Trojan.MulDrop21.23103

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'McAfeeUpdaterUI' = '"%ProgramFiles%\McAfee\Agent\x86\UpdaterUI.exe" /StartedFromRunKey'

Modifies file system

Creates the following files

%TEMP%\mcafeelogs\frminst_qfcbikqnhgd.log
%ALLUSERSPROFILE%\mcafee\agent\ml_cacerts.cer
%ProgramFiles%\mcafee\agent\x86\0410\mueres.dll
%ProgramFiles%\mcafee\agent\x86\040c\mueres.dll
%ProgramFiles%\mcafee\agent\x86\040b\mueres.dll
%ProgramFiles%\mcafee\agent\x86\040a\mueres.dll
%ProgramFiles%\mcafee\agent\x86\0407\mueres.dll
%ProgramFiles%\mcafee\agent\x86\0406\mueres.dll
%ProgramFiles%\mcafee\agent\x86\0405\mueres.dll
%ProgramFiles%\mcafee\agent\x86\0404\mueres.dll
%ProgramFiles%\mcafee\agent\x86\0409\mueres.dll
%ProgramFiles%\mcafee\agent\x86\mue.exe
%ProgramFiles%\mcafee\agent\x86\mfemactl.exe
%ProgramFiles%\mcafee\agent\x86\0412\mueres.dll
%ProgramFiles%\mcafee\agent\x86\mfelpc.dll
%ProgramFiles%\mcafee\agent\x86\mfecryptc.dll
%ProgramFiles%\mcafee\agent\x86\mctray.exe
%ProgramFiles%\mcafee\agent\x86\mcscancheck.exe
%ProgramFiles%\mcafee\agent\x86\marepomirror.exe
%ProgramFiles%\mcafee\agent\x86\macompatsvc.exe
%ALLUSERSPROFILE%\mcafee\agent\certstore\trellix_platform_globalsign_4_2022_2025_pem.cer
%ALLUSERSPROFILE%\mcafee\agent\certstore\trellix_globalsign_codesigning_root_r45_pem.cer
%ALLUSERSPROFILE%\mcafee\agent\certstore\mfe_globalsign_codesigning_ca_sha1.cer
%ProgramFiles%\mcafee\agent\x86\0413\mueres.dll
%ProgramFiles%\mcafee\agent\x86\040a\updres.dll
%ProgramFiles%\mcafee\agent\x86\poevtinf.dll
%ProgramFiles%\mcafee\agent\x86\policyupgrade.exe
%ProgramFiles%\mcafee\agent\x86\0407\updres.dll
%ProgramFiles%\mcafee\agent\x86\0406\updres.dll
%ProgramFiles%\mcafee\agent\x86\0405\updres.dll
%ProgramFiles%\mcafee\agent\x86\0404\updres.dll
%ProgramFiles%\mcafee\agent\x86\0409\updres.dll
%ProgramFiles%\mcafee\agent\x86\updaterui.exe
%ALLUSERSPROFILE%\mcafee\agent\update\updatemain.mcs
%ProgramFiles%\mcafee\agent\x86\trex.dll
%ProgramFiles%\mcafee\agent\x86\sqlite.dll
%ALLUSERSPROFILE%\mcafee\agent\certstore\trellix_globalsign_cc_r45_codesigning_ca_pem.cer
%ALLUSERSPROFILE%\mcafee\agent\certstore\trellix_enterprise_globalsign_4_2022_2025_pem.cer
%ProgramFiles%\mcafee\agent\x86\0414\mueres.dll
%ProgramFiles%\mcafee\agent\x86\mxml.dll
%ProgramFiles%\mcafee\agent\x86\0c0a\mueres.dll
%ProgramFiles%\mcafee\agent\x86\0816\mueres.dll
%ProgramFiles%\mcafee\agent\x86\0804\mueres.dll
%ProgramFiles%\mcafee\agent\x86\041f\mueres.dll
%ProgramFiles%\mcafee\agent\x86\041d\mueres.dll
%ProgramFiles%\mcafee\agent\x86\0419\mueres.dll
%ProgramFiles%\mcafee\agent\x86\0416\mueres.dll
%ProgramFiles%\mcafee\agent\x86\0415\mueres.dll
%ProgramFiles%\mcafee\agent\x86\nagshr32.dll
%ProgramFiles%\mcafee\agent\x86\0411\mueres.dll
%ALLUSERSPROFILE%\mcafee\agent\certstore\mfeca_sha256_2016_2019.cer
%ALLUSERSPROFILE%\mcafee\agent\certstore\mfeca_sha1_2016_2019.cer
%ProgramFiles%\mcafee\agent\x86\040b\updres.dll
%ProgramFiles%\mcafee\agent\x86\ma_compat_logger.dll
%ProgramFiles%\mcafee\agent\x86\ma_database.dll
%ProgramFiles%\mcafee\agent\x86\ma_crypto.dll
%ProgramFiles%\mcafee\agent\x86\ma_configurator.dll
%ProgramFiles%\mcafee\agent\x86\ma_compatplugin.dll
%ProgramFiles%\mcafee\agent\x86\ma_compatlpc.dll
%ProgramFiles%\mcafee\agent\x86\ma_compatdata.dll
