wfcrun32.exe
Summary
Citrix ICA Client (WFClient) - Citrix Workspace/Receiver connection manager for virtual apps and desktops.
wfcrun32.exe is the 832nd most commonly executed Windows program in EchoTrail's dataset, observed 3,527 times across enterprise environments. It typically runs from C:\Program Files (x86)\Citrix\ICA Client and it is most often launched by svchost.exe.
Behavior
Top Paths
- C:\Program Files (x86)\Citrix\ICA Client94.03%
- C:\Users\...5.97%
Top Hashes (SHA256)
- 9f1034acad81d369a25e60e4b3549ffd7791666e6d4d4e665db16dcf4622995228.46%
- 6571583fcd6ca525e7121246cb1ea9f820b45d5388617eda13e2af72b4ff230626.87%
- 8b01536153dd7a9c8ade736a2944313700a71744fae0c71d908e3739c69ad0ef9.96%
- ddb31b8c99560c5c79082f3bf17e8e87655045d940196e47e33ee998755bd8069.39%
- 3cd424c29870354d9bd6221e05c4450b81c15647330bc122f3d3e35309c077ba6.17%
- 2ff223bac7a1f6a9133814d97e5e9f5ca3e3561303edc879392dd804cac002713.39%
- 25e3baa94ff5a7097548c27880006157896d9f543443afd890df9200a49d87123.11%
- 98cb139e9d6afdee92a469b15917d3021f372700060418c80a4a85f92d73845e2.57%
- 5b9d74748317eca62bc0308e9a38e50f9f04508bc4e870182cba0328063d3ce52.38%
- 7f2f8867c8b3f1bd36eeb3a383aeddbe6876e7c9118cdd363aee439bb8b588cc2.26%
Process Ancestry
Top Grandparents
- services.exe45.45%
- explorer.exe31.34%
- ssoncom.exe20.27%
- iexplore.exe1.67%
- svchost.exe0.43%
- userinit.exe0.43%
- chrome.exe0.34%
- OUTLOOK.EXE0.04%
Top Parents
- svchost.exe50.59%
- chrome.exe24.1%
- ssonsvr.exe13.74%
- iexplore.exe9.9%
- firefox.exe0.68%
- explorer.exe0.54%
- RuntimeBroker.exe0.28%
- msedge.exe0.17%
Top Children
- wfica32.exe53.21%
- concentr.exe30.87%
- cdviewer.exe14.51%
- Receiver.exe1.41%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about wfcrun32.exe
Rocky answers questions about wfcrun32.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.