swi_lspdiag.exe
Summary
Sophos Web Intelligence LSP Diagnostic tool. Diagnoses Layered Service Provider configuration for Sophos web filtering.
swi_lspdiag.exe is the 155th most commonly executed Windows program in EchoTrail's dataset, observed 107,441 times across enterprise environments. It typically runs from C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence and it is most often launched by swi_service.exe.
Behavior
Top Paths
- C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence100%
Top Hashes (SHA256)
- 2c1af689f023b7aa6f0ecc644415e3f414bf80940975b11b3f21164a7614988160.51%
- b8bb7b2f14f9c6ccdd9d96dbc7d6453fcbfce37375e66abaf9bd0f0acd81209f17.41%
- f5742a9125e39deaaa2f0ffdf46440f14bd7e8f33c1c94638d5b8ff54fa8b3af13.48%
- 33e868442eb63d8395a93ed868e1d3b68559974d68a85d0a8105ff743b48cd697.32%
- 0adcdc312e742514b16addcf0c3b26b9b1606bc21447a37d393a980d8f7fd3191.01%
- f45319708abdec276515b5aebf39695ed138303b55af1b96c33d2de2e15d6ce50.26%
- b88d53986e3ef2e08cf2cf7e9a543af0244b407aae767ac15419008d1a4bac5b<0.01%
Process Ancestry
Top Grandparents
- services.exe100%
Top Parents
- swi_service.exe100%
Top Children
- conhost.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does swi_lspdiag.exe normally do?
Part of Sophos software.
When is swi_lspdiag.exe suspicious?
Running from unexpected paths.
How do attackers abuse swi_lspdiag.exe?
Not commonly abused.
Detection guidance
No specific detection needed.
False positive notes
Normal operation.
Ask Rocky about swi_lspdiag.exe
Rocky answers questions about swi_lspdiag.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.