%ProgramFiles%\mcafee\agent\x86\ma_compatbase.dll
%ProgramFiles%\mcafee\agent\x86\ma_compat_updater.dll
%ProgramFiles%\mcafee\agent\x86\ma_msgbus.dll
%ProgramFiles%\mcafee\agent\x86\ma_compat_subsystem.dll
%ProgramFiles%\mcafee\agent\x86\ma_compat_scheduler.dll
%ProgramFiles%\mcafee\agent\x86\ma_compat_framework_factory.dll
%ProgramFiles%\mcafee\agent\x86\ma_compat_agent.dll
%ProgramFiles%\mcafee\agent\x86\ma_client.dll
%ALLUSERSPROFILE%\mcafee\agent\data\logging\js\json2.js
%ALLUSERSPROFILE%\mcafee\agent\data\logging\js\agentlog.js
%ALLUSERSPROFILE%\mcafee\agent\data\logging\css\desc.gif
%ALLUSERSPROFILE%\mcafee\agent\data\logging\css\bg.gif
%ALLUSERSPROFILE%\mcafee\agent\data\logging\css\asc.gif
%ALLUSERSPROFILE%\mcafee\agent\data\logging\css\agentlog.css
%ProgramFiles%\mcafee\agent\x86\ma_logger.dll
%ProgramFiles%\mcafee\agent\x86\libuv.dll
%ProgramFiles%\mcafee\agent\x86\ma_network.dll
%ProgramFiles%\mcafee\agent\x86\ma_proxy.dll
%ALLUSERSPROFILE%\mcafee\agent\certstore\mfeca_llc_sha256_2019_2022.cer
%ProgramFiles%\mcafee\agent\x86\ma_msgbus_auth.sig
%ALLUSERSPROFILE%\mcafee\agent\certstore\mfeca_llc_sha1_2019_2022.cer
%ALLUSERSPROFILE%\mcafee\agent\certstore\mfeca_inc_sha256_2019_2022.cer
%ALLUSERSPROFILE%\mcafee\agent\certstore\mfeca_inc_sha1_2019_2022.cer
%ALLUSERSPROFILE%\mcafee\agent\certstore\mfeca_iam_2020.cer
%ALLUSERSPROFILE%\mcafee\agent\certstore\mfeca_2014_2017.cer
%ALLUSERSPROFILE%\mcafee\agent\certstore\mfeca.cer
%ALLUSERSPROFILE%\mcafee\agent\certstore\mfe_sia_ca_signer.pem.cer
%ALLUSERSPROFILE%\mcafee\agent\certstore\mfe_sia_ca_root.pem.cer
%ProgramFiles%\mcafee\agent\x86\ma_package_manager.dll
%ALLUSERSPROFILE%\mcafee\agent\certstore\mfe_globalsign_root_ca_sha256.cer
%ALLUSERSPROFILE%\mcafee\agent\certstore\mfe_globalsign_codesigning_ca_sha256.cer
%ProgramFiles%\mcafee\agent\x86\ma_datastore.dll
%ALLUSERSPROFILE%\mcafee\agent\certstore\mcafee_inc_2025.cer
%ProgramFiles%\mcafee\agent\x86\ma_xml.dll
%ProgramFiles%\mcafee\agent\x86\ma_variant.dll
%ProgramFiles%\mcafee\agent\x86\ma_utils.dll
%ProgramFiles%\mcafee\agent\x86\ma_udp_client.dll
%ProgramFiles%\mcafee\agent\x86\ma_service_manager_client.dll
%ProgramFiles%\mcafee\agent\x86\ma_serialization.dll
%ProgramFiles%\mcafee\agent\x86\ma_repository.dll
%ALLUSERSPROFILE%\mcafee\agent\certstore\mfe_globalsign_root_ca_sha1.cer
%ProgramFiles%\mcafee\agent\license.txt
%ProgramFiles%\mcafee\agent\x86\040c\updres.dll
%ProgramFiles%\mcafee\agent\x86\0c0a\updres.dll
%ProgramFiles%\mcafee\agent\mxml.dll
%ProgramFiles%\mcafee\agent\mfelpc.dll
%ProgramFiles%\mcafee\agent\mfecryptc.dll
%ProgramFiles%\mcafee\agent\mcupdater.exe
%ProgramFiles%\mcafee\agent\maconfig.exe
%ProgramFiles%\mcafee\agent\ma_xml.dll
%ProgramFiles%\mcafee\agent\ma_variant.dll
%ProgramFiles%\mcafee\agent\ma_utils.dll
%ProgramFiles%\mcafee\agent\ma_service_manager_client.dll
%ProgramFiles%\mcafee\agent\ma_serialization.dll
%ProgramFiles%\mcafee\agent\ma_proxy.dll
%ProgramFiles%\mcafee\agent\trex.dll
%ProgramFiles%\mcafee\agent\ma_network.dll
%ProgramFiles%\mcafee\agent\ma_msgbus_auth.sig
%ProgramFiles%\mcafee\agent\ma_msgbus.dll
%ProgramFiles%\mcafee\agent\ma_logger.dll
%ProgramFiles%\mcafee\agent\ma_datastore.dll
%ProgramFiles%\mcafee\agent\ma_database.dll
%ProgramFiles%\mcafee\agent\ma_crypto.dll
