swi_service.exe
Summary
Sophos Web Intelligence Service - provides web filtering and URL reputation for Sophos endpoint protection.
swi_service.exe is the 736th most commonly executed Windows program in EchoTrail's dataset, observed 4,683 times across enterprise environments. It typically runs from C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence and it is most often launched by services.exe.
Behavior
Top Paths
- C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence100%
Top Hashes (SHA256)
- 1c06f81d5478243e917c2845ec4d87506c23040567be253c12bf103e5628d16970.6%
- 8c252e59d8ecf395807a9e801cf4393c70de25bef9ce80fdf4ce000c94852cff15.66%
- a4fc5ad035fe92377d25763a0c8f561eab3b1e79f6d1186f100539455c53bc279.37%
- 27d89c54c0f674cf880708f7f254f6696e794ffb7d7758253a0a953e8c8b45273.19%
- 759e244e006cc6d52ef67984f9f1efdb2db0b2c19534561f5aa93cc6b636c76b0.92%
- 87cd569b97311b69972a8fc7bd56f54d2e49ae2d3805fe379ff29e7d74da09c90.22%
- 2e0986fff1c1fa90480e5fa930bf43fbb10139c99371049cb9f8b3777e2a69090.04%
Process Ancestry
Top Grandparents
- wininit.exe87.11%
- msiexec.exe12.89%
Top Parents
- services.exe88.13%
- msiexec.exe11.87%
Top Children
- swi_lspdiag.exe49.97%
- swi_lspdiag_64.exe49.96%
- regsvr32.exe<0.01%
- conhost.exe<0.01%
- net1.exe<0.01%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about swi_service.exe
Rocky answers questions about swi_service.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.