AM_Delta.exe
Summary
Windows Defender AM Delta - Defender antimalware definition delta update artifact.
AM_Delta.exe is the 547th most commonly executed Windows program in EchoTrail's dataset, observed 9,639 times across enterprise environments. It typically runs from C:\Windows\SoftwareDistribution\Download\Install and it is most often launched by wuauclt.exe.
Behavior
Top Paths
- C:\Windows\SoftwareDistribution\Download\Install100%
Top Hashes (SHA256)
- 77f2d4dfc5069238e9bc178c6fb84acee8c4be5a8cd16e413a2a2b7feef634080.24%
- c9fce905a78d79985f6836592f0d23dbbbd67ab2319237996c3fe9e11484a2ef0.24%
- de1273746dc62f7e873a1974bca5d4b39bf90226e7dd989e8f9654f714c1194e0.23%
- 9775468747fc475b0568af6602c99f81e9776204f2daf22c7a55050d56c7c9db0.21%
- 20efc3f98bbf169ff3afedde71e8fda63fd2553db77bd04afe30e7d0ba9aeb8b0.2%
- 3edc44d684728e9d70b3ba79ead5ad92d3641d5cc0f1264d362261cc4242a8a00.18%
- 6d325a18fb19069cb041a5c340eb27781040c6f5ae028904e84a8b3d800ea1cc0.18%
- 6d998ae38d844f849dd81bacf255bf18911e32d4c412440985d305e9a109b0da0.18%
- b1819a967d8da9b6976c4258a2798577478dc6a05bf5545661c20bd3c76a083f0.18%
- e5643fba7a61aae5f53f0a1196d8b875c75f1888c9df73dca01b5f34aa405f8d0.18%
Process Ancestry
Top Grandparents
- svchost.exe100%
Top Parents
- wuauclt.exe99.59%
- wuaucltcore.exe0.4%
Top Children
- MpSigStub.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about AM_Delta.exe
Rocky answers questions about AM_Delta.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.