AM_Base.exe
by Microsoft
Endpoint Security
Summary
Windows Defender Antimalware base update
AM_Base.exe is the 2182nd most commonly executed Windows program in EchoTrail's dataset, observed 250 times across enterprise environments. It typically runs from C:\Windows\SoftwareDistribution\Download\Install and it is most often launched by wuauclt.exe.
2182nd
most commonly executed Windows program
250
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Windows\SoftwareDistribution\Download\Install100%
Top Hashes (SHA256)
- c4d371a7a9490ff612b484475b45672e3c1c3f30c80bf8ee4a2b588f312fb2f713.41%
- ae0302481bfcc010d7aa99dc6234dcf00879900504116739cb103b0ef0b265a110.98%
- 4cd6e21356898378e9fc6151729bbdcd9ace005be280d00c42a4004f0174de7c4.88%
- 2b8dea30d0bbdd93e3808f88318641363921fa2b792e4c9494dd09af94c1a2294.47%
- 000bd5f02aab0bde8eed4b79f12fe9aef1d8263fb92df43294fc7ef4100fbdf84.07%
- 386825c22b951af980d0776b8a5f7746a10e66885724fbad12c0d814857281c84.07%
- 823980c250e90a7b210ff48958457f3ccdb4be092ca66a498e768ede2ee1bc2e4.07%
- 5fe542beb1ae1d526db6ba292743341ce1ea80467d69381674c100264260b1443.25%
- cafb0f5b47db564adf0edb96c9030c5d4eceb39cf0719ea6937971a5d56dac543.25%
- 8f6c72870061ff8e2fc246cb870e827c17c3051c186000daffd8f2d6d7edaae22.85%
Process Ancestry
Top Grandparents
- svchost.exe100%
Top Parents
- wuauclt.exe99.6%
- wuaucltcore.exe0.4%
Top Children
- MpSigStub.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about AM_Base.exe
Rocky answers questions about AM_Base.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.