invcol.exe
by Microsoft
Endpoint Management
Summary
SCCM Inventory Collection - collects inventory data for Configuration Manager reporting.
invcol.exe is the 348th most commonly executed Windows program in EchoTrail's dataset, observed 24,948 times across enterprise environments. It typically runs from C:\Windows\Temp\... and it is most often launched by InvColPC.exe.
348th
most commonly executed Windows program
24,948
observed executions
medium
statistical confidence
Behavior
Top Paths
- C:\Windows\Temp\...98.59%
- C:\Temp\...1.26%
- C:\Users\...0.12%
- C:\Program Files\Dell\SysMgt\cm\invcol0.03%
- C:\Program Files (x86)\Dell\SysMgt\cm\invcol<0.01%
Top Hashes (SHA256)
- 369e0d8f12a9eea73bd11a765e875ce6698e5795527451bf96fa3eb30bdf5fcc13.18%
- c8f0dc63faa34df5da6c3787c051571adc4b18fe5eff7a185cde96c005a266ba12.12%
- f2a3e41be8907579de412793f81937c2e56be644958ba103217cfd09386d51636.51%
- e0cca17859b615dc5c5945add86938a8125346c23050ee8c93b627b36a77fdef6.27%
- 6fdef81f2082321e0907e0f49567d8617ce7735b22cc45302104f54cb9ab7f7d5.25%
- e5bf5afc1092c0571c17066a5879554bbec7f8afc5dc5bdcab5526689b580ccd5.1%
- b8e6bcd3e7b4090817c300841a824f795dd38915059d72bf6547c1b01a385e8d4.7%
- bf191a230144fa4ee4b6a1e6ce11287ea41dadad527d7f38e5f52b04441cd4c54.32%
- 56f1847428c2215a620f9acd8345da9199b71355000c0cb68dac5188314769d54.13%
- d2c400b6e136e40e21b54b87fa3a5b564573010c11269cf67d5b7525f4ccf5cf4.11%
Process Ancestry
Top Grandparents
- ServiceShell.exe90.54%
Top Parents
- InvColPC.exe99.9%
- invcol.exe0.03%
- conhost.exe<0.01%
Top Children
- drvupdate.exe42.08%
- appupdate.exe36.59%
- usbupdate.exe4.01%
- cmd.exe3.52%
- smbiosinfo.exe1.06%
- osinv.exe1.06%
- scsiupdate.exe1.05%
- pnpupdate.exe1.05%
- GetDockVer32W.exe1.05%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about invcol.exe
Rocky answers questions about invcol.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.