File name:

McAfeeSmartInstall.rar

Full analysis: https://app.any.run/tasks/972edcfb-0bdd-4a70-9857-3a6ae456c5c8
Verdict: Malicious activity
Analysis date: December 12, 2018, 20:12:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

E80B2B59A7E04102CA0FCD1ECB15377E

SHA1:

D37B357DF30664EEB5FD480620BA0DBE3256FC3C

SHA256:

6F2F361B4A115B7CCB320F724C9A448A5D7B3D63E7C73895855A418972917774

SSDEEP:

24576:k9k545aScbH6k/HBjk/fgSmfEzocwwyuO54IVml:k2+cScbJ/H1GgSm8sxj5L2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • McAfeeSmartInstall.exe (PID: 3848)
      • McAfeeSmartInstall.exe (PID: 2684)
      • FrmInst.exe (PID: 2508)
      • mfemactl.exe (PID: 3308)
      • mfemactl.exe (PID: 2084)
      • macompatsvc.exe (PID: 2260)
      • maconfig.exe (PID: 3920)
      • masvc.exe (PID: 3976)
      • macmnsvc.exe (PID: 3888)
      • macompatsvc.exe (PID: 3048)
      • mfemactl.exe (PID: 3768)
      • UpdaterUI.exe (PID: 3368)
      • McTray.exe (PID: 1820)
      • maconfig.exe (PID: 2128)
      • McScript_InUse.exe (PID: 536)
      • dxlsetup.exe (PID: 3152)
      • dxlsetup.exe (PID: 1712)
      • mfedxlutil.exe (PID: 3108)
      • mfedxlutil32.exe (PID: 3192)
      • mfehidin.exe (PID: 4052)
      • mfemms.exe (PID: 3820)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 2608)
      • MsiExec.exe (PID: 2972)
      • macompatsvc.exe (PID: 2260)
      • MsiExec.exe (PID: 3792)
      • MsiExec.exe (PID: 3416)
      • maconfig.exe (PID: 3920)
      • MsiExec.exe (PID: 2696)
      • MsiExec.exe (PID: 3492)
      • macmnsvc.exe (PID: 3888)
      • MsiExec.exe (PID: 3424)
      • masvc.exe (PID: 3976)
      • mfemactl.exe (PID: 3768)
      • macompatsvc.exe (PID: 3048)
      • UpdaterUI.exe (PID: 3368)
      • MsiExec.exe (PID: 3564)
      • MsiExec.exe (PID: 2668)
      • maconfig.exe (PID: 2128)
      • McScript_InUse.exe (PID: 536)
      • McTray.exe (PID: 1820)
      • dxlsetup.exe (PID: 1712)
      • mfehidin.exe (PID: 4052)

    • Changes the autorun value in the registry

      • dxlsetup.exe (PID: 3152)

    • Changes settings of System certificates

      • mfehidin.exe (PID: 4052)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2948)
      • McAfeeSmartInstall.exe (PID: 2684)
      • MsiExec.exe (PID: 2320)
      • msiexec.exe (PID: 3220)
      • macmnsvc.exe (PID: 3888)
      • masvc.exe (PID: 3976)
      • McScript_InUse.exe (PID: 536)
      • dxlsetup.exe (PID: 1712)
      • dxlsetup.exe (PID: 3152)
      • MsiExec.exe (PID: 3112)
      • mfehidin.exe (PID: 4052)

    • Creates COM task schedule object

      • MsiExec.exe (PID: 3564)
      • MsiExec.exe (PID: 2608)
      • MsiExec.exe (PID: 3416)
      • MsiExec.exe (PID: 3492)
      • MsiExec.exe (PID: 2972)
      • MsiExec.exe (PID: 2696)
      • MsiExec.exe (PID: 3792)
      • MsiExec.exe (PID: 3424)
      • MsiExec.exe (PID: 2668)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 3220)

    • Creates or modifies windows services

      • maconfig.exe (PID: 3920)
      • masvc.exe (PID: 3976)
      • mfehidin.exe (PID: 4052)

    • Creates files in the program directory

      • macmnsvc.exe (PID: 3888)
      • macompatsvc.exe (PID: 3048)
      • maconfig.exe (PID: 3920)
      • mfemactl.exe (PID: 3768)
      • masvc.exe (PID: 3976)
      • McScript_InUse.exe (PID: 536)
      • dxlsetup.exe (PID: 3152)
      • mfehidin.exe (PID: 4052)

    • Creates files in the user directory

      • McTray.exe (PID: 1820)

    • Reads CPU info

      • masvc.exe (PID: 3976)

    • Creates files in the Windows directory

      • McScript_InUse.exe (PID: 536)
      • MsiExec.exe (PID: 3112)
      • mfedxlutil.exe (PID: 3108)
      • dxlsetup.exe (PID: 3152)
      • msiexec.exe (PID: 3220)
      • dxlsetup.exe (PID: 1712)
      • mfehidin.exe (PID: 4052)

    • Removes files from Windows directory

      • McScript_InUse.exe (PID: 536)
      • mfedxlutil32.exe (PID: 3192)
      • mfehidin.exe (PID: 4052)

