Should I block it?

No, this file is 100% safe to run.

Additional versions

SYSCORE.15.1.0.668	16.42%
SYSCORE.15.1.0.666	0.50%
SYSCORE.15.1.0.649	1.49%
SYSCORE.15.1.0.641	6.47%
SYSCORE.15.1.0.631	1.49%
SYSCORE.15.1.0.609	0.50%
SYSCORE.15.1.0.609	0.50%
SYSCORE.15.1.0.595	7.46%
SYSCORE.15.1.0.595	25.37%
SYSCORE.15.1.0.594	3.48%
SYSCORE.15.1.0.594	5.47%
SYSCORE.15.1.0.588	15.42%
SYSCORE.15.1.0.588	0.50%
SYSCORE.15.1.0.580	0.50%
SYSCORE.15.1.0.563	0.50%
SYSCORE.15.1.0.526	0.50%
SYSCORE.15.1.0.526	0.50%
SYSCORE.15.1.0.518	0.50%
SYSCORE.15.1.0.518	6.47%
SYSCORE.15.1.0.518	1.49%
SYSCORE.14.4.0.503	0.50%
SYSCORE.14.4.0.503	0.50%
SYSCORE.14.4.0.503	0.50%
SYSCORE.14.4.0.478	0.50%
SYSCORE.14.4.0.452	0.50%
View more
SYSCORE.14.3.0.514	0.50%
SYSCORE.14.2.0.964.x86	0.50%
SYSCORE.14.2.0.866.x86	0.50%
SYSCORE.14.2.0.866.x64	0.50%

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

PE file structure

Show functions

Import table

advapi32.dll

BuildTrusteeWithSidW, GetSecurityDescriptorDacl, GetExplicitEntriesFromAclW, GetSidSubAuthority, IsValidSid, GetSidIdentifierAuthority, OpenProcessToken, SetNamedSecurityInfoW, GetNamedSecurityInfoW, EqualSid, LookupPrivilegeValueW, AdjustTokenPrivileges, RegCreateKeyExW, SetEntriesInAclW, FreeSid, AllocateAndInitializeSid, StartServiceCtrlDispatcherW, RegisterServiceCtrlHandlerW, SetServiceStatus, RegOpenKeyExW, RegSetValueExW, RegNotifyChangeKeyValue, RegDeleteValueW, UnregisterTraceGuids, RegisterTraceGuidsW, GetTraceLoggerHandle, GetTraceEnableLevel, GetTraceEnableFlags, TraceEvent, RegQueryValueExW, RegCloseKey, GetSidSubAuthorityCount

kernel32.dll

UnmapViewOfFile, GetSystemTimeAsFileTime, GetCurrentProcessId, GetTickCount, QueryPerformanceCounter, GetModuleHandleA, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlUnwind, SetLastError, DebugBreak, TerminateProcess, LeaveCriticalSection, EnterCriticalSection, GetCurrentThreadId, DeleteCriticalSection, InitializeCriticalSection, InterlockedExchange, InterlockedDecrement, InterlockedIncrement, InterlockedCompareExchange, GetCurrentProcess, GetVersionExW, GetLastError, FreeLibrary, GetProcAddress, LoadLibraryW, GetModuleFileNameW, LoadLibraryExW, LocalFree, LocalAlloc, SetEvent, CloseHandle, WaitForMultipleObjects, CreateThread, CreateEventW, CancelWaitableTimer, WaitForSingleObject, SetWaitableTimer, CreateWaitableTimerW, GetWindowsDirectoryW, CreateDirectoryW, CreateFileW, WriteFile, GetFileSizeEx, GetLocalTime, SetFilePointer, Sleep, ResetEvent, GetFileTime, GetProcessHeap, MapViewOfFile, CreateFileMappingW, GetFileSize, FindNextChangeNotification, FindFirstChangeNotificationW, GetSystemDirectoryW, DeviceIoControl, MultiByteToWideChar, HeapFree, FindFirstFileW, FindClose, LoadLibraryA, GetSystemInfo, OpenProcess, DuplicateHandle, CreateMutexW, ReleaseMutex

msvcrt.dll

DllMain

ntdll.dll

_stricmp

ole32.dll

CoCreateInstance, CoInitialize, CoUninitialize, CoTaskMemFree

rpcrt4.dll

NdrServerCall2, RpcServerUnregisterIf, RpcServerUseProtseqEpW, RpcServerRegisterIf, RpcServerListen, RpcBindingFree, RpcMgmtStopServerListening

user32.dll

wsprintfW

ws2_32.dll

WSACreateEvent, WSAIoctl, WSAResetEvent, WSAStringToAddressA

mfefire.exe

SYSCORE by McAfee (Signed)

Remove mfefire.exe

Version:	SYSCORE.14.4.0.503
MD5:	b26782c3d6045b4464017d7926877560
SHA1:	a95d82d27628b865c92be76ccb57e4eff0133ac2

What is mfefire.exe?

McAfee Core Firewall Service is part of McAfee's core security products. This is a common modules that is shared between a number of McAfee progams.

Overview

mfefire.exe runs as a service under the name McAfee Firewall Core Service (mfefire) with extensive SYSTEM privileges (full administrator access). The file is digitally signed by McAfee which was issued by the VeriSign certificate authority (CA).

Details

File name:	mfefire.exe
Publisher:	McAfee, Inc.
Product name:	SYSCORE
Description:	McAfee Core Firewall Service
Typical file path:	C:\Program Files\common files\mcafee\systemcore\mfefire.exe
File version:	SYSCORE.14.4.0.503
Size:	205.65 KB (210,584 bytes)
Build date:	2/13/2012 11:40 PM
Certificate
Issued to:	McAfee
Authority (CA):	VeriSign
Expiration date:	Tuesday, December 31, 2013
Digital DNA
PE subsystem:	Windows Console
File packed:	No
Code language:	Microsoft Visual C++
.NET CLR:	No

More details

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'mfefire' (McAfee Firewall Core Service)
mfefire

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00082780%	0.028634%
Kernel CPU:	0.00039153%	0.013761%
User CPU:	0.00043627%	0.014873%
Kernel CPU time:	1,560 ms/min	100,923,805ms/min
Memory
Private memory:	2.84 MB	21.59 MB
Private (maximum):	13.25 MB
Private (minimum):	668 KB
Non-paged memory:	2.84 MB	21.59 MB
Virtual memory:	41.13 MB	140.96 MB
Virtual memory (peak):	44.26 MB	169.69 MB
Working set:	804 KB	18.61 MB
Working set (peak):	13.25 MB	37.95 MB
Resource allocations
Threads:	7	12
Handles:	126	600

Process properties

Integrety level:	System
Platform:	64-bit
Command line:	"C:\Program Files\common files\mcafee\systemcore\\mfefire.exe"
Owner:	SYSTEM
Windows Service
Service name:	mfefire
Display name:	McAfee Firewall Core Service
Description:	“Provides firewall services to McAfee products”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads