Rocky Raccoon

McInstru.exe

by McAfee/Trellix
Endpoint Security

Summary

McAfee Instrumentation - telemetry and instrumentation component for McAfee endpoint products.

McInstru.exe is the 1002nd most commonly executed Windows program in EchoTrail's dataset, observed 2,055 times across enterprise environments. It typically runs from C:\Program Files\mcafee\msc.

1002nd
most commonly executed Windows program
2,055
observed executions
low
statistical confidence

Behavior

Top Paths

  • C:\Program Files\mcafee\msc100%

Top Hashes (SHA256)

  • 937cb3dabb7a0b142c187be401bf887dc561696c31b71d0d8d4889b34644c0ce73.76%
  • 763283813a25639208f272c8d05d5002d567788a615d240636ced8aefc6e2b6b17.39%
  • fb5abe0e0d807ed141527c83aa22c161bab3f60c954174f517985e0ee968bfcc8.85%

Process Ancestry

Top Grandparents

Top Children

Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.

Ask Rocky about McInstru.exe

Rocky answers questions about McInstru.exe grounded in this same dataset — free, no account needed.

Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.

Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.