    • Searches for installed software

      • dxlsetup.exe (PID: 3152)

    • Creates a software uninstall entry

      • dxlsetup.exe (PID: 3152)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • mfehidin.exe (PID: 4052)

    • Adds / modifies Windows certificates

      • mfehidin.exe (PID: 4052)

    • Creates files in the driver directory

      • mfehidin.exe (PID: 4052)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • McAfeeSmartInstall.exe (PID: 2684)
      • msiexec.exe (PID: 3220)
      • macmnsvc.exe (PID: 3888)
      • dxlsetup.exe (PID: 3152)
      • MsiExec.exe (PID: 3112)

    • Application launched itself

      • msiexec.exe (PID: 3220)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 2320)
      • MsiExec.exe (PID: 4040)
      • MsiExec.exe (PID: 3112)

    • Creates files in the program directory

      • MsiExec.exe (PID: 2320)
      • msiexec.exe (PID: 3220)

    • Creates a software uninstall entry

      • MsiExec.exe (PID: 2320)
      • msiexec.exe (PID: 3220)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 1540)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
84
Monitored processes
39
Malicious processes
23
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe mcafeesmartinstall.exe no specs mcafeesmartinstall.exe frminst.exe msiexec.exe msiexec.exe no specs msiexec.exe mfemactl.exe mfemactl.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs macompatsvc.exe no specs maconfig.exe no specs macmnsvc.exe masvc.exe macompatsvc.exe updaterui.exe no specs mfemactl.exe mctray.exe no specs maconfig.exe no specs mcscript_inuse.exe dxlsetup.exe dxlsetup.exe vssvc.exe no specs drvinst.exe no specs mfedxlutil.exe no specs msiexec.exe mfedxlutil32.exe no specs mfehidin.exe mfemms.exe wevtutil.exe no specs wevtutil.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
280wevtutil.exe im aacetw.manC:\Windows\system32\wevtutil.exe—mfehidin.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Eventing Command Line Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wevtutil.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
536"C:\Program Files\McAfee\Agent\McScript_InUse.exe" -script C:\ProgramData\McAfee\Agent\update\InstallMain.McS -id 20828 -localeid 0409 -logfile C:\ProgramData\McAfee\Agent\logs\McScript_deploy -parent FRAMEWORK -initiator 4 -installdir "C:\Program Files\McAfee\Agent\\\\" -taskid 4200C:\Program Files\McAfee\Agent\McScript_InUse.exe
masvc.exe
User:
SYSTEM
Company:
McAfee LLC.
Integrity Level:
SYSTEM
Description:
McAfee Agent Script Engine
Exit code:
0
Version:
5.5.1.388
Modules
Images
c:\program files\mcafee\agent\mcscript_inuse.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\program files\mcafee\agent\libuv.dll
c:\windows\system32\ws2_32.dll
940wevtutil.exe um aacetw.manC:\Windows\system32\wevtutil.exe—mfehidin.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Eventing Command Line Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wevtutil.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
1540C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1712"C:\ProgramData\McAfee\Agent\Current\DXL_____1000\Install\0000\dxlsetup.exe" -burn.unelevated BurnPipe.{3BD4FCF1-0667-4CE6-8D2A-C6B8C5CE1F5D} {918E5D5F-8FBB-4C7E-91DC-8AD721A5C95E} 3152 /norestart /silent C:\ProgramData\McAfee\Agent\Current\DXL_____1000\Install\0000\dxlsetup.exe
dxlsetup.exe
User:
SYSTEM
Company:
McAfee LLC
Integrity Level:
SYSTEM
Description:
McAfee Data Exchange Layer
Exit code:
0
Version:
4.1.1.123
Modules
Images
c:\programdata\mcafee\agent\current\dxl_____1000\install\0000\dxlsetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1820/loadC:\Program Files\McAfee\Agent\McTray.exe—UpdaterUI.exe
User:
admin
Company:
McAfee LLC.
Integrity Level:
MEDIUM
Description:
McTray Application
Exit code:
0
Version:
2.2.0.608
Modules
Images
c:\program files\mcafee\agent\mctray.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mcafee\agent\mcafeewin32guisupportdll.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2084"C:\Users\admin\AppData\Local\Temp\2ff48c89-e212-40d8-93f4-84442670365d\mfemactl.exe" --log "C:\Users\admin\AppData\Local\Temp\McAfeeLogs" --ppid 2320 --interface 4D454F57010000000000000000000000C00000000000004600000000050000003CBDD370488DF6A175D6E967CD3188DC083400001009400F4F599671F293903700000000 C:\Users\admin\AppData\Local\Temp\2ff48c89-e212-40d8-93f4-84442670365d\mfemactl.exe
MsiExec.exe
User:
SYSTEM
Company:
McAfee LLC.
Integrity Level:
SYSTEM
Description:
McAfee Agent AAC Host
Exit code:
0
Version:
5.5.1.388
Modules
Images
c:\users\admin\appdata\local\temp\2ff48c89-e212-40d8-93f4-84442670365d\mfemactl.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2128 -writenotifyregistrykeyC:\Program Files\McAfee\Agent\maconfig.exe—MsiExec.exe
User:
SYSTEM
Company:
McAfee LLC.
Integrity Level:
SYSTEM
Description:
McAfee Agent Configurator
Exit code:
0
Version:
5.5.1.388
Modules
Images
c:\program files\mcafee\agent\maconfig.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\mcafee\agent\libuv.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\psapi.dll
2260"C:\Program Files\McAfee\Agent\macompatsvc.exe" /ServiceC:\Program Files\McAfee\Agent\macompatsvc.exe—msiexec.exe
User:
admin
Company:
McAfee LLC.
Integrity Level:
HIGH
Description:
MA Compat service
Exit code:
0
Version:
5.5.1.388
Modules
Images
c:\program files\mcafee\agent\macompatsvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mcafee\agent\ma_utils.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netapi32.dll
2320C:\Windows\system32\MsiExec.exe -Embedding CF7138B181DB31D02918C0B6F4518122 M Global\MSI0000C:\Windows\system32\MsiExec.exe
msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
2 914
Read events
1 204
Write events
1 691
Delete events
19

