SubmitTelem.exe
Summary
Submit Telemetry - sends telemetry data to a management platform.
SubmitTelem.exe is the 579th most commonly executed Windows program in EchoTrail's dataset, observed 8,434 times across enterprise environments. It typically runs from C:\Program Files (x86)\Sophos\AutoUpdate\Telemetry and it is most often launched by GatherTelem.exe.
Behavior
Top Paths
- C:\Program Files (x86)\Sophos\AutoUpdate\Telemetry100%
Top Hashes (SHA256)
- 8bac0eafafceb32ea7ee5b8869ab4c10c3f4e37234f4fa8e56ae9713eaae067b48.38%
- 89bc3813826325c2d9b778b36b96181b429132ea16af382ed00699efb84a3f3d19.56%
- 34f470fc1cbbde80fd062723b8a30b7dc3e8b5665162c23db44616fe852f99fc14.01%
- 95d0ae895fef8129345e7213c5d5047e5adf1b211c30608e88759b35e7dbd6f610.51%
- 6d13b0e8986e028e8033f86ce8a48f5adeed889916b564b5a6da29643ccd2c896.2%
- 53abfd1e3f4aa77ed5bc5464189a0d4c8685794a7e211a92ccf1eaf05e1d30cb1.33%
- 1a8040dec8da60f5f994c6722ca35244ae71792ab31fcd45c7360505a00b1f440.01%
Process Ancestry
Top Grandparents
- SophosUpdate.exe97.29%
- services.exe2.68%
- ALsvc.exe0.01%
- chrome.exe0.01%
Top Parents
- GatherTelem.exe96.13%
- SavService.exe3.87%
Top Children
- conhost.exe99.4%
- explorer.exe0.6%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about SubmitTelem.exe
Rocky answers questions about SubmitTelem.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.