AUTelem.exe
by Various
Application Support
Summary
Automatic Telemetry - automated telemetry collection agent.
AUTelem.exe is the 591st most commonly executed Windows program in EchoTrail's dataset, observed 8,150 times across enterprise environments. It typically runs from C:\Program Files (x86)\Sophos\AutoUpdate\Telemetry and it is most often launched by GatherTelem.exe.
591st
most commonly executed Windows program
8,150
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Program Files (x86)\Sophos\AutoUpdate\Telemetry100%
Top Hashes (SHA256)
- bc14a0be643a9c86bf464efb42b510522feabc740087a270e3886278c737fd0a49.88%
- f3bab6b5258cdca73d289fe10a8841036e4578a27ff7ab64cb5c2962837c200d20.2%
- cf71b74733856e78ab9aa25b336563ba785b39cdc307043aa95ac9eb5eb08f3912.97%
- 11a69cc12c72ed72522b594a5c9265c5af1874a6b003c7b0ce196bd874f250cc9.99%
- 707e1faf84902d1a4a143c83fedbcf6ab22fa0f2bf24430280fb1c18ed3d82fc5.58%
- 102bbdc3e6ae9f22f169c282a6946d241b6d5a38186ca54c73ac65fcce614ad41.37%
- a4dad6a91519b1fe02f663f6b37ca8f0a06229480ed9e23dd648144009cc071a0.01%
Process Ancestry
Top Grandparents
- SophosUpdate.exe99.98%
- ALsvc.exe0.01%
- svchost.exe0.01%
Top Parents
- GatherTelem.exe99.99%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about AUTelem.exe
Rocky answers questions about AUTelem.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.