McSACore.exe
SiteAdvisor Enterprise Plus by McAfee (Signed)
| Version: | 3.0.0.638 |
| MD5: | 4f2d526298cbc517edb82501e8041112 |
| SHA1: | 9663227405157536439ee689122831f5d277414c |
| SHA256: | 1acf383235fbc3500b50859a31ad39d5fdf4579f98631ee74ae96e38697d0d3b |
Overview
mcsacore.exe runs as a service under the name McAfee SiteAdvisor Enterprise Service with extensive SYSTEM privileges (full administrator access). This is typically installed with the program McAfee SiteAdvisor Enterprise Plus published by McAfee, Inc.. The file is digitally signed by McAfee which was issued by the VeriSign certificate authority (CA).
Details
| File name: | mcsacore.exe |
| Publisher: | McAfee, Inc. |
| Product name: | SiteAdvisor Enterprise Plus |
| Description: | SiteAdvisor |
| Typical file path: | C:\Program Files\mcafee\siteadvisor enterprise\mcsacore.exe |
| File version: | 3.0.0.638 |
| Product version: | 3.0.0.0 |
| Size: | 317.31 KB (324,928 bytes) |
| Certificate |
| Issued to: | McAfee |
| Authority (CA): | VeriSign |
| Effective date: | Friday, September 12, 2008 |
| Expiration date: | Sunday, October 9, 2011 |
| Digital DNA |
| PE subsystem: | Windows GUI |
| File packed: | No |
| Code language: | Microsoft Visual C++ 8.0 |
| .NET CLR: | No |
More details
Programs
The following program will install this file
“SiteAdvisor Enterprise relies on McAfee Global Threat Intelligence — our cloud-based rating service that continually scans the Internet with intelligent bots or virtual computers, downloads sites, and scans them for malware. The bots even fill out registration forms to determine whether signing up triggers spam. If the site contains malicious code or other suspicious activity, SiteAdvisor Enterprise marks the site “red” for risky. Feat...”
Behaviors
Service
Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)
- 'McAfee SiteAdvisor Enterprise Service'
Resource utilization
(Note: statistics below are averages based on a minimum sample size of 200 unique participants)
Averages
| CPU |
| Total CPU: | 0.00063748% | |
| Kernel CPU: | 0.00048973% | |
| User CPU: | 0.00014774% | |
| Kernel CPU time: | 156 ms/min | |
| CPU cycles: | 17,771/sec | |
| Memory |
| Private memory: | 3.27 MB | |
| Private (maximum): | 5.54 MB | |
| Private (minimum): | 1020 KB | |
| Non-paged memory: | 3.27 MB | |
| Virtual memory: | 57.23 MB | |
| Virtual memory (peak): | 61.73 MB | |
| Working set: | 2.68 MB | |
| Working set (peak): | 7.61 MB | |
| Page faults: | 4,897/min | |
| I/O |
| I/O read transfer: | 294 Bytes/sec | |
| I/O read operations: | 1/sec | |
| I/O other transfer: | 26 Bytes/sec | |
| I/O other operations: | 5/sec | |
| Resource allocations |
| Threads: | 6 | |
| Handles: | 126 | |
Process properties
| Integrety level: | System |
| Platform: | 64-bit |
| Command line: | "C:\Program Files\mcafee\siteadvisor enterprise\mcsacore.exe" |
| Owner: | SYSTEM |
| Windows Service |
| Service name: | McAfee SiteAdvisor Enterprise Service |
| Description: | “Provides low-level support for McAfee SiteAdvisor” |
| Type: | Win32OwnProcess |
| Parent process: | services.exe (Services and Controller app by Microsoft) |
Threads
Averages
| McSACore.exe (main module) |
| Total CPU: | 0.00027985% | |
| Kernel CPU: | 0.00018413% | |
| User CPU: | 0.00009572% | |
| CPU cycles: | 4,674/sec | |
| Memory: | 316 KB | |
| wow64.dll (Win32 Emulation on NT64 by Microsoft) |
| Total CPU: | 0.00027256% | |
| Kernel CPU: | 0.00000000% | |
| User CPU: | 0.00027256% | |
| CPU cycles: | 4,384/sec | |
| Memory: | 252 KB | |
Common loaded modules
These are modules that are typiclaly loaded within the context of this process.
Distribution by Windows OS
| OS version | distribution |
| Windows 7 Professional |
66.67% |
|
| Windows 7 Home Premium |
33.33% |
|
Distribution by country
TT installs about 66.67% of SiteAdvisor Enterprise Plus.
Distribution by PC manufacturer
| PC Manufacturer | distribution |
| Lenovo |
100.00% |
|
