SntpService.exe
Summary
SNTP Service - Simple Network Time Protocol time synchronization service.
SntpService.exe is the 846th most commonly executed Windows program in EchoTrail's dataset, observed 3,408 times across enterprise environments. It typically runs from C:\Program Files\Sophos\Sophos Network Threat Protection and it is most often launched by services.exe.
Behavior
Top Paths
- C:\Program Files\Sophos\Sophos Network Threat Protection83.54%
- C:\Program Files\Sophos\Sophos Network Threat Protection\bin16.46%
Top Hashes (SHA256)
- d0cd8a8adc3e2ba68ea319158e01adf856098a407546c0b532ea413570594e4955.66%
- 72a830b62fa3e391ddd2246a55552924f96130bdaaa16ed7715b10c0eda9c4fc21.75%
- f7cbf29c7bc39837dee92d665115c06154d01a21cab4362080146fac7d15af429.94%
- 01a1e4c418148d46b583947702252d295de17796fec03bc24261e3c658fc3c3c6.75%
- cfd14674a0bbbbb4ad36a4bbcbd1187577cb3fee0de2121923c3a9cc557bfda85.6%
- 5809708476cd9fe620809ac1ff5b783176330a5e48a801cad388f413515caadc0.3%
Process Ancestry
Top Grandparents
- wininit.exe100%
Top Parents
- services.exe100%
Top Children
- conhost.exe30.77%
- net1.exe23.08%
- regsvr32.exe15.38%
- cacls.exe7.69%
- csrss.exe7.69%
- pcaui.exe7.69%
- winlogon.exe7.69%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about SntpService.exe
Rocky answers questions about SntpService.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.