%ProgramFiles%\mcafee\agent\ma_configurator.dll
%ProgramFiles%\mcafee\agent\ma_client.dll
%ProgramFiles%\mcafee\agent\ma_repository.dll
%ProgramFiles%\mcafee\agent\libeay32.dll
%ProgramFiles%\mcafee\agent\zlib.dll
%ALLUSERSPROFILE%\mcafee\agent\svc_x64.cab
%ALLUSERSPROFILE%\mcafee\agent\shared64.cab
%ALLUSERSPROFILE%\mcafee\agent\shared.cab
%ALLUSERSPROFILE%\mcafee\agent\mfeagent_x64.msi
%ProgramFiles%\mcafee\agent\masvc.exe
%ProgramFiles%\mcafee\agent\macmnsvc.exe
%ProgramFiles%\mcafee\agent\ma_updater_service.dll
%ProgramFiles%\mcafee\agent\ma_udp_server.dll
%ProgramFiles%\mcafee\agent\ma_udp_client.dll
%ProgramFiles%\mcafee\agent\ma_sensor_service.dll
%ProgramFiles%\mcafee\agent\libuv.dll
%ProgramFiles%\mcafee\agent\sqlite.dll
%ProgramFiles%\mcafee\agent\ma_property_service.dll
%ProgramFiles%\mcafee\agent\ma_policy_service.dll
%ProgramFiles%\mcafee\agent\ma_p2p.dll
%ProgramFiles%\mcafee\agent\ma_lockdown_service.dll
%ProgramFiles%\mcafee\agent\ma_io_service.dll
%ProgramFiles%\mcafee\agent\ma_http_server.dll
%ProgramFiles%\mcafee\agent\ma_event_service.dll
%ProgramFiles%\mcafee\agent\ma_datachannel_service.dll
%ProgramFiles%\mcafee\agent\ma_csclient.dll
%ProgramFiles%\mcafee\agent\ma_ahclient.dll
%ProgramFiles%\mcafee\agent\ma_repository_service.dll
%ProgramFiles%\mcafee\agent\ma_aac_service.dll
%ProgramFiles%\mcafee\agent\ssleay32.dll
%ProgramFiles%\mcafee\agent\libcurl.dll
%ProgramFiles%\mcafee\agent\x86\0410\agentres.dll
%ProgramFiles%\mcafee\agent\x86\userspace.dll
%ProgramFiles%\mcafee\agent\api-ms-win-core-timezone-l1-1-0.dll
%ProgramFiles%\mcafee\agent\api-ms-win-core-synch-l1-2-0.dll
%ProgramFiles%\mcafee\agent\api-ms-win-core-processthreads-l1-1-1.dll
%ProgramFiles%\mcafee\agent\api-ms-win-core-localization-l1-2-0.dll
%ProgramFiles%\mcafee\agent\api-ms-win-core-file-l2-1-0.dll
%ProgramFiles%\mcafee\agent\api-ms-win-core-file-l1-2-0.dll
%ProgramFiles%\mcafee\agent\msvcp140.dll
%ProgramFiles%\mcafee\agent\x86\zlib.dll
%ProgramFiles%\mcafee\agent\x86\xmlwrap.dll
%ProgramFiles%\mcafee\agent\api-ms-win-crt-conio-l1-1-0.dll
%ProgramFiles%\mcafee\agent\api-ms-win-crt-convert-l1-1-0.dll
%ProgramFiles%\mcafee\agent\x86\0410\updres.dll
%ProgramFiles%\mcafee\agent\x86\0804\updres.dll
%ProgramFiles%\mcafee\agent\x86\041f\updres.dll
%ProgramFiles%\mcafee\agent\x86\041d\updres.dll
%ProgramFiles%\mcafee\agent\x86\0419\updres.dll
%ProgramFiles%\mcafee\agent\x86\0416\updres.dll
%ProgramFiles%\mcafee\agent\x86\0415\updres.dll
%ProgramFiles%\mcafee\agent\x86\0414\updres.dll
%ProgramFiles%\mcafee\agent\x86\0413\updres.dll
%ProgramFiles%\mcafee\agent\x86\0412\updres.dll
%ProgramFiles%\mcafee\agent\x86\0816\updres.dll
%ProgramFiles%\mcafee\agent\x86\0411\updres.dll
%ProgramFiles%\mcafee\agent\api-ms-win-crt-environment-l1-1-0.dll
%ProgramFiles%\mcafee\agent\concrt140.dll
%ProgramFiles%\mcafee\agent\msvcp140_1.dll
%ProgramFiles%\mcafee\agent\cmdagent.exe
%ProgramFiles%\mcafee\agent\microsoft.vc142.crt.manifest
%ProgramFiles%\mcafee\agent\vcruntime140_1.dll
%ProgramFiles%\mcafee\agent\vcruntime140.dll
%ProgramFiles%\mcafee\agent\vccorlib140.dll
%ProgramFiles%\mcafee\agent\ucrtbase.dll
%ProgramFiles%\mcafee\agent\msvcp140_codecvt_ids.dll
%ProgramFiles%\mcafee\agent\msvcp140_atomic_wait.dll
%ProgramFiles%\mcafee\agent\msvcp140_2.dll
