Process
ubiquitoussigned
mpdefendercoreservice.exe
File identity
File details
- File type
- PE32+ executable
- Magic
- PE32+ executable (GUI)
- Original name
- MpDefenderCoreService.exe
- Internal name
- MpDefenderCoreService.exe
- Product
- Microsoft® Windows® Operating System
Signing information
- Status
- Signed
- Publisher
- Microsoft Corporation
- Signer
- Microsoft Windows Publisher
- Issuer
- Microsoft Windows Production PCA 2011
- Signature rate
- 100%
File version1
4.18.26040.7 (8d846dd50fd7adca65beb1b013a5fda76a9ec807)100%
File size1
2047.30 KB100%
Execution context
File paths1
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26040.7-0\MpDefenderCoreService.exe100%
User context0
Not observed.
Integrity level0
Not observed.
Instances1
1100%
Session1
Session 0100%
Token privileges7
SeIncreaseQuotaPrivilege100%SeRestorePrivilege100%SeShutdownPrivilege100%SeSecurityPrivilege100%SeBackupPrivilege100%
Ancestry
Parents0
Not observed.
Children0
Not observed.
Grandparents0
Not observed.
Grandchildren0
Not observed.
Behavior
Loaded modules0
Not observed.
Named pipes0
Not observed.
Process handles0
Not observed.
Command-line patterns0
Not observed.
Indicators
Hashes
Not observed.
Analysis
About this process
No analyst write-up yet.
Security notes
No analyst write-up yet.
Anomaly signals
None defined yet.
Telemetry
OS prevalence1
Microsoft Windows 11 Enterprise Evaluation100%
Observation timeline
- First seen
- 2026-06-08
- Last seen
- 2026-06-08
- Machines
- 1