File name:

TrellixSmartInstall.exe

Full analysis: https://app.any.run/tasks/d15eb316-cbf8-4f52-89ff-021f86010b0f
Verdict: Malicious activity
Analysis date: April 17, 2024, 15:18:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

82E3BE96DDEFCD8DF1C2AAF71AEA430E

SHA1:

4185336B9E913B8F5DD4A2C4A9383E4198AD2A33

SHA256:

BB5C333E0611647C347EF79977216ED91C7D64891F1FBC85161E8E7614DEA1E9

SSDEEP:

49152:7Pn0vzOdauelEjZRXuB42Ym+PmjOFD6Vw6W6peszMNY1Yp1FvZ+ua/BvuyLVWJHH:7Pn0xlEjZR+B3JimjW7YoPvAZ/dPR2HH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • TrellixSmartInstall.exe (PID: 548)
      • FrmInst.exe (PID: 2880)
      • dxlsetup-ma.exe (PID: 1880)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • TrellixSmartInstall.exe (PID: 548)
      • FrmInst.exe (PID: 2880)
      • dxlsetup-ma.exe (PID: 1880)

    • Checks Windows Trust Settings

      • FrmInst.exe (PID: 2880)
      • masvc.exe (PID: 924)
      • UpdaterUI.exe (PID: 3216)
      • mfemactl.exe (PID: 2844)
      • mcupdater.exe (PID: 2176)

    • Reads security settings of Internet Explorer

      • FrmInst.exe (PID: 2880)
      • mcupdater.exe (PID: 2176)
      • UpdaterUI.exe (PID: 3216)

    • Executes as Windows Service

      • macmnsvc.exe (PID: 1340)
      • masvc.exe (PID: 924)

    • The process verifies whether the antivirus software is installed

      • macmnsvc.exe (PID: 1340)
      • UpdaterUI.exe (PID: 3216)
      • mfemactl.exe (PID: 2844)
      • masvc.exe (PID: 924)
      • mcupdater.exe (PID: 2176)
      • FrmInst.exe (PID: 2880)
      • mctray.exe (PID: 2248)

    • Creates or modifies Windows services

      • masvc.exe (PID: 924)

    • Application launched itself

      • dxlsetup-ma.exe (PID: 2632)

    • Searches for installed software

      • dxlsetup-ma.exe (PID: 2632)
      • dxlsetup-ma.exe (PID: 1880)

    • Adds/modifies Windows certificates

      • masvc.exe (PID: 924)

  • INFO

    • Create files in a temporary directory

      • FrmInst.exe (PID: 2880)
      • TrellixSmartInstall.exe (PID: 548)
      • UpdaterUI.exe (PID: 3216)
      • mctray.exe (PID: 2248)
      • mcupdater.exe (PID: 2176)
      • dxlsetup-ma.exe (PID: 1880)

    • Checks supported languages

      • TrellixSmartInstall.exe (PID: 548)
      • FrmInst.exe (PID: 2880)
      • macmnsvc.exe (PID: 1340)
      • masvc.exe (PID: 924)
      • UpdaterUI.exe (PID: 3216)
      • mfemactl.exe (PID: 2844)
      • mctray.exe (PID: 2248)
      • mcupdater.exe (PID: 2176)
      • dxlsetup-ma.exe (PID: 1880)
      • dxlsetup-ma.exe (PID: 2632)

    • Reads the computer name

      • TrellixSmartInstall.exe (PID: 548)
      • FrmInst.exe (PID: 2880)
      • macmnsvc.exe (PID: 1340)
      • masvc.exe (PID: 924)
      • mfemactl.exe (PID: 2844)
      • UpdaterUI.exe (PID: 3216)
      • mctray.exe (PID: 2248)
      • mcupdater.exe (PID: 2176)
      • dxlsetup-ma.exe (PID: 2632)
      • dxlsetup-ma.exe (PID: 1880)

    • Reads the machine GUID from the registry

      • TrellixSmartInstall.exe (PID: 548)
      • FrmInst.exe (PID: 2880)
      • macmnsvc.exe (PID: 1340)
      • masvc.exe (PID: 924)
      • mfemactl.exe (PID: 2844)
      • mcupdater.exe (PID: 2176)
      • UpdaterUI.exe (PID: 3216)
      • dxlsetup-ma.exe (PID: 2632)

    • Creates files in the program directory

      • macmnsvc.exe (PID: 1340)
      • masvc.exe (PID: 924)
      • mfemactl.exe (PID: 2844)

    • Creates files or folders in the user directory

      • mctray.exe (PID: 2248)