%ProgramFiles%\mcafee\agent\genevtinf5_64.dll
%ProgramFiles%\mcafee\agent\api-ms-win-crt-filesystem-l1-1-0.dll
%ProgramFiles%\mcafee\agent\api-ms-win-crt-heap-l1-1-0.dll
%ProgramFiles%\mcafee\agent\api-ms-win-crt-time-l1-1-0.dll
%ProgramFiles%\mcafee\agent\api-ms-win-crt-string-l1-1-0.dll
%ProgramFiles%\mcafee\agent\api-ms-win-crt-stdio-l1-1-0.dll
%ProgramFiles%\mcafee\agent\api-ms-win-crt-runtime-l1-1-0.dll
%ProgramFiles%\mcafee\agent\api-ms-win-crt-process-l1-1-0.dll
%ProgramFiles%\mcafee\agent\api-ms-win-crt-private-l1-1-0.dll
%ProgramFiles%\mcafee\agent\api-ms-win-crt-multibyte-l1-1-0.dll
%ProgramFiles%\mcafee\agent\api-ms-win-crt-math-l1-1-0.dll
%ProgramFiles%\mcafee\agent\api-ms-win-crt-locale-l1-1-0.dll
%ProgramFiles%\mcafee\agent\api-ms-win-crt-utility-l1-1-0.dll
%ProgramFiles%\mcafee\agent\x86\ssleay32.dll
%ProgramFiles%\mcafee\agent\x86\libeay32.dll
%ProgramFiles%\mcafee\agent\x86\libcurl.dll
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\button_disabled.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\bidirectional.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\allow.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\advisory_dlg.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\advisory_dlg.ini
%ProgramFiles%\mcafee\agent\x86\mctrayeventlog.dll
%ProgramFiles%\mcafee\agent\x86\mctrayerrorloggingplugin.dll
%ProgramFiles%\mcafee\agent\x86\mcafeewin32guisupportdll.dll
%ProgramFiles%\mcafee\agent\x86\mcafeecommonupdaterplugin.dll
%ProgramFiles%\mcafee\agent\x86\microsoft.vc142.crt.manifest
%ProgramFiles%\mcafee\agent\x86\vccorlib140.dll
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\checked.png
%ProgramFiles%\mcafee\agent\x86\ucrtbase.dll
%ProgramFiles%\mcafee\agent\x86\msvcp140_codecvt_ids.dll
%ProgramFiles%\mcafee\agent\x86\msvcp140_atomic_wait.dll
%ProgramFiles%\mcafee\agent\x86\msvcp140_2.dll
%ProgramFiles%\mcafee\agent\x86\msvcp140_1.dll
%ProgramFiles%\mcafee\agent\x86\concrt140.dll
%ProgramFiles%\mcafee\agent\x86\api-ms-win-crt-utility-l1-1-0.dll
%ProgramFiles%\mcafee\agent\x86\api-ms-win-crt-time-l1-1-0.dll
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\button_hover.png
%ProgramFiles%\mcafee\agent\x86\vcruntime140.dll
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\system_status_warning_medium.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\checkmark.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\splashscreen.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\rule_folder_closed.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\plus_sign.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\outbound.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\no_symbol.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\minus_sign.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\main_window.ini
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\inbound.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\group_folder_closed.png
%ProgramFiles%\mcafee\agent\x86\api-ms-win-crt-string-l1-1-0.dll
