swi_di.exe

by Sophos

Endpoint Security

Summary

Sophos Web Intelligence Download Interceptor - intercepts and scans file downloads for Sophos web protection.

swi_di.exe is the 1277th most commonly executed Windows program in EchoTrail's dataset, observed 1,107 times across enterprise environments. It typically runs from C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence and it is most often launched by msiexec.exe.

1277th

most commonly executed Windows program

1,107

observed executions

low

statistical confidence

Behavior

Top Paths

C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence100%

Top Hashes (SHA256)

ca85cc98b108a8396dfeb67b30517325afa325b4106d99dab41eb6827fc6b37d56.42%
52879344746dfd11453997ebecc52dd9b633eba5a671407f8442a8af6d36afae26.59%
0152c4b757221971cfc8df184e12a2fbba64b386a58a1eac744319b45d1be9637.66%
34906606fb7e1030bb39976540c3e34fdff617e748c03e8ebb6b55bd1570e2717.2%
5e3fcce49f315d95c1cb51705ee85e893ef339a5bc86edba280e8dd47b59f5d01.85%
8b8ba97ec881af7ccab5e2959fdb9f6fb86d9f6df8efb6957ab5d91675a605820.28%

Process Ancestry

Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.

Ask Rocky about swi_di.exe

Rocky answers questions about swi_di.exe grounded in this same dataset — free, no account needed.

Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.

Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.