swi_lspdiag_64.exe
Summary
Sophos Web Intelligence LSP Diagnostic tool (64-bit). 64-bit version of the Sophos LSP diagnostic tool.
swi_lspdiag_64.exe is the 156th most commonly executed Windows program in EchoTrail's dataset, observed 107,425 times across enterprise environments. It typically runs from C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence and it is most often launched by swi_service.exe.
Behavior
Top Paths
- C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence100%
Top Hashes (SHA256)
- 722ddacc5cb32c725d84d9e2764b28a47acdfef50de80abdc08e7dd0f26e72af60.51%
- d06d59dc8ed66f890571a87902b6a3c37af5f8f14918ccbe75634e7e1bab26b017.42%
- 79a321b8913fe6c80414739651800c29e34a0b1e93ac4602e828a3e4758b2e1813.48%
- e9ae3818cf586f4bac58dd0c0ea186de9f70d777f4380e87e6bff0643aa5c7917.32%
- 358fa17ba6ca975ec417f612741d26e2201ad544a301f7891b64badadcbf29e81.01%
- 6a6d39e04e4ab31eb37a962030553435f28de9877660b099a1919f11d7533e4c0.26%
- 03c58cf6a2568d703ad0b7d2997fc484a5c9dfdf9c17d4f0d491830a180b19fa<0.01%
Process Ancestry
Top Grandparents
- services.exe100%
Top Parents
- swi_service.exe100%
Top Children
- conhost.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does swi_lspdiag_64.exe normally do?
Part of Sophos software.
When is swi_lspdiag_64.exe suspicious?
Running from unexpected paths.
How do attackers abuse swi_lspdiag_64.exe?
Not commonly abused.
Detection guidance
No specific detection needed.
False positive notes
Normal operation.
Ask Rocky about swi_lspdiag_64.exe
Rocky answers questions about swi_lspdiag_64.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.