mcagent.exe
by McAfee / Trellix
Endpoint Security
Summary
McAfee Agent
mcagent.exe is the 2322nd most commonly executed Windows program in EchoTrail's dataset, observed 206 times across enterprise environments. It typically runs from C:\Program Files\mcafee.com\agent and it is most often launched by svchost.exe.
2322nd
most commonly executed Windows program
206
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Program Files\mcafee.com\agent84.95%
- C:\...15.05%
Top Hashes (SHA256)
- 63a9fe22dbad17c397ec38fc2ea56ee642abfe8c4c6939186b1bf78f04fd3fcb75%
- 007e31fe594f5f5db7f4ad19939eada9a75cbe964599f53db4cff4ac38bc2afb11.7%
- 333665f923f3dddda3a5a680e6df4a5c697b2bacc2039f7ea1365c80a13f32fe7.45%
- 15176338662144b7c484de96a691d9d47c118f45f1c5f534cd468a97314cc4ce3.72%
- 398c2490da0e535de8ab96c960d2e34a654a0632420787ec5da453c5fd2442ba1.6%
- fde520d8c6bcfc5420bb4b97a8010287c2bd82e5801e6b8750b0c4fd9bdfac010.53%
Process Ancestry
Top Grandparents
- services.exe54.29%
- explorer.exe40%
- MCUPDA~1.EXE2.86%
Top Parents
- svchost.exe91.26%
- runonce.exe6.8%
- McInst.exe1.94%
Top Children
- McUICnt.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about mcagent.exe
Rocky answers questions about mcagent.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.