swi_service.exe
Sources: 300M+ executions observed in the wild.
Summary
Sophos Web Intelligence Service - provides web filtering and URL reputation for Sophos endpoint protection.
swi_service.exe is the 736th most commonly executed Windows program in EchoTrail's dataset, observed 4,683 times across enterprise environments. It typically runs from C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence and it is most often launched by services.exe.
Get this in your tools
The same record for swi_service.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/swi_service.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence100%
Top Hashes (SHA256)
- 1c06f81d5478243e917c2845ec4d87506c23040567be253c12bf103e5628d16970.6%
- 8c252e59d8ecf395807a9e801cf4393c70de25bef9ce80fdf4ce000c94852cff15.66%
- a4fc5ad035fe92377d25763a0c8f561eab3b1e79f6d1186f100539455c53bc279.37%
- 27d89c54c0f674cf880708f7f254f6696e794ffb7d7758253a0a953e8c8b45273.19%
- 759e244e006cc6d52ef67984f9f1efdb2db0b2c19534561f5aa93cc6b636c76b0.92%
- 87cd569b97311b69972a8fc7bd56f54d2e49ae2d3805fe379ff29e7d74da09c90.22%
- 2e0986fff1c1fa90480e5fa930bf43fbb10139c99371049cb9f8b3777e2a69090.04%
Process Ancestry
Top Grandparents
- wininit.exe87.11%
- msiexec.exe12.89%
Top Parents
- services.exe88.13%
- msiexec.exe11.87%
Top Children
- swi_lspdiag.exe49.97%
- swi_lspdiag_64.exe49.96%
- regsvr32.exe<0.01%
- conhost.exe<0.01%
- net1.exe<0.01%
Ask Rocky about swi_service.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for swi_service.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.