swi_filter.exe
Summary
Sophos Web Intelligence Filter - network filter component of Sophos web protection.
swi_filter.exe is the 747th most commonly executed Windows program in EchoTrail's dataset, observed 4,525 times across enterprise environments. It typically runs from C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence and it is most often launched by services.exe.
Behavior
Top Paths
- C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence100%
Top Hashes (SHA256)
- 9c16dcee21ef2b027afd8095780809890dcddd3a9cf723e01a61ceb9f26d8a0969.98%
- 5b37dee85a6a4c1efcc1cdbdfde3366ddef0d40b70105fccba816ae64377f73d16.15%
- 37801b24b87bdfdc878eeb0545de18b727b5d9b24cfe05f88445da07588c2f4c9.73%
- 3c162fa54489a1dede5edcd806e7d97eabc44af7e6e809c33187d2696758de203.14%
- 909f8063ac4addf050a97ac12e52e258eabf085d5a3bbb6bfc0cb5cd3b778c210.95%
- 147a2ecddaa2e22d30173ca32ed76cf7095f5e360ed51785a6e8bc20eb5e4c980.05%
Process Ancestry
Top Grandparents
- wininit.exe86.84%
- msiexec.exe13.16%
Top Parents
- services.exe87.89%
- msiexec.exe12.11%
Top Children
- swi_fc.exe88.43%
- conhost.exe11.41%
- net1.exe0.08%
- regsvr32.exe0.06%
- lpksetup.exe0.02%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about swi_filter.exe
Rocky answers questions about swi_filter.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.