AM_Base.exe
by Microsoft
Endpoint Security
Sources: 300M+ executions observed in the wild.
Summary
Windows Defender Antimalware base update
AM_Base.exe is the 2182nd most commonly executed Windows program in EchoTrail's dataset, observed 250 times across enterprise environments. It typically runs from C:\Windows\SoftwareDistribution\Download\Install and it is most often launched by wuauclt.exe.
Get this in your tools
The same record for am_base.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/am_base.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
2182nd
most commonly executed Windows program
250
observed endpoint executions
Behavior
Top Paths
- C:\Windows\SoftwareDistribution\Download\Install100%
Top Hashes (SHA256)
- c4d371a7a9490ff612b484475b45672e3c1c3f30c80bf8ee4a2b588f312fb2f713.41%
- ae0302481bfcc010d7aa99dc6234dcf00879900504116739cb103b0ef0b265a110.98%
- 4cd6e21356898378e9fc6151729bbdcd9ace005be280d00c42a4004f0174de7c4.88%
- 2b8dea30d0bbdd93e3808f88318641363921fa2b792e4c9494dd09af94c1a2294.47%
- 000bd5f02aab0bde8eed4b79f12fe9aef1d8263fb92df43294fc7ef4100fbdf84.07%
- 386825c22b951af980d0776b8a5f7746a10e66885724fbad12c0d814857281c84.07%
- 823980c250e90a7b210ff48958457f3ccdb4be092ca66a498e768ede2ee1bc2e4.07%
- 5fe542beb1ae1d526db6ba292743341ce1ea80467d69381674c100264260b1443.25%
- cafb0f5b47db564adf0edb96c9030c5d4eceb39cf0719ea6937971a5d56dac543.25%
- 8f6c72870061ff8e2fc246cb870e827c17c3051c186000daffd8f2d6d7edaae22.85%
Process Ancestry
Top Grandparents
- svchost.exe100%
Top Parents
- wuauclt.exe99.6%
- wuaucltcore.exe0.4%
Top Children
- MpSigStub.exe100%
Ask Rocky about AM_Base.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for AM_Base.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.