mcocrollback.exe
by McAfee/Various
Endpoint Security
Sources: 300M+ executions observed in the wild.
Summary
MCO Rollback - McAfee or management console operation rollback utility.
mcocrollback.exe is the 1009th most commonly executed Windows program in EchoTrail's dataset, observed 2,022 times across enterprise environments. It typically runs from C:\Program Files\mcafee\msc\oobe.
Get this in your tools
The same record for mcocrollback.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/mcocrollback.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
1009th
most commonly executed Windows program
2,022
observed endpoint executions
Behavior
Top Paths
- C:\Program Files\mcafee\msc\oobe100%
Top Hashes (SHA256)
- e73f4fcbcd81215122dab2d978b402ae7a5fa7379a735fce98d6f58403a93dc172.91%
- 8f4bc485b55e5ebeed443348d3bb169146d29e014cf4af995c32024de06790da17.7%
- ac1c69e47941509fb9c5beecff8a1ca37914f0ae78ed3ff82c2b9b97aad6298a8.3%
- 0e5a470995fe7de50386e91afa041a9405280fd280c68250e6cfceace595920c1.09%
Process Ancestry
Top Grandparents
- services.exe100%
Top Children
- conhost.exe100%
Ask Rocky about mcocrollback.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for mcocrollback.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.