WPDShextAutoplay.exe
Summary
Windows Portable Devices Shell Extension AutoPlay - handles AutoPlay for portable devices (cameras, phones).
WPDShextAutoplay.exe is the 1313th most commonly executed Windows program in EchoTrail's dataset, observed 1,020 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by svchost.exe.
Behavior
Top Paths
- C:\Windows\System32100%
Top Hashes (SHA256)
- 630b97a1a2a1d98d14dfefe754f7a7fc9cde7f6d969a1368803f595e6423959384.27%
- 2f3ac64c8ea56828743602e01e1f12c58140f5e26371721eba26d8ed7264374312.09%
- 76df8561cebd8e531307d69bdee87734557c5cff772fe6b3882424181bf63d6f2.26%
- 15adad168dab8b37a2f984f121ecd5a00ee800f3153b3b0042a99f6307c9171b1.18%
- 1661dfeb7233152aa5c5315c2592479a66fb7d62c7dae1fa268ee89a2e5359e30.1%
- 4318afa741aba6c4f84626c4a7a883efcdf74b90e8f5577535bb1730a300473b0.1%
Process Ancestry
Top Grandparents
- services.exe100%
Top Parents
- svchost.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about WPDShextAutoplay.exe
Rocky answers questions about WPDShextAutoplay.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.