Versions

6.2.8250.0 (winmain_win8beta.120217-1520)	0.37%
6.2.8102.0 (winmain_win8m3.110823-1455)	0.74%
4.3.9600.16384 (winblue_rtm.130821-1623)	13.01%
4.3.9600.16384 (winblue_rtm.130821-1623)	0.74%
4.3.9431.0 (winmain_bluemp.130615-1214)	1.86%
4.3.9431.0 (winmain_bluemp.130615-1214)	0.37%
4.0.9200.16384 (win8_rtm.120725-1247)	18.22%
4.0.9200.16384 (win8_rtm.120725-1247)	62.83%
4.0.8400.0 (winmain_win8rc.120518-1423)	1.12%
4.0.8400.0 (winmain_win8rc.120518-1423)	0.74%

This is a Windows system installed file with Windows File Protection (WFP) enabled.

There are 10 versions of msmpeng.exe in the wild, the latest version being 6.2.8250.0 (winmain_win8beta.120217-1520). It is started as a Windows Service called 'Servizio Windows Defender' with the name 'WinDefend' and described as “Contribuisce a proteggere gli utenti da malware e altro software potenzialmente indesiderato”. . In addition, it is run under the context of the SYSTEM account with extensive privileges (the administrator accounts have the same privileges). The average file size is about 17.28 KB. The file is a digitally signed and issued to Microsoft Corporation by Microsoft Corporation. During the process's lifecycle, the typical CPU resource utilization is about 0.0054% including both foreground and background operations, the average private memory consumption is about 77.82 MB with the maximum memory reaching around 112.08 MB. Addionally, typically read and write I/O disk operations is about 2.68 MB per minute for reads and 266.45 KB per minute for writes.

MsMpEng.exe is the back-end of Microsoft Security Essentials. It is important to remember that this process is actually used by both Windows Defender and MSE. When you install Microsoft Security Essentials, then Windows Defender is automatically turned off and Microsoft Security Essentials uses this process. This is the main process that runs the program and takes quite some system memory. If you end this process then Microsoft Security Essentials will be disabled and an alert will be shown aski