cwainstaller.exe
by Citrix Systems, Inc.
Sources: observed in the EchoTrail lab on Windows 11.
Summary
(Citrix Workspace, Citrix Systems, Inc.)
cwainstaller.exe is not in the 2025 snapshot. It was observed in EchoTrail's behavior lab on Windows 11 24H2 on 2026-09-29 installed from winget package Citrix.Workspace.
Get this in your tools
The same record for cwainstaller.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/cwainstaller.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
n/a
most commonly executed Windows program
n/a
observed endpoint executions
Behavior
Top Paths
- C:\Program Files\Citrix\Citrix Workspace 26.3.11.10
Top Hashes (SHA256)
- f00875128dc2199193090f43e801b67142c8414dcd7408517cc3f07b60b4045a
Process Ancestry
Top Grandparents
Top Parents
Lab record
- Installed from
- winget Citrix.Workspace 26.3.11.10
- Publisher
- Citrix Systems, Inc.
- Persistence
- none
- Network
- 2 destinations
- Command lines
- 1 pattern (1 launch)
- DLL loads
- 172 patterns (202 loads)
- Registry writes
- 20 patterns (45 writes)
- File writes
- 90 patterns (90 writes)
- HTTP requests
- 0 patterns (0 requests)
- TLS connections
- 1 pattern (1 handshake)
- Named pipes
- 2 patterns (3 events)
- Process access
- 0 patterns (0 events)
- Driver loads
- 0 patterns (0 loads)
- PowerShell blocks
- 0 patterns (0 blocks)
- Remote threads
- 0 patterns (0 events)
- Audit events
- 0 patterns (0 events)
Full record on Team.
Ask Rocky about cwainstaller.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for cwainstaller.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.