invcol.exe
by Microsoft
Endpoint Management
Sources: 300M+ executions observed in the wild.
Summary
SCCM Inventory Collection - collects inventory data for Configuration Manager reporting.
invcol.exe is the 348th most commonly executed Windows program in EchoTrail's dataset, observed 24,948 times across enterprise environments. It typically runs from C:\Windows\Temp\... and it is most often launched by InvColPC.exe.
Get this in your tools
The same record for invcol.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/invcol.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
348th
most commonly executed Windows program
24,948
observed endpoint executions
Behavior
Top Paths
- C:\Windows\Temp\...98.59%
- C:\Temp\...1.26%
- C:\Users\...0.12%
- C:\Program Files\Dell\SysMgt\cm\invcol0.03%
- C:\Program Files (x86)\Dell\SysMgt\cm\invcol<0.01%
Top Hashes (SHA256)
- 369e0d8f12a9eea73bd11a765e875ce6698e5795527451bf96fa3eb30bdf5fcc13.18%
- c8f0dc63faa34df5da6c3787c051571adc4b18fe5eff7a185cde96c005a266ba12.12%
- f2a3e41be8907579de412793f81937c2e56be644958ba103217cfd09386d51636.51%
- e0cca17859b615dc5c5945add86938a8125346c23050ee8c93b627b36a77fdef6.27%
- 6fdef81f2082321e0907e0f49567d8617ce7735b22cc45302104f54cb9ab7f7d5.25%
- e5bf5afc1092c0571c17066a5879554bbec7f8afc5dc5bdcab5526689b580ccd5.1%
- b8e6bcd3e7b4090817c300841a824f795dd38915059d72bf6547c1b01a385e8d4.7%
- bf191a230144fa4ee4b6a1e6ce11287ea41dadad527d7f38e5f52b04441cd4c54.32%
- 56f1847428c2215a620f9acd8345da9199b71355000c0cb68dac5188314769d54.13%
- d2c400b6e136e40e21b54b87fa3a5b564573010c11269cf67d5b7525f4ccf5cf4.11%
Process Ancestry
Top Grandparents
- ServiceShell.exe90.54%
Top Parents
- InvColPC.exe99.9%
- invcol.exe0.03%
- conhost.exe<0.01%
Top Children
- drvupdate.exe42.08%
- appupdate.exe36.59%
- usbupdate.exe4.01%
- cmd.exe3.52%
- smbiosinfo.exe1.06%
- osinv.exe1.06%
- scsiupdate.exe1.05%
- pnpupdate.exe1.05%
- GetDockVer32W.exe1.05%
Ask Rocky about invcol.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for invcol.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.