AM_Base_Patch1.exe
Summary
Windows Defender AM Base Patch - Defender antimalware base definition patch.
AM_Base_Patch1.exe is the 1232nd most commonly executed Windows program in EchoTrail's dataset, observed 1,215 times across enterprise environments. It typically runs from C:\Windows\SoftwareDistribution\Download\Install and it is most often launched by wuauclt.exe.
Behavior
Top Paths
- C:\Windows\SoftwareDistribution\Download\Install100%
Top Hashes (SHA256)
- 475039a3891d1afd89f67e5ae4da38f3b79dab980de6981a694c0d94e3ded1b83.43%
- dcaff0ed788ac776ff659e1d4b06acd5eae6488efed637661d632b57194faa8f3.16%
- 018bb30a7bbbfcfb73158d594de945c6869e552155d1cdecc5040cca994e56ef2.55%
- 798fd10874b4b9af403c44b42337c8557f129f88fbe460dd151f036baad341512.55%
- c299909127cbf6120b30b45f24b9908fdb5ed820957f14be12cbbc3881d602c72.55%
- 8e6c698928ebb073df88ca38a49e2ace877ad66f9dba5189b7e002d0c94968aa2.37%
- f8e77a42dbbe513f6975e625e83bef6bc54f942825f7f2de1466d6dd68d916372.37%
- a6a8cdf09fd48112a578c7cefce4da6e830f14f2f4fccbfafda2841c5d9456032.28%
- 321bc971776996ad108a82c14abee11d74996fdb8c1bb02368db0e58713563852.2%
- 629d9e6d29ea6842fed235024a458743363228e9cc271ab97fa5508cf84181e72.2%
Process Ancestry
Top Grandparents
- svchost.exe100%
Top Parents
- wuauclt.exe99.34%
- wuaucltcore.exe0.58%
- Update.exe0.08%
Top Children
- MpSigStub.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about AM_Base_Patch1.exe
Rocky answers questions about AM_Base_Patch1.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.