mfemms.exe
by McAfee / Trellix
Endpoint Security
Summary
McAfee Firewall Management service
mfemms.exe is the 2149th most commonly executed Windows program in EchoTrail's dataset, observed 261 times across enterprise environments. It typically runs from C:\Program Files\Common Files\McAfee\SystemCore and it is most often launched by services.exe.
2149th
most commonly executed Windows program
261
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Program Files\Common Files\McAfee\SystemCore100%
Top Hashes (SHA256)
- 1da2f0e801aa43099923a20d0c3f24d5ea71220fdbd87bc3be7fd4609cc19ee161.92%
- 19a5d12ced08f3ca86f27deffbcc90497bde79403cbb540b7545b34d5a61b2e216.32%
- b77d293859d3778422396d8df01ebd1da7350d2df74846c09d32d87bde46914910.04%
- de6190b4b71cfab808bfaf626e61e16c3b9db75b7cc6d24a0285e293c57537669.21%
- 7b84db8b4cf83a1a21b0e63971e564a391e184ebbab6845c9b47edb2b77548bd1.67%
- 87d793eb3eb78ef1f85c5fea8e1c4b2eb157295f4b3c4b3ab2e52f6a19a30cec0.84%
Process Ancestry
Top Grandparents
- wininit.exe100%
Top Parents
- services.exe99.24%
Top Children
- MfeAVSvc.exe18.99%
- mfevtps.exe17.3%
- mfefire.exe17.15%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about mfemms.exe
Rocky answers questions about mfemms.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.