"most of the time" it is the Windows Update Automatic Update CLienT
executable, a genuine windows file
there is a chance that some version of malware will chose that name for its
cloaking, but if the file is the right size location crc for your os
version it is not likely to be malware