wksprt.exe
by Microsoft
Operating System
Summary
Windows RemoteApp and Desktop Connections - manages workspace connections for RemoteApp.
wksprt.exe is the 721st most commonly executed Windows program in EchoTrail's dataset, observed 4,884 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by svchost.exe.
721st
most commonly executed Windows program
4,884
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Windows\System32100%
Top Hashes (SHA256)
- 1a2561f12f9eeb0f5168277197e20234641c3c9c0193453afec1160fec722f0f71.29%
- 4ffd22f4cbbc90b74ced15111ca1312ca9d24afe6f06f01515f421fa78c3d9ad12.49%
- 4f57f549aea9065ca3d487b18ee3048689cdb1a93947bd1368bb4bd9f2581e6b9.95%
- 63fb00f1e31949c948de0e9cb7e96809a8ff5da027a0c16f455762062434ce433.07%
- 0e68cad2d39d1e21cd96453440ed95b77fb88439bafd70b802471b9047b5f3d92.93%
- 6a9700dce43a9ffb4c59a13a6cb8a1a94197fc051310615f1ad7ea84b6d22fea0.2%
- 3d5ffd6aba16556995bb6a7afbfdd93f66940a224feba9fef0b92c437ffcbac90.04%
- 043ed43cfc78e1a72faa6aaad3bdb68880dc78c0d6833cc498632ff1f4f0d7010.02%
Process Ancestry
Top Grandparents
- services.exe100%
Top Parents
- svchost.exe100%
Top Children
- control.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about wksprt.exe
Rocky answers questions about wksprt.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.