TelemetryPlugin.exe
Summary
Telemetry Plugin - plugin for telemetry data collection in management suites.
TelemetryPlugin.exe is the 593rd most commonly executed Windows program in EchoTrail's dataset, observed 8,118 times across enterprise environments. It typically runs from C:\Program Files\Sophos\Endpoint Defense and it is most often launched by GatherTelem.exe.
Behavior
Top Paths
- C:\Program Files\Sophos\Endpoint Defense70.69%
- C:\Program Files\Sophos\Sophos System Protection29.31%
Top Hashes (SHA256)
- 450ef4b26f0ad4c4f90ab0c6e0ea8c27f2c65a30286a6aeca6f9732d130e3b3b30.16%
- 0a6202cd5aac3809dcbd62a1c53aa8173fe263d97fd06c0ddbe0ec812d6cd72728.56%
- 07b9723b9ad8d3ba600b3d8dd90ba25b7c054fe63707fb9f7caae53cb4b0a07616.61%
- 8db289ab6bac8c118effed061f43047731ae0fa832bff3a0d5276547e04a98ef8.82%
- a4463fa039bae484ddc6bad084f86da6fa343ce0005b454ec15d51d4c91fc3cd8.67%
- 2a67c886676a6d7534d7da942339198982ad02d42e9c55933a7d884cd518aff25.71%
- 431bf6db409ce518679dc54bddb9d351b5e81e1c07ace7057087d7e092fa573d1.04%
- 6182b85072c116ae70c3a29b318d9dccaf172d2dda48e0ba1a99b76efb318b7a0.25%
- 2e5c4a229b15175609ccd66dafa3a50de9131da8f9ba04c25a81dcd342f565340.2%
Process Ancestry
Top Grandparents
- SophosUpdate.exe99.98%
- ALsvc.exe0.01%
- chrome.exe0.01%
Top Parents
- GatherTelem.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about TelemetryPlugin.exe
Rocky answers questions about TelemetryPlugin.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.