SAVAdminService.exe
Summary
Sophos Anti-Virus Admin Service - administrative control service for Sophos endpoint protection.
SAVAdminService.exe is the 779th most commonly executed Windows program in EchoTrail's dataset, observed 4,148 times across enterprise environments. It typically runs from C:\Program Files (x86)\Sophos\Sophos Anti-Virus and it is most often launched by services.exe.
Behavior
Top Paths
- C:\Program Files (x86)\Sophos\Sophos Anti-Virus100%
Top Hashes (SHA256)
- a90c37a31c39947dff5403b36bfd8784c59023ad20718fac9fe3ca50af26775849.52%
- c7d03bb1d0c71fc70049e6fd1e3cb763559599452fd1de5a6b8926b25767af6219.69%
- 0f5e022cf682dc7a1234c93bc88069c72aee7696eb6911840f394d7bb2079a7914.66%
- 2932b7c7993531692c3814c3ed4ca4bfb1fbcc6262ba59ad1f8c13e8b161cb154.81%
- 2659926f6e8233e11421aa016d5ca03210af917135c3a04c90ac5b1b538e87664.47%
- 1c345d565a7f12e7ac582bbf694cf2b568d5a9de15c04b96942016fd5636aec42.86%
- 47356b3b72d935b2f11be9f8208bdb433930230d2cf9e0df6b40cbbb82d7583b2.79%
- 23755ee8f85521cd3a7dc55d017cf86e7a236b0b67e2d812afc5e4c7f427aef70.79%
- 70e14ebd1019167349f48ae495a4c51a33a84c800b2d67115720ddde3d66d2f70.25%
- d1712bc34d51795e3b2adc0dbeb45a8e2f36818744088f298c5a29bbeaccec380.12%
Process Ancestry
Top Grandparents
- wininit.exe100%
Top Parents
- services.exe100%
Top Children
- WSCClient.exe99.97%
- regsvr32.exe0.02%
- conhost.exe<0.01%
- net1.exe<0.01%
- explorer.exe<0.01%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about SAVAdminService.exe
Rocky answers questions about SAVAdminService.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.