvents

NACAgent.exe

Cisco NAC Agent by Cisco Systems (Signed)

Remove NACAgent.exe

Version:	4.8.2.3
MD5:	cf50b1196b096c4ef3abda7ce5c89f53
SHA1:	f0cfabcc8cec901b8bb278752bf24a3d11a71438
SHA256:	979733d9737616d094163263718be18d698ac14a5e314a54cf784a85d2a3354a

Overview

nacagent.exe runs as a service under the name Cisco NAC Agent (NACAgent) with extensive SYSTEM privileges (full administrator access). This is typically installed with the program Cisco NAC Agent published by Cisco Systems, Inc.. The file is digitally signed by Cisco Systems which was issued by the VeriSign certificate authority (CA).

Details

File name:	nacagent.exe
Publisher:	Cisco Systems, Inc.
Product name:	Cisco NAC Agent
Description:	Cisco NAC Agent Service
Typical file path:	C:\Program Files\cisco\cisco nac agent\nacagent.exe
File version:	4.8.2.3
Size:	1.05 MB (1,105,848 bytes)
Certificate
Issued to:	Cisco Systems
Authority (CA):	VeriSign
Effective date:	Monday, February 7, 2011
Expiration date:	Thursday, February 7, 2013
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
Code language:	Microsoft Visual C++ 9.0
.NET CLR:	No

More details

Programs

The following program will install this file

Cisco NAC Agent

Cisco Systems, Inc.

9% remove

Cisco NAC is a network admission control (NAC) system developed by Cisco Systems designed to produce a secure and clean network environment. The system usually installs an application known as the Clean Access Agent on computers that will be connected to the network. This application, in conjunction with both a Clean Access server and a Clean Access Manager, has become common in many universities and corporate environments today. It is ...

Behaviors

Service

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'NACAgent' (Cisco NAC Agent)

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00015361%	0.028634%
Kernel CPU:	0.00005873%	0.013761%
User CPU:	0.00009489%	0.014873%
Kernel CPU time:	330,469 ms/min	100,923,805ms/min
Context switches:	2/sec	284/sec
Memory
Private memory:	5.4 MB	21.59 MB
Private (maximum):	7.12 MB
Private (minimum):	1.1 MB
Non-paged memory:	5.4 MB	21.59 MB
Virtual memory:	45.12 MB	140.96 MB
Virtual memory (peak):	56 MB	169.69 MB
Working set:	1.17 MB	18.61 MB
Working set (peak):	8.62 MB	37.95 MB
Resource allocations
Threads:	3	12
Handles:	133	600
GUI GDI count:	8	103
GUI USER count:	2	49

Process properties

Integrety level:	Undefined
Platform:	32-bit
Command line:	"C:\Program Files\cisco\cisco nac agent\nacagent.exe"
Owner:	SYSTEM
Windows Service
Service name:	NACAgent
Display name:	Cisco NAC Agent
Description:	“Cisco Network Admission Control Agent”
Type:	Win32OwnProcess, InteractiveProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads