SavService.exe

by Sophos

Endpoint Security

Summary

Sophos Anti-Virus Service - core antivirus scanning service for Sophos endpoint protection.

SavService.exe is the 781st most commonly executed Windows program in EchoTrail's dataset, observed 4,125 times across enterprise environments. It typically runs from C:\Program Files (x86)\Sophos\Sophos Anti-Virus and it is most often launched by services.exe.

781st

most commonly executed Windows program

4,125

observed executions

low

statistical confidence

Behavior

Top Paths

C:\Program Files (x86)\Sophos\Sophos Anti-Virus100%

Top Hashes (SHA256)

c92fd7d99c172fcb9bff75f66ade9545a3acf83994bc3c5ba425076e8680599349.12%
84a053ac3c0de234dccfdece88452524837aed50282ca1fc0f27ac4d48e9c69719.72%
6749737d7ac821bbdcf0a0a30946578c2aad6a61d40605647bf5d96c0772f3e715.01%
2912e9fd336ae5359c95408d83517b85f9739897b2fcb14191ffb29f72be21034.76%
fb203034fbf92c275fba2e3f94bd3323630c919506376138be3753d8afada2404.34%
2eaa72c6ad12e6dc4da352188320729979deb6f81b9c18d4d307422f549ab93b2.9%
3cc711782c02093c4de684872056ecec52411de56d5ff7c913ecae7a7b6fab202.9%
69705d59d9835cd4b81057350fedcd6d89283b9fc38035ae40977e5aa637131d0.79%
738740db028b9a9838466714914a844af72a669bae1243123780f2c2fcd132cc0.25%
a3624e712ec0181903b7431f9ee2b138df5a1270b60a5d54154bd6de99c059ea0.12%

Process Ancestry

Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.

Ask Rocky about SavService.exe

Rocky answers questions about SavService.exe grounded in this same dataset — free, no account needed.

Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.

Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.