mcocrollback.exe
by McAfee/Various
Endpoint Security
Summary
MCO Rollback - McAfee or management console operation rollback utility.
mcocrollback.exe is the 1009th most commonly executed Windows program in EchoTrail's dataset, observed 2,022 times across enterprise environments. It typically runs from C:\Program Files\mcafee\msc\oobe.
1009th
most commonly executed Windows program
2,022
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Program Files\mcafee\msc\oobe100%
Top Hashes (SHA256)
- e73f4fcbcd81215122dab2d978b402ae7a5fa7379a735fce98d6f58403a93dc172.91%
- 8f4bc485b55e5ebeed443348d3bb169146d29e014cf4af995c32024de06790da17.7%
- ac1c69e47941509fb9c5beecff8a1ca37914f0ae78ed3ff82c2b9b97aad6298a8.3%
- 0e5a470995fe7de50386e91afa041a9405280fd280c68250e6cfceace595920c1.09%
Process Ancestry
Top Grandparents
- services.exe100%
Top Children
- conhost.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about mcocrollback.exe
Rocky answers questions about mcocrollback.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.