Should I block it?

No, this file is 100% safe to run.

Additional versions

SYSCORE.15.1.0.668	16.42%
SYSCORE.15.1.0.666	0.50%
SYSCORE.15.1.0.649	1.49%
SYSCORE.15.1.0.641	6.47%
SYSCORE.15.1.0.631	1.49%
SYSCORE.15.1.0.609	0.50%
SYSCORE.15.1.0.609	0.50%
SYSCORE.15.1.0.595	7.46%
SYSCORE.15.1.0.595	25.37%
SYSCORE.15.1.0.594	3.48%
SYSCORE.15.1.0.594	5.47%
SYSCORE.15.1.0.588	15.42%
SYSCORE.15.1.0.588	0.50%
SYSCORE.15.1.0.580	0.50%
SYSCORE.15.1.0.563	0.50%
SYSCORE.15.1.0.526	0.50%
SYSCORE.15.1.0.526	0.50%
SYSCORE.15.1.0.518	0.50%
SYSCORE.15.1.0.518	6.47%
SYSCORE.15.1.0.518	1.49%
SYSCORE.14.4.0.503	0.50%
SYSCORE.14.4.0.503	0.50%
SYSCORE.14.4.0.503	0.50%
SYSCORE.14.4.0.478	0.50%
SYSCORE.14.4.0.452	0.50%
View more
SYSCORE.14.3.0.514	0.50%
SYSCORE.14.2.0.964.x86	0.50%
SYSCORE.14.2.0.866.x86	0.50%
SYSCORE.14.2.0.866.x64	0.50%

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

PE file structure

Show functions

Import table

advapi32.dll

BuildTrusteeWithSidW, GetSecurityDescriptorDacl, GetExplicitEntriesFromAclW, GetSidSubAuthority, IsValidSid, GetSidIdentifierAuthority, OpenProcessToken, SetNamedSecurityInfoW, GetNamedSecurityInfoW, EqualSid, LookupPrivilegeValueW, AdjustTokenPrivileges, RegCreateKeyExW, SetEntriesInAclW, FreeSid, AllocateAndInitializeSid, StartServiceCtrlDispatcherW, RegisterServiceCtrlHandlerW, SetServiceStatus, RegOpenKeyExW, RegSetValueExW, RegNotifyChangeKeyValue, RegDeleteValueW, UnregisterTraceGuids, RegisterTraceGuidsW, GetTraceLoggerHandle, GetTraceEnableLevel, GetTraceEnableFlags, TraceEvent, RegQueryValueExW, RegCloseKey, GetSidSubAuthorityCount

kernel32.dll

UnmapViewOfFile, GetSystemTimeAsFileTime, GetCurrentProcessId, GetTickCount, QueryPerformanceCounter, GetModuleHandleA, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlUnwind, SetLastError, DebugBreak, TerminateProcess, LeaveCriticalSection, EnterCriticalSection, GetCurrentThreadId, DeleteCriticalSection, InitializeCriticalSection, InterlockedExchange, InterlockedDecrement, InterlockedIncrement, InterlockedCompareExchange, GetCurrentProcess, GetVersionExW, GetLastError, FreeLibrary, GetProcAddress, LoadLibraryW, GetModuleFileNameW, LoadLibraryExW, LocalFree, LocalAlloc, SetEvent, CloseHandle, WaitForMultipleObjects, CreateThread, CreateEventW, CancelWaitableTimer, WaitForSingleObject, SetWaitableTimer, CreateWaitableTimerW, GetWindowsDirectoryW, CreateDirectoryW, CreateFileW, WriteFile, GetFileSizeEx, GetLocalTime, SetFilePointer, Sleep, ResetEvent, GetFileTime, GetProcessHeap, MapViewOfFile, CreateFileMappingW, GetFileSize, FindNextChangeNotification, FindFirstChangeNotificationW, GetSystemDirectoryW, DeviceIoControl, MultiByteToWideChar, HeapFree, FindFirstFileW, FindClose, LoadLibraryA, GetSystemInfo, OpenProcess, DuplicateHandle, CreateMutexW, ReleaseMutex

msvcrt.dll

DllMain

ntdll.dll

_stricmp

ole32.dll

CoCreateInstance, CoInitialize, CoUninitialize, CoTaskMemFree

rpcrt4.dll

NdrServerCall2, RpcServerUnregisterIf, RpcServerUseProtseqEpW, RpcServerRegisterIf, RpcServerListen, RpcBindingFree, RpcMgmtStopServerListening

user32.dll

wsprintfW

ws2_32.dll

WSACreateEvent, WSAIoctl, WSAResetEvent, WSAStringToAddressA

mfefire.exe

SYSCORE by McAfee (Signed)

Remove mfefire.exe

Version:	SYSCORE.15.1.0.580
MD5:	34d91c5e8e0e5187bcba8077e29cab00
SHA1:	bb4ee919ce26ddf3a4b491ff36bdde4cb0f5fe83

What is mfefire.exe?

McAfee Core Firewall Service is part of McAfee's core security products. This is a common modules that is shared between a number of McAfee progams.

Overview

mfefire.exe runs as a service under the name McAfee Firewall Core Service (mfefire) with extensive SYSTEM privileges (full administrator access). The file is digitally signed by McAfee which was issued by the VeriSign certificate authority (CA).

Details

File name:	mfefire.exe
Publisher:	McAfee, Inc.
Product name:	SYSCORE
Description:	McAfee Core Firewall Service
Typical file path:	C:\Program Files\common files\mcafee\systemcore\mfefire.exe
File version:	SYSCORE.15.1.0.580
Size:	213.2 KB (218,320 bytes)
Certificate
Issued to:	McAfee
Authority (CA):	VeriSign
Expiration date:	Tuesday, December 31, 2013
Digital DNA
PE subsystem:	Windows Console
File packed:	No
Code language:	Microsoft Visual C++
.NET CLR:	No

More details

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'mfefire' (McAfee Firewall Core Service)
mfefire

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00006629%	0.028634%
Kernel CPU:	0.00006592%	0.013761%
User CPU:	0.00000036%	0.014873%
Kernel CPU time:	110,542 ms/min	100,923,805ms/min
Memory
Private memory:	4.11 MB	21.59 MB
Private (maximum):	8.72 MB
Private (minimum):	7.82 MB
Non-paged memory:	4.11 MB	21.59 MB
Virtual memory:	46.82 MB	140.96 MB
Virtual memory (peak):	48.82 MB	169.69 MB
Working set:	8.25 MB	18.61 MB
Working set (peak):	8.79 MB	37.95 MB
Resource allocations
Threads:	7	12
Handles:	135	600

Process properties

Integrety level:	Undefined
Platform:	64-bit
Command line:	"C:\Program Files\common files\mcafee\systemcore\\mfefire.exe"
Owner:	SYSTEM
Windows Service
Service name:	mfefire
Display name:	McAfee Firewall Core Service
Description:	“Provides firewall services to McAfee products”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads