mpas-d.exe
by Microsoft
Endpoint Security
Summary
Windows Defender Antimalware signature delta update
mpas-d.exe is the 2854th most commonly executed Windows program in EchoTrail's dataset, observed 112 times across enterprise environments. It typically runs from C:\Windows\SoftwareDistribution\Download\Install and it is most often launched by wuauclt.exe.
2854th
most commonly executed Windows program
112
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Windows\SoftwareDistribution\Download\Install100%
Top Hashes (SHA256)
- 19cabecde2e2e92a06a7c462bfd1051fd1e255e3a2a353c0cf683919be0649804.46%
- 293ad6d76f8c6cbb8b0bb97b9a9ca80ab755d63027cd93f31f7a8e0041bc8dfd4.46%
- 5091a71745b35cc45bf62746a1874a97f2af4d26c5c4cff18eee4f518d9b604b4.46%
- f340a8e40b54a6baa41a221eaeaf16724c1b573049bf05c40c20a471a202d4064.46%
- 00e16b098e4979aed88a9bc128d66cb5310adff10d162d509da348776304162f3.57%
- 45ec5c4767bf895281aac010ac24b9305c99fb0704554f55eefea6ec425c44ac3.57%
- 685fe6f1f81100b01505838d6ce66fc56f582825b304d17bd74bd7f330e8c8f03.57%
- 813656163b8e46cef79936368402db5e79246d70ddc0fe56e44242586669157c3.57%
- 8d9d2da575104a0fa7c5540b375810f329100fafbe4db8d7359e084a265153803.57%
- 919ccec428fc6b1d21b110e356c16c2c553b8dd4ada2f64f04d32f74f97ba0b03.57%
Process Ancestry
Top Grandparents
- svchost.exe100%
Top Parents
- wuauclt.exe100%
Top Children
- MpSigStub.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about mpas-d.exe
Rocky answers questions about mpas-d.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.