swi_di.exe

by Sophos

Endpoint Security

Sources: 300M+ executions observed in the wild.

Summary

Sophos Web Intelligence Download Interceptor - intercepts and scans file downloads for Sophos web protection.

swi_di.exe is the 1277th most commonly executed Windows program in EchoTrail's dataset, observed 1,107 times across enterprise environments. It typically runs from C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence and it is most often launched by msiexec.exe.

Get this in your tools

The same record for swi_di.exe, by REST or as an MCP tool. Free key, no card.

Get a free key

curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
  https://api.echotrail.io/v1/process/swi_di.exe

Free returns the summary. Team returns the full record you see on this page. Endpoint docs

1277th

most commonly executed Windows program

1,107

observed endpoint executions

Behavior

Top Paths

C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence100%

Top Hashes (SHA256)

ca85cc98b108a8396dfeb67b30517325afa325b4106d99dab41eb6827fc6b37d56.42%
52879344746dfd11453997ebecc52dd9b633eba5a671407f8442a8af6d36afae26.59%
0152c4b757221971cfc8df184e12a2fbba64b386a58a1eac744319b45d1be9637.66%
34906606fb7e1030bb39976540c3e34fdff617e748c03e8ebb6b55bd1570e2717.2%
5e3fcce49f315d95c1cb51705ee85e893ef339a5bc86edba280e8dd47b59f5d01.85%
8b8ba97ec881af7ccab5e2959fdb9f6fb86d9f6df8efb6957ab5d91675a605820.28%

Process Ancestry

Ask Rocky about swi_di.exe

Rocky is the free chat demo. It answers from this same dataset, no account needed.

This page is the Team-tier API record for swi_di.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.