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\grip.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\button_up.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\gradated_background.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\folder_open.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\folder_closed.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\document.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\disallow.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\details_open_pressed.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\details_open_normal.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\details_close_pressed.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\details_close_normal.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\gray_checked.png
%ProgramFiles%\mcafee\agent\x86\api-ms-win-crt-stdio-l1-1-0.dll
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\system_status_error_medium.png
%ProgramFiles%\mcafee\agent\x86\api-ms-win-crt-runtime-l1-1-0.dll
%ProgramFiles%\mcafee\agent\x86\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\mfe570db332-9459-487b-b876-823a83cbfcf3.tmp\dxl\dxdet.mcs
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\system_status_ok_medium.png
%TEMP%\mfe570db332-9459-487b-b876-823a83cbfcf3.tmp\contrib.ini
%TEMP%\mfe570db332-9459-487b-b876-823a83cbfcf3.tmp\dxl.zip
%TEMP%\mfe570db332-9459-487b-b876-823a83cbfcf3.tmp\hashes.xml
%TEMP%\mfe570db332-9459-487b-b876-823a83cbfcf3.tmp\packageinfo.xml
%TEMP%\mfe570db332-9459-487b-b876-823a83cbfcf3.tmp\bootstrapinfo.xml
%TEMP%\mfe570db332-9459-487b-b876-823a83cbfcf3.tmp\sr2048pubkey.bin
%TEMP%\mfe570db332-9459-487b-b876-823a83cbfcf3.tmp\req2048seckey.bin
%TEMP%\mfe570db332-9459-487b-b876-823a83cbfcf3.tmp\agent.ini
%TEMP%\mfe570db332-9459-487b-b876-823a83cbfcf3.tmp\dxl\dxinst.mcs
%TEMP%\mfe570db332-9459-487b-b876-823a83cbfcf3.tmp\dxl\dxlsetup-ma.exe
%TEMP%\mfe570db332-9459-487b-b876-823a83cbfcf3.tmp\repokeys.ini
%TEMP%\mfe570db332-9459-487b-b876-823a83cbfcf3.tmp\svc_x86.cab
%TEMP%\mfe570db332-9459-487b-b876-823a83cbfcf3.tmp\svc_x64.cab
%TEMP%\mfe570db332-9459-487b-b876-823a83cbfcf3.tmp\shared64.cab
%TEMP%\mfe570db332-9459-487b-b876-823a83cbfcf3.tmp\shared.cab
%TEMP%\mfe570db332-9459-487b-b876-823a83cbfcf3.tmp\mfeagent_x64.msi
%TEMP%\mfe570db332-9459-487b-b876-823a83cbfcf3.tmp\mfeagent.msi
%TEMP%\mfe570db332-9459-487b-b876-823a83cbfcf3.tmp\frminst.exe
%TEMP%\mfe570db332-9459-487b-b876-823a83cbfcf3.tmp\cleanup.exe
%TEMP%\mfe570db332-9459-487b-b876-823a83cbfcf3.tmp\__temp.zip
%TEMP%\mfe570db332-9459-487b-b876-823a83cbfcf3.tmp\agentfipsmode
%TEMP%\mfe570db332-9459-487b-b876-823a83cbfcf3.tmp\sitelist.xml
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\gradated_background_with_trellix_logo.png
%TEMP%\mcafeelogs\mfeagent.msi.2022.12.08.10.57.06.log
%ProgramFiles%\mcafee\agent\x86\api-ms-win-core-processthreads-l1-1-1.dll
%ProgramFiles%\mcafee\agent\x86\api-ms-win-core-synch-l1-2-0.dll
%ProgramFiles%\mcafee\agent\x86\api-ms-win-crt-multibyte-l1-1-0.dll
%ProgramFiles%\mcafee\agent\x86\api-ms-win-crt-math-l1-1-0.dll
%ProgramFiles%\mcafee\agent\x86\api-ms-win-crt-locale-l1-1-0.dll
%ProgramFiles%\mcafee\agent\x86\api-ms-win-crt-heap-l1-1-0.dll
%ProgramFiles%\mcafee\agent\x86\api-ms-win-crt-filesystem-l1-1-0.dll
%ProgramFiles%\mcafee\agent\x86\api-ms-win-crt-environment-l1-1-0.dll
%ProgramFiles%\mcafee\agent\x86\api-ms-win-crt-convert-l1-1-0.dll
%ProgramFiles%\mcafee\agent\x86\api-ms-win-crt-conio-l1-1-0.dll
