mpnotify.exe
by Microsoft
Operating System
Summary
Windows MPNOTIFY - notification process for multiple provider router during logon.
mpnotify.exe is the 872nd most commonly executed Windows program in EchoTrail's dataset, observed 3,125 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by winlogon.exe.
872nd
most commonly executed Windows program
3,125
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Windows\System32100%
Top Hashes (SHA256)
- 09ab6c181076018f7bb9f73016a5fd8bb009ad4b5e2f37f28c9f1d16d612370a19.73%
- 33f636f222a3af0bbbe429cc87b25b21b6c56182936c81c9453c4bdfb61a3c5e19.66%
- 22601f36573e018612a8bcf51e2acd02893470f2c4f887acab4d6ca37cc8853112.83%
- d9ac91810d74e4e63a00f61357b010c9f1335be07ea3cbc68fd28cb369a16ac510.1%
- 089ab6eef1b657d1887d37cb7e8cda3428fd826a073234833941f362f2a711789.44%
- 398d4586a2728bad40b776c7905dfea28ce237f9e6258c1cae85b65059a0a9e68.91%
- e09740d26a0c9723de55173134dbbeb663a34085297ab14d7aeacd2bd594e55b8.81%
- 9e2be15984787436709c024b89bdb7b8da54daf0da1fdd040af1168973cf7c215.44%
- 77f61bb677dc591f01382e88307ce1bdb62c41d9929cb3c6ba3ec6c93fafc2ce3.66%
- 7909c265936da0d6af82cb245e77d1b3f8f30451690ecbe097e840b0ce08ddef0.49%
Process Ancestry
Top Grandparents
- smss.exe99.33%
- svchost.exe0.44%
- nvvsvc.exe0.15%
- hmpalert.exe0.07%
Top Parents
- winlogon.exe99.81%
- smss.exe0.03%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about mpnotify.exe
Rocky answers questions about mpnotify.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.