Many Windows 10 users who have upgraded to the Creators Update have been experiencing extremely slow internet because of a process named MpCmdRun.exe hogging their entire internet connection. When users affected by this problem investigate it via Task Manager or by accessing the Network tab of Windows 10’s Resource Monitor, they see MpCmdRun.exe maxing out their upload (yes, upload!) bandwidth. A process hogging the entirety of your internet connection to upload data from your computer to somewhere else is not only annoying but is also a little concerning, especially to any Windows 10 user who values their privacy.
MpCmdRun.exe is a process associated with Windows Defender, so it uploading data might make sense in some cases. However, malicious programs and invaders are also known to disguise themselves as MpCmdRun.exe in order to mask their harmful activities and make them seem legitimate. If the MpCmdRun.exe process that is hogging your internet connection is the legitimate process associated with Windows Defender, it will eventually be done uploading data. However, if there doesn’t seem to be any end to the process’s ongoing data upload, it would be in your best interest to determine whether the process is the real deal or a malicious invader.
The legitimate MpCmdRun.exe process can be found in X:\Program Files\Windows Defender (X being the drive letter corresponding to the partition of your computer’s hard drive that Windows is installed on) in file form, whereas a malicious element disguising itself as the MpCmdRun.exe process would be located in some other directory. To determine whether the MpCmdRun.exe process that is killing your internet connection is a legitimate Windows Defender process or something potentially harmful, all you need to do is find out what directory it is located in on your computer. To do so, simply:
1. Press the Windows Logo key + X to open the WinX Menu.
2. Click on Task Manager to launch it.
3. Navigate to the Processes tab.
4. Scroll down through the list of processes, locate MpCmdRun.exe, and right-click on it.
5. Click on Open file location in the context menu.
When the location of the file opens in Windows Explorer, see what the location is. If the MpCmdRun.exe process in file form is located in X:\Program Files\Windows Defender (X being the letter corresponding to the partition of your computer’s hard drive that Windows is installed on), then the process is the legitimate process associated with Windows Defender. However, if the file is located in some other directory, there is a pretty good chance that it is a malicious invader probably means to cause harm to your computer. If that is the case, run antivirus and anti-malware programs as well as other anti-intruder programs to get to the bottom of the intrusion and eliminate it.