swi_lspdiag.exe
Sources: 300M+ executions observed in the wild.
Summary
Sophos Web Intelligence LSP Diagnostic tool. Diagnoses Layered Service Provider configuration for Sophos web filtering.
swi_lspdiag.exe is the 155th most commonly executed Windows program in EchoTrail's dataset, observed 107,441 times across enterprise environments. It typically runs from C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence and it is most often launched by swi_service.exe.
Get this in your tools
The same record for swi_lspdiag.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/swi_lspdiag.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence100%
Top Hashes (SHA256)
- 2c1af689f023b7aa6f0ecc644415e3f414bf80940975b11b3f21164a7614988160.51%
- b8bb7b2f14f9c6ccdd9d96dbc7d6453fcbfce37375e66abaf9bd0f0acd81209f17.41%
- f5742a9125e39deaaa2f0ffdf46440f14bd7e8f33c1c94638d5b8ff54fa8b3af13.48%
- 33e868442eb63d8395a93ed868e1d3b68559974d68a85d0a8105ff743b48cd697.32%
- 0adcdc312e742514b16addcf0c3b26b9b1606bc21447a37d393a980d8f7fd3191.01%
- f45319708abdec276515b5aebf39695ed138303b55af1b96c33d2de2e15d6ce50.26%
- b88d53986e3ef2e08cf2cf7e9a543af0244b407aae767ac15419008d1a4bac5b<0.01%
Process Ancestry
Top Grandparents
- services.exe100%
Top Parents
- swi_service.exe100%
Top Children
- conhost.exe100%
Security Analysis
What does swi_lspdiag.exe normally do?
Part of Sophos software.
When is swi_lspdiag.exe suspicious?
Running from unexpected paths.
How do attackers abuse swi_lspdiag.exe?
Not commonly abused.
Detection guidance
No specific detection needed.
False positive notes
Normal operation.
Ask Rocky about swi_lspdiag.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for swi_lspdiag.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.