AM_Base_Patch1.exe
Sources: 300M+ executions observed in the wild.
Summary
Windows Defender AM Base Patch - Defender antimalware base definition patch.
AM_Base_Patch1.exe is the 1232nd most commonly executed Windows program in EchoTrail's dataset, observed 1,215 times across enterprise environments. It typically runs from C:\Windows\SoftwareDistribution\Download\Install and it is most often launched by wuauclt.exe.
Get this in your tools
The same record for am_base_patch1.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/am_base_patch1.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Windows\SoftwareDistribution\Download\Install100%
Top Hashes (SHA256)
- 475039a3891d1afd89f67e5ae4da38f3b79dab980de6981a694c0d94e3ded1b83.43%
- dcaff0ed788ac776ff659e1d4b06acd5eae6488efed637661d632b57194faa8f3.16%
- 018bb30a7bbbfcfb73158d594de945c6869e552155d1cdecc5040cca994e56ef2.55%
- 798fd10874b4b9af403c44b42337c8557f129f88fbe460dd151f036baad341512.55%
- c299909127cbf6120b30b45f24b9908fdb5ed820957f14be12cbbc3881d602c72.55%
- 8e6c698928ebb073df88ca38a49e2ace877ad66f9dba5189b7e002d0c94968aa2.37%
- f8e77a42dbbe513f6975e625e83bef6bc54f942825f7f2de1466d6dd68d916372.37%
- a6a8cdf09fd48112a578c7cefce4da6e830f14f2f4fccbfafda2841c5d9456032.28%
- 321bc971776996ad108a82c14abee11d74996fdb8c1bb02368db0e58713563852.2%
- 629d9e6d29ea6842fed235024a458743363228e9cc271ab97fa5508cf84181e72.2%
Process Ancestry
Top Grandparents
- svchost.exe100%
Top Parents
- wuauclt.exe99.34%
- wuaucltcore.exe0.58%
- Update.exe0.08%
Top Children
- MpSigStub.exe100%
Ask Rocky about AM_Base_Patch1.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for AM_Base_Patch1.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.