GatherTelem.exe
Summary
Gather Telemetry - collects system telemetry for management platforms.
GatherTelem.exe is the 589th most commonly executed Windows program in EchoTrail's dataset, observed 8,154 times across enterprise environments. It typically runs from C:\Program Files (x86)\Sophos\AutoUpdate\Telemetry and it is most often launched by SophosUpdate.exe.
Behavior
Top Paths
- C:\Program Files (x86)\Sophos\AutoUpdate\Telemetry100%
Top Hashes (SHA256)
- ecff82dbe902510273a8faaca7da45efa110827447e884c8f7e4b335581ac0c149.85%
- 3ef3e9ba7a6cbf2a02544eed0addb75a85813e0f02162bbb4ba089242a4bdf7b20.2%
- ff05b9c8d337652e44300b4ec46623f7536ebf949d36ff3dbe702227e2bfefff12.98%
- cc2cf205f9bc9344ecef45592a99a5d315db9139b0783f69829d51ab008fee699.98%
- a9bcedbb2475c9903c53c72824c248f114b49e4034087532cd4c36a02305f1da5.58%
- 2d8d52aebadd1a66aa4f2e1e62fe44cdbf680cf859b4a9798b57ad002d24155b1.37%
- fe4fefbec8a61508c667f66a4a2ebe29f8f727d48a93fa96d72b5f33545c49440.04%
Process Ancestry
Top Grandparents
- ALsvc.exe99.95%
- services.exe0.04%
- chrome.exe0.01%
Top Parents
- SophosUpdate.exe99.95%
- ALsvc.exe0.04%
- chrome.exe0.01%
Top Children
- Telemetry.exe35.29%
- AUTelem.exe8.7%
- TelemetryPlugin.exe8.67%
- SubmitTelem.exe8.66%
- conhost.exe8.62%
- HealthClient.exe7.98%
- SAVTelem.exe7.8%
- EXPTelem.exe6.11%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about GatherTelem.exe
Rocky answers questions about GatherTelem.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.