Safestore64.exe
Summary
Sophos SafeStore (64-bit) - manages quarantined files for Sophos endpoint protection.
Safestore64.exe is the 860th most commonly executed Windows program in EchoTrail's dataset, observed 3,226 times across enterprise environments. It typically runs from C:\Program Files\Sophos\Safestore and it is most often launched by services.exe.
Behavior
Top Paths
- C:\Program Files\Sophos\Safestore100%
Top Hashes (SHA256)
- 7d297fb97d9309922c9acb77bebb78805d79338c3da73878477b6721b1c0f06b62.3%
- 6fa2feccfb950b4f6bf75bdf95018a6cafee5a65c7c24fa847cd3daed55e997230.52%
- b6d2898d4a7fd0524a148cf58bdc18cce681a37872ec99e487092c7d58088a0b7.19%
Process Ancestry
Top Grandparents
- wininit.exe97.59%
- SophosUpdate.exe2.31%
- Uninstall.exe0.07%
Top Parents
- services.exe97.74%
- Clean.exe2.26%
Top Children
- regsvr32.exe50%
- conhost.exe33.33%
- net1.exe16.67%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about Safestore64.exe
Rocky answers questions about Safestore64.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.