My VoodooShield is always asking me whether to run C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2009.7-0\MPCMDRUN. I think it is part of Defender. But why would VoodooShield ask, if it is part of Windows, or is it some hacker who wants to do something ? Another one is c:\windows\temp\xxxxxxx\MPSIGSTUB. When I manually update Windows Defender with mpam-fe, this pops up, so I know it is legit. But sometimes it wants to run without me doing anything. What do you guys think?