%ProgramFiles%\mcafee\agent\x86\api-ms-win-core-timezone-l1-1-0.dll
%ProgramFiles%\mcafee\agent\x86\api-ms-win-crt-private-l1-1-0.dll
%TEMP%\mfe570db332-9459-487b-b876-823a83cbfcf3.tmp\dxl\pkgcatalog.z
%TEMP%\mcafeelogs\frminst_qfcbikqnhgd_error.log
%ProgramFiles%\mcafee\agent\x86\api-ms-win-core-file-l2-1-0.dll
%ProgramFiles%\mcafee\agent\x86\api-ms-win-core-file-l1-2-0.dll
%ProgramFiles%\mcafee\agent\x86\msvcp140.dll
%ProgramFiles%\mcafee\agent\x86\componentpointproduct.dll
%TEMP%\{6bfbe083-b521-43f7-b01c-b5a949b1564b}\repokeys.ini
%TEMP%\{6bfbe083-b521-43f7-b01c-b5a949b1564b}\agentfipsmode
%TEMP%\{6bfbe083-b521-43f7-b01c-b5a949b1564b}\sr2048pubkey.bin
%TEMP%\{6bfbe083-b521-43f7-b01c-b5a949b1564b}\req2048seckey.bin
%TEMP%\{6bfbe083-b521-43f7-b01c-b5a949b1564b}\main.txt
%ProgramFiles%\mcafee\agent\x86\api-ms-win-core-localization-l1-2-0.dll
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\button_down.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\trailer.png
%ProgramFiles%\mcafee\agent\x86\0409\cmauires.dll
%ProgramFiles%\mcafee\agent\0416\agentres.ini
%ProgramFiles%\mcafee\agent\x86\clientui.dll
%ProgramFiles%\mcafee\agent\x86\boost_thread-vc142-mt-1_39.dll
%ProgramFiles%\mcafee\agent\x86\boost_system-vc142-mt-1_39.dll
%ProgramFiles%\mcafee\agent\0c0a\agentres.ini
%ProgramFiles%\mcafee\agent\0816\agentres.ini
%ProgramFiles%\mcafee\agent\0804\agentres.ini
%ProgramFiles%\mcafee\agent\041f\agentres.ini
%ProgramFiles%\mcafee\agent\041d\agentres.ini
%ProgramFiles%\mcafee\agent\0419\agentres.ini
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\tray_menu_issue.png
%ProgramFiles%\mcafee\agent\x86\0404\cmauires.dll
%ProgramFiles%\mcafee\agent\0405\agentres.ini
%ProgramFiles%\mcafee\agent\0413\agentres.ini
%ProgramFiles%\mcafee\agent\0412\agentres.ini
%ProgramFiles%\mcafee\agent\0411\agentres.ini
%ProgramFiles%\mcafee\agent\0410\agentres.ini
%ProgramFiles%\mcafee\agent\040c\agentres.ini
%ProgramFiles%\mcafee\agent\040b\agentres.ini
%ProgramFiles%\mcafee\agent\040a\agentres.ini
%ProgramFiles%\mcafee\agent\0407\agentres.ini
%ProgramFiles%\mcafee\agent\0406\agentres.ini
%ProgramFiles%\mcafee\agent\0414\agentres.ini
%ProgramFiles%\mcafee\agent\0415\agentres.ini
%ProgramFiles%\mcafee\agent\x86\0405\cmauires.dll
%ProgramFiles%\mcafee\agent\x86\0419\cmauires.dll
%ProgramFiles%\mcafee\agent\x86\041d\cmauires.dll
%ProgramFiles%\mcafee\agent\x86\mctray\gui_redirect.ini
%ProgramFiles%\mcafee\agent\x86\genevtinf5.dll
%ProgramFiles%\mcafee\agent\x86\frminst.exe
%ALLUSERSPROFILE%\mcafee\agent\frameworkmanifest.xml
%ProgramFiles%\mcafee\agent\x86\componentuserinterface.dll
%ProgramFiles%\mcafee\agent\x86\0c0a\cmauires.dll
%ProgramFiles%\mcafee\agent\x86\0816\cmauires.dll
%ProgramFiles%\mcafee\agent\x86\0804\cmauires.dll
%ProgramFiles%\mcafee\agent\x86\041f\cmauires.dll
%ALLUSERSPROFILE%\mcafee\agent\update\installmain.mcs
%ProgramFiles%\mcafee\agent\x86\0406\cmauires.dll
%ProgramFiles%\mcafee\agent\x86\0407\cmauires.dll
%ProgramFiles%\mcafee\agent\x86\0415\cmauires.dll
%ProgramFiles%\mcafee\agent\x86\0414\cmauires.dll
%ProgramFiles%\mcafee\agent\x86\0413\cmauires.dll
%ProgramFiles%\mcafee\agent\x86\0412\cmauires.dll
%ProgramFiles%\mcafee\agent\x86\0411\cmauires.dll
%ProgramFiles%\mcafee\agent\x86\0410\cmauires.dll
%ProgramFiles%\mcafee\agent\x86\040c\cmauires.dll
