SophosNA.exe
by Sophos
Endpoint Security
Summary
Sophos Network Agent - network monitoring component of Sophos endpoint protection.
SophosNA.exe is the 1023rd most commonly executed Windows program in EchoTrail's dataset, observed 1,935 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by smss.exe.
1023rd
most commonly executed Windows program
1,935
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Windows\System32100%
Top Hashes (SHA256)
- 397694b697716b62e30da01b5f1039ace7a6aa93c19233e57ae836c876e9ddf658.37%
- e77111a8a5bae3592ea7cf3f123fd8b439570048cba48e99da9bc87f0891a98435.51%
- e9555803e43af8bc506dedaefed023659cdbd5d7042db5979cd8725b917280ce3.4%
- dc5624cded8ed064112c5d5d157e0fd956b046c7507bc7803ba83caf3e09c4180.99%
- 4816763bb893c77e41eadef5675530f967173b853e214a806e58786894fd7e140.89%
- 89ab2062df98f54f499301e1b85537d13de6790c20db4700b03b3aa4476c3fcb0.58%
- 61b6bc9cf63e2360c3e18fe26cb5122613e5045d18f369a9b8aef7eef174d02e0.21%
- 3aba694f3a89b4efc37a56fc5bed249d268612bd12cf26224494227b19c4900d0.05%
Process Ancestry
Top Parents
- smss.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about SophosNA.exe
Rocky answers questions about SophosNA.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.