    • Reads the software policy settings

      • masvc.exe (PID: 924)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (43.5)
.exe | Win32 EXE Yoda's Crypter (42.7)
.exe | Win32 Executable (generic) (7.2)
.exe | Generic Win/DOS Executable (3.2)
.exe | DOS Executable Generic (3.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:12:07 19:36:30+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 937984
InitializedDataSize: 118784
UninitializedDataSize: 1724416
EntryPoint: 0x28a7c0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 5.8.1.313
ProductVersionNumber: 5.8.1.313
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Musarubra US LLC.
FileDescription: Trellix Smart Installer
FileVersion: 5.8.1.313
InternalName: TrellixSmartInstall.exe
LegalCopyright: Copyright (C) 2024 Musarubra US LLC. All rights reserved
OriginalFileName: TrellixSmartInstall.exe
ProductName: Trellix Agent
ProductVersion: 5.8.1.313
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
11
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
start trellixsmartinstall.exe frminst.exe macmnsvc.exe masvc.exe updaterui.exe mfemactl.exe mctray.exe no specs mcupdater.exe dxlsetup-ma.exe no specs dxlsetup-ma.exe trellixsmartinstall.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
548"C:\Users\admin\AppData\Local\Temp\TrellixSmartInstall.exe" C:\Users\admin\AppData\Local\Temp\TrellixSmartInstall.exe
explorer.exe
User:
admin
Company:
Musarubra US LLC.
Integrity Level:
HIGH
Description:
Trellix Smart Installer
Version:
5.8.1.313
Modules
Images
c:\users\admin\appdata\local\temp\trellixsmartinstall.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
924"C:\Program Files\McAfee\Agent\masvc.exe" /ServiceStartC:\Program Files\McAfee\Agent\masvc.exe
services.exe
User:
SYSTEM
Company:
Musarubra US LLC.
Integrity Level:
SYSTEM
Description:
Trellix Agent Service
Version:
5.8.1.313
Modules
Images
c:\program files\mcafee\agent\masvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mcafee\agent\libeay32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\gdi32.dll
1196"C:\Users\admin\AppData\Local\Temp\TrellixSmartInstall.exe" C:\Users\admin\AppData\Local\Temp\TrellixSmartInstall.exe—explorer.exe
User:
admin
Company:
Musarubra US LLC.
Integrity Level:
MEDIUM
Description:
Trellix Smart Installer
Exit code:
3221226540
Version:
5.8.1.313
Modules
Images
c:\users\admin\appdata\local\temp\trellixsmartinstall.exe
c:\windows\system32\ntdll.dll
1340"C:\Program Files\McAfee\Agent\macmnsvc.exe" /ServiceStartC:\Program Files\McAfee\Agent\macmnsvc.exe
services.exe
User:
LOCAL SERVICE
Company:
Musarubra US LLC.
Integrity Level:
SYSTEM
Description:
Trellix Agent Common Services
Version:
5.8.1.313
Modules
Images
c:\program files\mcafee\agent\macmnsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mcafee\agent\libeay32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\gdi32.dll
1880"C:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\DXL\dxlsetup-ma.exe" -burn.unelevated BurnPipe.{DC7E9337-48D2-449B-9E2C-1B401C0F9CBF} {A79C8642-012C-4200-B6F8-63A4E78C79B0} 2632 /norestart /silentC:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\DXL\dxlsetup-ma.exe
dxlsetup-ma.exe
User:
admin
Company:
Trellix
Integrity Level:
HIGH
Description:
Trellix Data Exchange Layer for TA
Version:
6.0.3.1021
Modules
Images
c:\users\admin\appdata\local\temp\mcafeesmartinstall\dxl\dxlsetup-ma.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2176 -install -location "C:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall" -initiator 2880C:\Program Files\McAfee\Agent\mcupdater.exe
FrmInst.exe
User:
admin
Company:
Musarubra US LLC.
Integrity Level:
HIGH
Description:
Trellix Agent Extension Updater
Version:
5.8.1.313
Modules
Images
c:\program files\mcafee\agent\mcupdater.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mcafee\agent\libeay32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\gdi32.dll
2248/loadC:\Program Files\McAfee\Agent\mctray.exe—UpdaterUI.exe
User:
admin
Company:
Trellix
Integrity Level:
MEDIUM
Description:
Trellix Tray Application
Version:
2.2.0.4696
Modules
Images
c:\program files\mcafee\agent\mctray.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mcafee\agent\mcafeewin32guisupportdll.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2632C:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\DXL\dxlsetup-ma.exe /norestart /silentC:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\DXL\dxlsetup-ma.exe—mcupdater.exe
User:
admin
Company:
Trellix
Integrity Level:
HIGH
Description:
Trellix Data Exchange Layer for TA
Version:
6.0.3.1021
Modules
Images
c:\users\admin\appdata\local\temp\mcafeesmartinstall\dxl\dxlsetup-ma.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2844"C:\Program Files\McAfee\Agent\\mfemactl.exe" --msi 1 --log "C:\ProgramData\McAfee\Agent\logs" --ppid 924 --interface 4D454F57010000000000000000000000C000000000000046000000000500000027A2145BA31EE896C0D3668376F544E6011400009C039805DCEBE999E7B90ED700000000 C:\Program Files\McAfee\Agent\mfemactl.exe
masvc.exe
User:
SYSTEM
Company:
Musarubra US LLC.
Integrity Level:
SYSTEM
Description:
Trellix Agent AAC Host
Version:
5.8.1.313
Modules
Images
c:\program files\mcafee\agent\mfemactl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mcafee\agent\ma_utils.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2880"C:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\FrmInst.exe" /Install=Agent /Silent /FramePkg /EnforceEvents /TenantID="0B753CAA-282E-4143-AFAA-B6956A3E3861" /AgentGUID="{20f4bfaa-aeda-4ef8-8332-ce638297293d}"C:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\FrmInst.exe
TrellixSmartInstall.exe
User:
admin
Company:
Musarubra US LLC.
Integrity Level:
HIGH
Description:
MA Setup Program
Version:
5.8.1.313
Modules
Images
c:\users\admin\appdata\local\temp\mcafeesmartinstall\frminst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
Total events
10 670
Read events
10 604
Write events
59
Delete events
7

