mfefire.exe
by McAfee / Trellix
Endpoint Security
Summary
McAfee Firewall Core service
mfefire.exe is the 2788th most commonly executed Windows program in EchoTrail's dataset, observed 120 times across enterprise environments. It typically runs from C:\Program Files\Common Files\mcafee\SystemCore and it is most often launched by mfemms.exe.
2788th
most commonly executed Windows program
120
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Program Files\Common Files\mcafee\SystemCore100%
Top Hashes (SHA256)
- d38dbdd9e6e1ac4f93222ddaaa74833ac855e893d2905e861b2e3c0b52f1688941%
- e09e3b3590f0770ccb65350f29c8dea49ee2c26cd1e6276b41cee7cb3e95efe126%
- d071609d5f7353b251f7a45ff28e841488238c5491e0be0a37e97eca153057d520%
- a8ec1c1ee176f2132a473325b244ae7a468fb6ef163079577155443941b155da8%
- b7d297ffca147473c8bbf33defa7267c7e596af63bf5002bad03de050ea0b2f24%
- fa1d3f766ded7c4765ad51b985fd1e65c03315e9ed377bf0cef14b8d01dc7b061%
Process Ancestry
Top Grandparents
- services.exe75.76%
- wininit.exe24.24%
Top Parents
- mfemms.exe92.56%
- services.exe7.44%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about mfefire.exe
Rocky answers questions about mfefire.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.