HealthClient.exe
by Various
Endpoint Management
Summary
Health Client - endpoint health monitoring and reporting client.
HealthClient.exe is the 613th most commonly executed Windows program in EchoTrail's dataset, observed 7,473 times across enterprise environments. It typically runs from C:\Program Files (x86)\Sophos\Health and it is most often launched by GatherTelem.exe.
613th
most commonly executed Windows program
7,473
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Program Files (x86)\Sophos\Health100%
Top Hashes (SHA256)
- 07091908ea6b03b7ce0fce359d36e8e198334c890aff34bdd751b2c09517664b59.87%
- 1b5f7807d3819d30dbc40d3eba7359c828d423da289d04a575803ed72c980c5e23.22%
- 8a37d0f49d9d75da2174cd05eefce1d5c9a4b94cd1f9f94b90bdf63247297d4e9.66%
- 0ab5ab2738a0a5602c945524768b127633e529d1136cef845a6e32cc282d5ee76.08%
- 77d1980320a0add97be4e5a9160a2d378f608c589ddf417878cec46c5f334b8a1.17%
Process Ancestry
Top Grandparents
- SophosUpdate.exe99.97%
- ALsvc.exe0.01%
- chrome.exe0.01%
Top Parents
- GatherTelem.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about HealthClient.exe
Rocky answers questions about HealthClient.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.