13. A system for analyzing executable content within at least one network of an enterprise, comprising: a plurality of collection agents disposed within one or more networks of an enterprise and executable by one or more hardware processors of one or more devices within the one or more networks, wherein each collection agent is configured to detect a presence of multiple instances of executable content within the enterprise; and a central analysis server remotely disposed from and in operative communication with the plurality of collection agents via the one or more networks, the central analysis server comprising: a collection engine, executable by a hardware processor of the central analysis server, that is configured to capture and store the multiple instances of executable content received from the plurality of collection agents; an extraction engine, executable by the hardware processor of the central analysis server, that is configured to extract one or more characteristics from each instance of the executable content; an analysis engine, executable by the hardware processor of the central analysis server, that is configured to: identify associations among the extracted characteristics; determine, based on the associations among the extracted characteristics, that a first portion of executable content is associated with a non-trusted entity; obtain a hash value for the first portion of executable content; and store the hash value and the associated extracted characteristics to create a non-trusted entity profile; and a first database that is configured to store the extracted characteristics, identified associations, and hash value, the first database being accessible by the hardware processor of the central analysis server and the plurality of collection agents such that each of the plurality of collection agents is operable to identify at least another portion of executable content associated with the non-trusted entity based on the hash value that has been recognized and presented in the database, wherein each of the plurality of collection agents is operable to transmit to the central analysis server an indication of notice indicative of a detection of the non-trusted entity at the corresponding collection agent, the indication comprising the hash value, location information but not a copy of the at least another portion of executable content to limit use of enterprise infrastructure resources and so as to update the non-trusted entity profile.
18. The system of claim 13 , wherein the first database is configured to store information specifying a unique location associated with each piece of executable content.