%ProgramFiles%\mcafee\agent\x86\040b\cmauires.dll
%ProgramFiles%\mcafee\agent\x86\040a\cmauires.dll
%ProgramFiles%\mcafee\agent\x86\0416\cmauires.dll
%ProgramFiles%\mcafee\agent\ma_scheduler.dll
%ALLUSERSPROFILE%\mcafee\agent\svc_x86.cab
%ProgramFiles%\mcafee\agent\x86\0c0a\agentres.dll
%ProgramFiles%\mcafee\agent\x86\0407\mctrayres.dll
%ProgramFiles%\mcafee\agent\x86\0416\mctrayres.dll
%ProgramFiles%\mcafee\agent\x86\0415\mctrayres.dll
%ProgramFiles%\mcafee\agent\x86\0414\mctrayres.dll
%ProgramFiles%\mcafee\agent\x86\0413\mctrayres.dll
%ProgramFiles%\mcafee\agent\x86\0412\mctrayres.dll
%ProgramFiles%\mcafee\agent\x86\0411\mctrayres.dll
%ProgramFiles%\mcafee\agent\x86\0410\mctrayres.dll
%ProgramFiles%\mcafee\agent\x86\040c\mctrayres.dll
%ProgramFiles%\mcafee\agent\x86\040b\mctrayres.dll
%ProgramFiles%\mcafee\agent\0409\agentres.ini
%ProgramFiles%\mcafee\agent\x86\041d\mctrayres.dll
%ProgramFiles%\mcafee\agent\x86\0406\mctrayres.dll
%ProgramFiles%\mcafee\agent\x86\0405\mctrayres.dll
%ProgramFiles%\mcafee\agent\x86\0404\mctrayres.dll
%ProgramFiles%\mcafee\agent\x86\0409\mctrayres.dll
%ProgramFiles%\mcafee\agent\x86\mctraylegacysupportplugin32.dll
%ProgramFiles%\mcafee\agent\x86\mctrayinterfacelib.dll
%ProgramFiles%\mcafee\agent\x86\mctrayinstsupp.dll
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\unchecked.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\trellix_m_small.png
%ProgramFiles%\mcafee\agent\x86\mctray\images\mcafee\tray_menu_okay.png
%ProgramFiles%\mcafee\agent\x86\040a\mctrayres.dll
%ProgramFiles%\mcafee\agent\0404\agentres.ini
%ProgramFiles%\mcafee\agent\x86\041f\mctrayres.dll
%ProgramFiles%\mcafee\agent\x86\0c0a\mctrayres.dll
%ProgramFiles%\mcafee\agent\x86\0804\mctrayres.dll
%ProgramFiles%\mcafee\agent\x86\0816\agentres.dll
%ProgramFiles%\mcafee\agent\x86\0804\agentres.dll
%ProgramFiles%\mcafee\agent\x86\041f\agentres.dll
%ProgramFiles%\mcafee\agent\x86\041d\agentres.dll
%ProgramFiles%\mcafee\agent\x86\0419\agentres.dll
%ProgramFiles%\mcafee\agent\x86\0416\agentres.dll
%ProgramFiles%\mcafee\agent\x86\0415\agentres.dll
%ProgramFiles%\mcafee\agent\x86\0414\agentres.dll
%ProgramFiles%\mcafee\agent\x86\0413\agentres.dll
%ProgramFiles%\mcafee\agent\x86\0816\mctrayres.dll
%ProgramFiles%\mcafee\agent\x86\0412\agentres.dll
%ProgramFiles%\mcafee\agent\x86\0419\mctrayres.dll
%ProgramFiles%\mcafee\agent\x86\040c\agentres.dll
%ProgramFiles%\mcafee\agent\x86\040b\agentres.dll
%ProgramFiles%\mcafee\agent\x86\040a\agentres.dll
%ProgramFiles%\mcafee\agent\x86\0407\agentres.dll
%ProgramFiles%\mcafee\agent\x86\0406\agentres.dll
%ProgramFiles%\mcafee\agent\x86\0405\agentres.dll
%ProgramFiles%\mcafee\agent\x86\0404\agentres.dll
%ProgramFiles%\mcafee\agent\x86\0409\agentres.dll
%ALLUSERSPROFILE%\mcafee\agent\data\logging\agentlog.html
%ProgramFiles%\mcafee\agent\x86\0411\agentres.dll
%WINDIR%\installer\{6bfbe083-b521-43f7-b01c-b5a949b1564b}\arpproducticon.exe

Network activity

UDP

DNS ASK microsoft.com

Miscellaneous

Creates and executes the following

'%TEMP%\mfe570db332-9459-487b-b876-823a83cbfcf3.tmp\frminst.exe' /FramePkg /OriginalFramePkg="<Full path to file>" /Cleanup="%TEMP%\mfe570DB332-9459-487B-B876-823A83CBFCF3.tmp" /LOGDIR="%TEMP%\McAfeeLogs" /EmbeddedUsername="" /EmbeddedDomain="" /EmbeddedPass...
