McInst.exe
by McAfee / Trellix
Endpoint Security
Summary
McAfee installer process
McInst.exe is the 2502nd most commonly executed Windows program in EchoTrail's dataset, observed 167 times across enterprise environments. It typically runs from C:\Program Files (x86)\Common Files\McAfee\Installer\11.7.125.0 and it is most often launched by MCUPDA~1.EXE.
2502nd
most commonly executed Windows program
167
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Program Files (x86)\Common Files\McAfee\Installer\11.7.125.024.74%
- C:\Program Files (x86)\Common Files\McAfee\Installer\15.2.116.018.21%
- C:\Program Files (x86)\Common Files\McAfee\Installer\10.0.3017.016.84%
- C:\...12.37%
- C:\Program Files (x86)\Common Files\McAfee\Installer\12.0.114.07.56%
- C:\Program Files (x86)\Common Files\McAfee\Installer\11.5.165.06.87%
- C:\Program Files (x86)\Common Files\McAfee\Installer\12.8.120.03.78%
- C:\ProgramData\...3.09%
- C:\Program Files (x86)\Common Files\McAfee\Installer3.09%
- C:\Program Files (x86)\Common Files\McAfee\Installer\12.7.148.01.72%
Top Hashes (SHA256)
- 9c1241a155eb1281eab3bd267a640eb3d77b808a8389ea9318e8f78d18747a9626.35%
- a83bbdeacb90146c61c41d61c93f339ecf7bbfff53ef602b0439e1913e6579ab21.3%
- f630d0ca2454b5c01d6a205d05974c8e65140ebf57d6838b984d23ef21efd81119.13%
- b3d10f65989c4936936c39a2e9a150bb68df25b9da141f4fbee50f1c077f508d17.69%
- edd6fd0798a37dd9e4228873bfd7bce23d895639560b9926e52a8d36565ff5ac8.66%
- 8f4cb190491489b55447c8e05834f9c96b291f9d4e7e3875f982f610f5814bd92.89%
- 568d971055f65ac72d4690480b9947243032eb5a4c600267b81db58a1529dc2e1.44%
- 245ca5ad8e860923557f1285a8387c0f1ccd279029be4b883b8cbbe5febde9ae1.08%
- f57b428f67487b0ffdfa99f4e86008400d8885fec1a96fbb74c078175ef8f30d0.72%
- 5e677fd989a2e022893ac94e911d68c35d17e97695ce32a4a0df82b877d076e00.36%
Process Ancestry
Top Grandparents
- rundll32.exe60%
- dllhost.exe20%
- MCUPDA~1.EXE7.5%
Top Parents
- MCUPDA~1.EXE36.53%
- rundll32.exe28.74%
- McInst.exe3.59%
- mcupdatemgr.exe3.59%
- services.exe2.99%
- McPltCmd.exe2.4%
- dadupdater.exe1.8%
- mcupdutl.exe0.6%
Top Children
- regsvr32.exe57.14%
- rundll32.exe3.64%
- sc.exe2.86%
- schtasks.exe2.08%
- McPltCmd.exe1.56%
- mcupdate.exe1.56%
- net.exe1.56%
- mcapexe.exe1.04%
- mcvsmap.exe0.78%
- dadupdater.exe0.52%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about McInst.exe
Rocky answers questions about McInst.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.