Modification events

(PID) Process:(2948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2948) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall.rar
(PID) Process:(2948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(2948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
340
Suspicious files
111
Text files
368
Unknown types
29

Dropped files

PID
Process
Filename
Type
2948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2948.6114\McAfeeSmartInstall.exeexecutable
MD5:—
SHA256:—
2948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2948.6114\Prueba de producto.docdocument
MD5:—
SHA256:—
2684McAfeeSmartInstall.exeC:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\Shared.cab —
MD5:—
SHA256:—
2684McAfeeSmartInstall.exeC:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\coninfo.xmlxml
MD5:—
SHA256:—
2684McAfeeSmartInstall.exeC:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\FrameworkConfig.zipcompressed
MD5:—
SHA256:—
2684McAfeeSmartInstall.exeC:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\SiteList.xmltext
MD5:—
SHA256:—
2684McAfeeSmartInstall.exeC:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\cabundle.certext
MD5:—
SHA256:—
3220msiexec.exeC:\Windows\Installer\MSI447.tmp —
MD5:—
SHA256:—
2684McAfeeSmartInstall.exeC:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\reqseckey.binbinary
MD5:—
SHA256:—
2684McAfeeSmartInstall.exeC:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\srpubkey.binbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
16
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2684
McAfeeSmartInstall.exe
GET
—
52.222.146.37:80
http://cdn-usw002.mvision.mcafee.com/Software/Current/EPOAGENT3000/Install/0409/FrameworkInstall.zip
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2684
McAfeeSmartInstall.exe
52.37.110.205:443
ah-usw002.mvision.mcafee.com
Amazon.com, Inc.
US
unknown
2684
McAfeeSmartInstall.exe
52.222.146.37:80
cdn-usw002.mvision.mcafee.com
Amazon.com, Inc.
US
unknown
3976
masvc.exe
10.104.10.48:443
—
—
—
unknown
3976
masvc.exe
52.37.110.205:443
ah-usw002.mvision.mcafee.com
Amazon.com, Inc.
US
unknown
536
McScript_InUse.exe
161.69.29.157:443
lc.mcafee.com
McAfee, Inc.
US
unknown
536
McScript_InUse.exe
52.37.110.205:443
ah-usw002.mvision.mcafee.com
Amazon.com, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
cdn-usw002.mvision.mcafee.com
  • 52.222.146.37
  • 52.222.146.47
  • 52.222.146.64
  • 52.222.146.16
whitelisted
sw-usw002.mvision.mcafee.com
  • 54.231.184.215
  • 52.218.224.147
shared
ah-usw002.mvision-prod.local
  • —
unknown
ah-usw002.mvision.mcafee.com
  • 52.37.110.205
  • 54.187.45.226
unknown
lc.mcafee.com
  • 161.69.29.157
unknown

Threats

No threats detected
Process
Message
FrmInst.exe
NotComDllGetInterface: DLL not found in install location, looking in current directory
FrmInst.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\FrmInst.exe loading C:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\mfevtpa.dll, WinVerifyTrust failed with 80092003
FrmInst.exe
NotComDllGetInterface: DLL not found in install location, looking in current directory
FrmInst.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\FrmInst.exe loading C:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\mfeaaca.dll, WinVerifyTrust failed with 80092003
FrmInst.exe
NotComDllGetInterface: DLL not found in install location, looking in current directory
FrmInst.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\FrmInst.exe loading C:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\mfeaaca.dll, WinVerifyTrust failed with 80092003
FrmInst.exe
NotComDllGetInterface: DLL not found in install location, looking in current directory
FrmInst.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\FrmInst.exe loading C:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\mfeaaca.dll, WinVerifyTrust failed with 80092003
FrmInst.exe
NotComDllGetInterface: DLL not found in install location, looking in current directory
FrmInst.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\FrmInst.exe loading C:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\mfeaaca.dll, WinVerifyTrust failed with 80092003
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
McAfeeSmartInstall.rar