'%ProgramFiles%\mcafee\agent\x86\mfemactl.exe' --log "%TEMP%\McAfeeLogs" --refresh_vtp_bin 2
'%ProgramFiles%\mcafee\agent\maconfig.exe' -provision -managed -dir "%TEMP%\mfe570DB332-9459-487B-B876-823A83CBFCF3.tmp" -logdir "%TEMP%\McAfeeLogs" -nostart -check
'%ProgramFiles%\mcafee\agent\macmnsvc.exe' /ServiceStart
'%ProgramFiles%\mcafee\agent\masvc.exe' /ServiceStart
'%WINDIR%\syswow64\tasklist.exe' /FI "IMAGENAME eq Mue_InUse.exe" /FO CSV /NH' (with hidden window)
'%WINDIR%\syswow64\tasklist.exe' /FO CSV /NH' (with hidden window)
'%WINDIR%\syswow64\tasklist.exe' /FI "IMAGENAME eq McScript_InUse.exe" /FO CSV /NH' (with hidden window)
'%WINDIR%\syswow64\tasklist.exe' /FI "IMAGENAME eq UpdaterUI.exe" /FO CSV /NH' (with hidden window)
'%WINDIR%\syswow64\tasklist.exe' /FI "IMAGENAME eq UdaterUI.exe" /FO CSV /NH' (with hidden window)
'%WINDIR%\syswow64\tasklist.exe' /FI "IMAGENAME eq masvc.exe" /FO CSV /NH' (with hidden window)
'%WINDIR%\syswow64\tasklist.exe' /FI "IMAGENAME eq macmnsvc.exe" /FO CSV /NH' (with hidden window)
'%WINDIR%\syswow64\tasklist.exe' /FI "IMAGENAME eq macompatsvc.exe" /FO CSV /NH' (with hidden window)
'%ProgramFiles%\mcafee\agent\x86\mfemactl.exe' --log "%TEMP%\McAfeeLogs" --refresh_vtp_bin 2' (with hidden window)
'%ProgramFiles%\mcafee\agent\maconfig.exe' -provision -managed -dir "%TEMP%\mfe570DB332-9459-487B-B876-823A83CBFCF3.tmp" -logdir "%TEMP%\McAfeeLogs" -nostart -check' (with hidden window)

Executes the following

'%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\mfe570DB332-9459-487B-B876-823A83CBFCF3.tmp\MFEagent_x64.msi" ADDLOCAL=Main,Agent,Svc_x64 TRANSFORMS=:1033.mst /qb+ /l+*v "%TEMP%\McAfeeLogs\MFEagent.msi.2022.12.08.10.57.06.log" SIT...
'%WINDIR%\syswow64\tasklist.exe' /FI "IMAGENAME eq Mue_InUse.exe" /FO CSV /NH
'%WINDIR%\syswow64\tasklist.exe' /FO CSV /NH
'%WINDIR%\syswow64\tasklist.exe' /FI "IMAGENAME eq McScript_InUse.exe" /FO CSV /NH
'%WINDIR%\syswow64\tasklist.exe' /FI "IMAGENAME eq UpdaterUI.exe" /FO CSV /NH
'%WINDIR%\syswow64\tasklist.exe' /FI "IMAGENAME eq UdaterUI.exe" /FO CSV /NH
'%WINDIR%\syswow64\tasklist.exe' /FI "IMAGENAME eq masvc.exe" /FO CSV /NH
'%WINDIR%\syswow64\tasklist.exe' /FI "IMAGENAME eq macmnsvc.exe" /FO CSV /NH
'%WINDIR%\syswow64\tasklist.exe' /FI "IMAGENAME eq macompatsvc.exe" /FO CSV /NH

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial