diagtrackrunner.exe
Summary
Windows Connected User Experiences and Telemetry runner - executes telemetry collection tasks for Windows diagnostics.
diagtrackrunner.exe is the 667th most commonly executed Windows program in EchoTrail's dataset, observed 6,203 times across enterprise environments. It typically runs from C:\Windows\System32\CompatTel and it is most often launched by svchost.exe.
Behavior
Top Paths
- C:\Windows\System32\CompatTel100%
Top Hashes (SHA256)
- 67e045fd25809e8ca486b1d17eb33667835fbc04974dd65dc07fcfc7e9a3d254100%
Process Ancestry
Top Grandparents
- services.exe73.94%
- wininit.exe26.06%
Top Parents
- svchost.exe83.15%
- services.exe16.81%
Top Children
- conhost.exe99.84%
- WerFault.exe0.16%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about diagtrackrunner.exe
Rocky answers questions about diagtrackrunner.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.