AtBroker.exe
Summary
Assistive Technology Broker - manages accessibility (AT) applications like Narrator, Magnifier, and on-screen keyboard.
AtBroker.exe is the 536th most commonly executed Windows program in EchoTrail's dataset, observed 10,043 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by winlogon.exe.
Behavior
Top Paths
- C:\Windows\System32100%
Top Hashes (SHA256)
- 78ff9af3b2319b2776b8937df584ad6899433fd10dea64d8081f2f69b0d567b240.2%
- c8d67389d90381efda4bfc7e198c6423ed8146803d0b6b8556714bf70678938313.96%
- 63a92b2a5c99f4c339bc55ba45b61d0cd6a4e4970b6ba9613b7b0e19771e4cd18.97%
- f7686ec25aaf67724cd6170a9d7a20cd987ea32f35ef654ae56fdcea16180c5d8.02%
- 39fdca8f94f2f8653d7e5054eb3878e8b0e9a36cd8817609c68361dab52d91735.51%
- fac0293dd1061b151e779bf4b245e6652c951fedebc602a166156dfbd38b5d674.65%
- a84417ee9d039891af43b267896db921a40838d8a17cc1be29785d031e5944d43.98%
- ce21acae03a54fc15cbf6fd553ca87ed778755d41a68a701a134790cf2e14f453.25%
- a4924c3a207b8f1c55318b0012d0e99d06cdeef8709296ce25881cc46b31aec13.18%
- 80cc3fb17d8cbb4a68f27c607a8d1c0208cee892f6d2a2e222e18b23d4e0fc762.88%
Process Ancestry
Top Grandparents
- smss.exe97.06%
- userinit.exe1.17%
- svchost.exe0.83%
- winlogon.exe0.79%
- LogonUI.exe0.08%
- nvvsvc.exe0.04%
- dwm.exe0.02%
Top Parents
- winlogon.exe98.67%
- explorer.exe0.64%
- AtBroker.exe0.45%
- utilman.exe0.01%
Top Children
- sethc.exe94%
- Magnify.exe3.24%
- AtBroker.exe1.07%
- osk.exe0.27%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about AtBroker.exe
Rocky answers questions about AtBroker.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.