Should I block it?

No, this file is 100% safe to run.

Additional versions

SYSCORE.15.1.0.668	16.42%
SYSCORE.15.1.0.666	0.50%
SYSCORE.15.1.0.649	1.49%
SYSCORE.15.1.0.641	6.47%
SYSCORE.15.1.0.631	1.49%
SYSCORE.15.1.0.609	0.50%
SYSCORE.15.1.0.609	0.50%
SYSCORE.15.1.0.595	7.46%
SYSCORE.15.1.0.595	25.37%
SYSCORE.15.1.0.594	3.48%
SYSCORE.15.1.0.594	5.47%
SYSCORE.15.1.0.588	15.42%
SYSCORE.15.1.0.588	0.50%
SYSCORE.15.1.0.580	0.50%
SYSCORE.15.1.0.563	0.50%
SYSCORE.15.1.0.526	0.50%
SYSCORE.15.1.0.526	0.50%
SYSCORE.15.1.0.518	0.50%
SYSCORE.15.1.0.518	6.47%
SYSCORE.15.1.0.518	1.49%
SYSCORE.14.4.0.503	0.50%
SYSCORE.14.4.0.503	0.50%
SYSCORE.14.4.0.503	0.50%
SYSCORE.14.4.0.478	0.50%
SYSCORE.14.4.0.452	0.50%
View more
SYSCORE.14.3.0.514	0.50%
SYSCORE.14.2.0.964.x86	0.50%
SYSCORE.14.2.0.866.x86	0.50%
SYSCORE.14.2.0.866.x64	0.50%

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

PE file structure

Show functions

Import table

advapi32.dll

BuildTrusteeWithSidW, GetSecurityDescriptorDacl, GetExplicitEntriesFromAclW, GetSidSubAuthority, IsValidSid, GetSidIdentifierAuthority, OpenProcessToken, SetNamedSecurityInfoW, GetNamedSecurityInfoW, EqualSid, LookupPrivilegeValueW, AdjustTokenPrivileges, RegCreateKeyExW, SetEntriesInAclW, FreeSid, AllocateAndInitializeSid, StartServiceCtrlDispatcherW, RegisterServiceCtrlHandlerW, SetServiceStatus, RegOpenKeyExW, RegSetValueExW, RegNotifyChangeKeyValue, RegDeleteValueW, UnregisterTraceGuids, RegisterTraceGuidsW, GetTraceLoggerHandle, GetTraceEnableLevel, GetTraceEnableFlags, TraceEvent, RegQueryValueExW, RegCloseKey, GetSidSubAuthorityCount

kernel32.dll

UnmapViewOfFile, GetSystemTimeAsFileTime, GetCurrentProcessId, GetTickCount, QueryPerformanceCounter, GetModuleHandleA, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlUnwind, SetLastError, DebugBreak, TerminateProcess, LeaveCriticalSection, EnterCriticalSection, GetCurrentThreadId, DeleteCriticalSection, InitializeCriticalSection, InterlockedExchange, InterlockedDecrement, InterlockedIncrement, InterlockedCompareExchange, GetCurrentProcess, GetVersionExW, GetLastError, FreeLibrary, GetProcAddress, LoadLibraryW, GetModuleFileNameW, LoadLibraryExW, LocalFree, LocalAlloc, SetEvent, CloseHandle, WaitForMultipleObjects, CreateThread, CreateEventW, CancelWaitableTimer, WaitForSingleObject, SetWaitableTimer, CreateWaitableTimerW, GetWindowsDirectoryW, CreateDirectoryW, CreateFileW, WriteFile, GetFileSizeEx, GetLocalTime, SetFilePointer, Sleep, ResetEvent, GetFileTime, GetProcessHeap, MapViewOfFile, CreateFileMappingW, GetFileSize, FindNextChangeNotification, FindFirstChangeNotificationW, GetSystemDirectoryW, DeviceIoControl, MultiByteToWideChar, HeapFree, FindFirstFileW, FindClose, LoadLibraryA, GetSystemInfo, OpenProcess, DuplicateHandle, CreateMutexW, ReleaseMutex

msvcrt.dll

DllMain

ntdll.dll

_stricmp

ole32.dll

CoCreateInstance, CoInitialize, CoUninitialize, CoTaskMemFree

rpcrt4.dll

NdrServerCall2, RpcServerUnregisterIf, RpcServerUseProtseqEpW, RpcServerRegisterIf, RpcServerListen, RpcBindingFree, RpcMgmtStopServerListening

user32.dll

wsprintfW

ws2_32.dll

WSACreateEvent, WSAIoctl, WSAResetEvent, WSAStringToAddressA

mfefire.exe

SYSCORE by McAfee (Signed)

Remove mfefire.exe

Version:	SYSCORE.15.1.0.666
MD5:	a769fabf6f9b5e72450f9e161c83d495
SHA1:	bf2ab3ac4a969c1c91ad55a012c9e6d9df270bf6

What is mfefire.exe?

McAfee Core Firewall Service is part of McAfee's core security products. This is a common modules that is shared between a number of McAfee progams.

Overview

mfefire.exe runs as a service under the name McAfee Firewall Core Service (mfefire) with extensive SYSTEM privileges (full administrator access). The file is digitally signed by McAfee which was issued by the VeriSign certificate authority (CA).

Details

File name:	mfefire.exe
Publisher:	McAfee, Inc.
Product name:	SYSCORE
Description:	McAfee Core Firewall Service
Typical file path:	C:\Program Files\common files\mcafee\systemcore\mfefire.exe
File version:	SYSCORE.15.1.0.666
Size:	214.6 KB (219,752 bytes)
Build date:	3/10/2014 8:11 PM
Certificate
Issued to:	McAfee
Authority (CA):	VeriSign
Expiration date:	Tuesday, December 31, 2013
Digital DNA
PE subsystem:	Windows Console
File packed:	No
Code language:	Microsoft Visual C++
.NET CLR:	No

More details

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'mfefire' (McAfee Firewall Core Service)
mfefire

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00061467%	0.028634%
Kernel CPU:	0.00046352%	0.013761%
User CPU:	0.00015115%	0.014873%
Kernel CPU time:	47 ms/min	100,923,805ms/min
CPU cycles:	130,525/sec	17,470,203/sec
Context switches:	1/sec	284/sec
Memory
Private memory:	2.89 MB	21.59 MB
Private (maximum):	6.96 MB
Private (minimum):	6.92 MB
Non-paged memory:	2.89 MB	21.59 MB
Virtual memory:	47.02 MB	140.96 MB
Virtual memory (peak):	50.14 MB	169.69 MB
Working set:	6.93 MB	18.61 MB
Working set (peak):	6.96 MB	37.95 MB
Page faults:	1,827/min	2,039/min
I/O
I/O other transfer:	1.58 KB/sec	448.09 KB/min
I/O other operations:	43/sec	1,671/min
Resource allocations
Threads:	8	12
Handles:	133	600

Process properties

Integrety level:	System
Platform:	64-bit
Command line:	"C:\Program Files\common files\mcafee\systemcore\\mfefire.exe"
Owner:	SYSTEM
Windows Service
Service name:	mfefire
Display name:	McAfee Firewall Core Service
Description:	“Provides firewall services to McAfee products”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads