EfwTelemetryPlugin.exe
by Various
Endpoint Security
Summary
EFW Telemetry Plugin - endpoint firewall telemetry plugin.
EfwTelemetryPlugin.exe is the 710th most commonly executed Windows program in EchoTrail's dataset, observed 5,195 times across enterprise environments. It typically runs from C:\Program Files\Sophos\Endpoint Firewall and it is most often launched by GatherTelem.exe.
710th
most commonly executed Windows program
5,195
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Program Files\Sophos\Endpoint Firewall100%
Top Hashes (SHA256)
- 77c1d39d208bf89791b0dcf3c1b6f5b24a1c115eb73264c9cf2f38d7fa8ce21c53.08%
- 535ab2499eba1734e9fa369bbb055158cf88b562bebb798942cb837055172e3246.92%
Process Ancestry
Top Grandparents
- SophosUpdate.exe99.98%
- chrome.exe0.02%
Top Parents
- GatherTelem.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about EfwTelemetryPlugin.exe
Rocky answers questions about EfwTelemetryPlugin.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.