Modification events

(PID) Process:(924) masvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\Agent\FirewallRules
Operation:writeName:Rule_1
Value:
Allow Agent HTTP Server,C:\Program Files\McAfee\Agent\macmnsvc.exe,0,,,,,1
(PID) Process:(924) masvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\Agent\FirewallRules
Operation:writeName:Rule_2
Value:
Allow Agent UDP Client,C:\Program Files\McAfee\Agent\macmnsvc.exe,1,,,,,1
(PID) Process:(924) masvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\Agent\FirewallRules
Operation:writeName:Rule_5
Value:
Allow Agent Compat Relay Discovery,C:\Program Files\McAfee\Agent\macmnsvc.exe,1,,,,8083,0
(PID) Process:(924) masvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\Agent\FirewallRules
Operation:writeName:Rule_6
Value:
Allow Agent TCP Traffic,C:\Program Files\McAfee\Agent\masvc.exe,0,,,,,1
(PID) Process:(924) masvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\Agent\FirewallRules
Operation:writeName:Rule_7
Value:
Allow Agent UDP Traffic,C:\Program Files\McAfee\Agent\masvc.exe,1,,,,,1
(PID) Process:(924) masvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\Agent\FirewallRules
Operation:writeName:Rule_8
Value:
Allow Agent Provisioning,C:\Program Files\McAfee\Agent\maconfig.exe,0,,,,,1
(PID) Process:(924) masvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\Agent\FirewallRules
Operation:writeName:Rule_9
Value:
Allow Agent Updater Engine TCP Traffic,C:\Program Files\McAfee\Agent\McScript_InUse.exe,0,,,,,1
(PID) Process:(924) masvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\Agent\FirewallRules
Operation:writeName:Rule_10
Value:
Allow Agent Updater Engine UDP Traffic,C:\Program Files\McAfee\Agent\McScript_InUse.exe,1,,,,,1
(PID) Process:(924) masvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\Agent\FirewallRules
Operation:writeName:Rule_11
Value:
Allow Agent Repository Mirror,C:\Program Files\McAfee\Agent\marepomirror.exe,0,,,,,1
(PID) Process:(924) masvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\Agent\FirewallRules
Operation:writeName:Rule_12
Value:
Allow Agent Provisioning,C:\Program Files\McAfee\Agent\maconfigCmd.exe,0,,,,,1
Executable files
9
Suspicious files
134
Text files
38
Unknown types
33

