swi_lspdiag_64.exe

by Sophos

Endpoint Security

Sources: 300M+ executions observed in the wild.

Summary

Sophos Web Intelligence LSP Diagnostic tool (64-bit). 64-bit version of the Sophos LSP diagnostic tool.

swi_lspdiag_64.exe is the 156th most commonly executed Windows program in EchoTrail's dataset, observed 107,425 times across enterprise environments. It typically runs from C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence and it is most often launched by swi_service.exe.

Get this in your tools

The same record for swi_lspdiag_64.exe, by REST or as an MCP tool. Free key, no card.

Get a free key

curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
  https://api.echotrail.io/v1/process/swi_lspdiag_64.exe

Free returns the summary. Team returns the full record you see on this page. Endpoint docs

156th

most commonly executed Windows program

107,425

observed endpoint executions

Behavior

Top Paths

C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence100%

Top Hashes (SHA256)

722ddacc5cb32c725d84d9e2764b28a47acdfef50de80abdc08e7dd0f26e72af60.51%
d06d59dc8ed66f890571a87902b6a3c37af5f8f14918ccbe75634e7e1bab26b017.42%
79a321b8913fe6c80414739651800c29e34a0b1e93ac4602e828a3e4758b2e1813.48%
e9ae3818cf586f4bac58dd0c0ea186de9f70d777f4380e87e6bff0643aa5c7917.32%
358fa17ba6ca975ec417f612741d26e2201ad544a301f7891b64badadcbf29e81.01%
6a6d39e04e4ab31eb37a962030553435f28de9877660b099a1919f11d7533e4c0.26%
03c58cf6a2568d703ad0b7d2997fc484a5c9dfdf9c17d4f0d491830a180b19fa<0.01%

Process Ancestry

Security Analysis

What does swi_lspdiag_64.exe normally do?

Part of Sophos software.

When is swi_lspdiag_64.exe suspicious?

Running from unexpected paths.

How do attackers abuse swi_lspdiag_64.exe?

Not commonly abused.

Detection guidance

No specific detection needed.

False positive notes

Normal operation.

Ask Rocky about swi_lspdiag_64.exe

Rocky is the free chat demo. It answers from this same dataset, no account needed.

This page is the Team-tier API record for swi_lspdiag_64.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.