McCHSvc.exe
by McAfee / Trellix
Endpoint Security
Summary
McAfee Change Control service
McCHSvc.exe is the 1962nd most commonly executed Windows program in EchoTrail's dataset, observed 322 times across enterprise environments. It typically runs from C:\Program Files\McAfee Security Scan\3.11.500 and it is most often launched by services.exe.
1962nd
most commonly executed Windows program
322
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Program Files\McAfee Security Scan\3.11.50011.49%
- C:\Program Files\McAfee Security Scan\3.11.20237.14%
- C:\Program Files\McAfee Security Scan\3.11.9686.21%
- C:\Program Files\McAfee Security Scan\3.11.11375.9%
- C:\Program Files\McAfee Security Scan\3.11.19245.28%
- C:\Program Files\McAfee Security Scan\3.11.17194.66%
- C:\Program Files\McAfee Security Scan\3.11.10124.35%
- C:\Program Files\McAfee Security Scan\3.11.15124.35%
- C:\Program Files\McAfee Security Scan\3.11.18444.35%
- C:\Program Files\McAfee Security Scan\3.11.8124.04%
Top Hashes (SHA256)
- 40fecde3494578ffb31c6457911529c093b6bd76ff257c858a132d0e1bb4cc8312.17%
- 08272159e69fcf8f77424cc1996648bea7d3dc372f0de9d1b65717ed71b557357.57%
- a86dbba56d9f2ed03b76006c456a67450a41bc6df284883dcc49c29cd900f1226.25%
- f92bcfde38ba473e369bdf6fe84a63aeacadd33adeb80440a2a897373d0a21335.59%
- e1247b62c389939f0b17e9c90dc38925eb2c7a83982039f12e81ec001744149d4.93%
- 71d20b3fec326a29dff74cec63e612ba22061a659b0ed69e9c0b3da5e7e9505d4.61%
- f4477293383247cfad7806d2efdd7000d05323364ff100163d92e2af55fd71584.61%
- 3cee3fbbc7401d810f1666d50a95d0c70dfef9754225b3332c8f13fc4196bff04.28%
- b77bc75d5ea7740cc3f903bc4cac8a0d19c76b178edf2a5413516bdefee34b263.95%
- c4d67399779ea868aff072021ffed629065233bc5502cd3623c908b9ef2377fc3.95%
Process Ancestry
Top Grandparents
- wininit.exe79.51%
Top Parents
- services.exe76.4%
- uninstallx.exe11.49%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about McCHSvc.exe
Rocky answers questions about McCHSvc.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.