Dropped files

PID
Process
Filename
Type
548TrellixSmartInstall.exeC:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\Shared.cab —
MD5:—
SHA256:—
548TrellixSmartInstall.exeC:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\coninfo.xmlxml
MD5:391800A21D66F706C08908BA7200EF4F
SHA256:15B3EEDD2F795FADD68B5965B224580678D3E1C29A4AD1F34EBAFF77211A1A48
548TrellixSmartInstall.exeC:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\FrameworkInstall.zipcompressed
MD5:41E5CDC2A7BF95EF6A465FC50356A557
SHA256:5206D9FA9F89C7CA3729EF492AF868559DA99EA54D4D88C569773501C2CBE747
548TrellixSmartInstall.exeC:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\RepoKeys.iniini
MD5:4C9FA315DA6856C1BC0D74520167F519
SHA256:EDC63E39BDA39C600E426D5380F0913C825C522F3EE14DBC6750000720D89712
548TrellixSmartInstall.exeC:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\FrameworkConfig.zipcompressed
MD5:0D4181994F34F65FECF3A0E69D3236C9
SHA256:4CB4754D2937FA5239FC4A6382640276C3FCF10FC5DA53A14CA8A3AA50F782CA
548TrellixSmartInstall.exeC:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\cleanup.exeexecutable
MD5:A5C24E977890D96977A859723298AB1D
SHA256:44691F79E82E30B73CE208677CF8AB2B02021E903311841FE819AA69C6CF30A1
548TrellixSmartInstall.exeC:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\hashes.xmlxml
MD5:B48B0C1EDAA6C684DE3919928291BB00
SHA256:8530BDB81DBFFD2E3231B5BCD2863DA02AEA80BB17319EF69EC90DBC58DF403F
548TrellixSmartInstall.exeC:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\sr2048pubkey.binbinary
MD5:FB599B28155C00E05882C33FE06E5DF8
SHA256:B8F6AB4BBD8FE6C6BE3456BAA668945F71BA156D8D1D51C4BF335BFE98718642
548TrellixSmartInstall.exeC:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\FrmInst.exeexecutable
MD5:EF8D0352527B35E613BD4C37BFF66082
SHA256:C497FDA2C61BCB718591B416EB0895B7C68E7D18D8446C6DAA7EFEB98F9E35A9
548TrellixSmartInstall.exeC:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\MFEagent.msiexecutable
MD5:2B3B81058104C6BAA5A22FBFE1D26946
SHA256:2C878EF16D42EA1B8E20B760AEC84F1CE129504B50CE3BABC4437FF8EE7F8A77
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
8
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
548
TrellixSmartInstall.exe
GET
200
13.225.78.6:80
http://cdn-usw004.mvision.mcafee.com/Software/Current/EPOAGENT3000/Install/0409/FrameworkInstall.zip
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
548
TrellixSmartInstall.exe
52.32.216.244:443
ah-usw004.manage.trellix.com
AMAZON-02
US
unknown
548
TrellixSmartInstall.exe
192.168.100.255:8082
—
—
—
whitelisted
548
TrellixSmartInstall.exe
13.225.78.6:80
cdn-usw004.mvision.mcafee.com
AMAZON-02
US
whitelisted
924
masvc.exe
52.32.216.244:443
ah-usw004.manage.trellix.com
AMAZON-02
US
unknown

DNS requests

Domain
IP
Reputation
ah-usw004.manage.trellix.com
  • 52.32.216.244
  • 54.189.216.48
unknown
cdn-usw004.mvision.mcafee.com
  • 13.225.78.6
  • 13.225.78.79
  • 13.225.78.26
  • 13.225.78.93
unknown
sw-usw004.mvision.mcafee.com
  • 52.218.132.10
  • 52.92.186.123
  • 52.92.201.43
  • 52.92.200.43
  • 52.92.210.3
  • 52.92.180.35
  • 52.218.132.82
unknown
ah-usw004.mvision.mcafee.com
  • 52.32.216.244
  • 54.189.216.48
unknown
cdn-usw004.manage.trellix.com
  • 13.225.78.79
  • 13.225.78.6
  • 13.225.78.26
  • 13.225.78.93
unknown

Threats

No threats detected
Process
Message
FrmInst.exe
NotComDllGetInterface: DLL not found in install location, looking in current directory
FrmInst.exe
NotComDllGetInterface: DLL not found in install location, looking in current directory
FrmInst.exe
NotComDllGetInterface: DLL not found in install location, looking in current directory
FrmInst.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\FrmInst.exe loading C:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\mfevtpa.dll, WinVerifyTrust failed with 80092003
FrmInst.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\FrmInst.exe loading C:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\mfeaaca.dll, WinVerifyTrust failed with 80092003
FrmInst.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\FrmInst.exe loading C:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\mfeaaca.dll, WinVerifyTrust failed with 80092003
FrmInst.exe
NotComDllGetInterface: DLL not found in install location, looking in current directory
FrmInst.exe
NotComDllGetInterface: DLL not found in install location, looking in current directory
FrmInst.exe
NotComDllGetInterface: DLL not found in install location, looking in current directory
FrmInst.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\FrmInst.exe loading C:\Users\admin\AppData\Local\Temp\McAfeeSmartInstall\mfeaaca.dll, WinVerifyTrust failed with 80092003
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
TrellixSmartInstall.exe