sav32cli.exe
by Sophos
Endpoint Security
Summary
Sophos Anti-Virus command-line scanner
sav32cli.exe is the 2401st most commonly executed Windows program in EchoTrail's dataset, observed 187 times across enterprise environments. It typically runs from C:\Program Files (x86)\Sophos\Sophos Anti-Virus and it is most often launched by cmd.exe.
2401st
most commonly executed Windows program
187
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Program Files (x86)\Sophos\Sophos Anti-Virus100%
Top Hashes (SHA256)
- 898c86d4dc01573bb7c342bb2ec615896d0d5adb5412523d29290dfad6e40be180.75%
- b743841d96112b1722b9805f68b9614acd5ef5a78caf2291b9f37b5c49e19e5a17.11%
- a93682e05094c6a127c6e27e8f32ad7d8c945eda853c5e5c9ed8989cda3290fc1.6%
- aca614602af040f0b0c16fa85b50f7bac4929883a198b9ec82817e00e86afbc20.53%
Process Ancestry
Top Grandparents
- LTSVC.exe100%
Top Parents
- cmd.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about sav32cli.exe
Rocky answers questions about sav32cli.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.