» McSACore.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

McSACore.exe

SiteAdvisor Enterprise Plus

McAfee, Inc.

It runs as a separate (within the context of its own process) windows Service named “McAfee SiteAdvisor Enterprise Service”. This is installed with McAfee SiteAdvisor Enterprise Plus.

File name:

McSACore.exe

Publisher:

McAfee, Inc. (signed and verified)

Product:

SiteAdvisor Enterprise Plus

Description:

SiteAdvisor

Version:

3.0.0.561

MD5:

20f77f14fe972aa028454047632b2ac8

SHA-1:

1c7f414ac3d2a2afd47487ab4f3dfbba6d1643ec

SHA-256:

4a597edd7f9e058ff7e3b349e5ba5f1029385eb8aba5ed8d99d88a5be81746cb

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

4/19/2024 10:18:56 PM UTC (today)

File size:

221.3 KB (226,624 bytes)

Product version:

3.0.0.0

Original file name:

McSACore.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\mcafee\siteadvisor enterprise\mcsacore.exe

Digital Signature

Signed by:

McAfee, Inc.

Authority:

VeriSign, Inc.

Valid from:

9/12/2008 9:00:00 PM

Valid to:

10/9/2011 8:59:59 PM

Subject:

CN="McAfee, Inc.", OU=IIS, OU=Digital ID Class 3 - Microsoft Software Validation v2, O="McAfee, Inc.", L=Santa Clara, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa (c)04, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

564A361E168A81A8F3EFAADA332508E1

File PE Metadata

Compilation timestamp:

3/5/2010 1:28:27 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

3072:UsoMMxkoZLA9KncitAgSeDuA8QsseRLPjA/JcSPM4OMQkLBYdYd:ZoMOFJDwxKOSPM4OMQkLBYdG

Entry address:

0x1C0FF

Entry point:

E8, D0, 03, 00, 00, E9, 36, FD, FF, FF, CC, CC, CC, CC, CC, CC, CC, 51, 8D, 4C, 24, 08, 2B, C8, 83, E1, 0F, 03, C1, 1B, C9, 0B, C1, 59, E9, 4A, FA, FF, FF, 51, 8D, 4C, 24, 08, 2B, C8, 83, E1, 07, 03, C1, 1B, C9, 0B, C1, 59, E9, 34, FA, FF, FF, 68, 34, BB, 41, 00, 64, FF, 35, 00, 00, 00, 00, 8B, 44, 24, 10, 89, 6C, 24, 10, 8D, 6C, 24, 10, 2B, E0, 53, 56, 57, A1, 68, A0, 42, 00, 31, 45, FC, 33, C5, 50, 89, 65, E8, FF, 75, F8, 8B, 45, FC, C7, 45, FC, FE, FF, FF, FF, 89, 45, F8, 8D, 45, F0, 64, A3, 00, 00, 00... 
[+]

Entropy:

6.1064

Code size:

120 KB (122,880 bytes)

Service

Display name:

McAfee SiteAdvisor Enterprise Service

Description:

Provides low-level support for McAfee SiteAdvisor

Type:

Win32OwnProcess

The file McSACore.exe has been discovered within the following program.

McAfee SiteAdvisor Enterprise Plus by McAfee, Inc.

Publisher's description - “SiteAdvisor Enterprise relies on McAfee Global Threat Intelligence — our cloud-based rating service that continually scans the Internet with intelligent bots or virtual computers, downloads sites, and scans them for malware.”

www.mcafee.com

About 3% of users remove it

Scan McSACore.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.