browser_broker.exe
Summary
Edge/IE Browser Broker - mediates between the browser sandbox and the operating system for elevated operations.
browser_broker.exe is the 315th most commonly executed Windows program in EchoTrail's dataset, observed 29,796 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by svchost.exe.
Behavior
Top Paths
- C:\Windows\System32100%
Top Hashes (SHA256)
- ddc207bc7b5a50d58b90505c83857ce3001612ac81eb3c605f8d8f9b5d0259e935.14%
- 1d9585ac850b5554739877ffe2a644b5406a54ac05aa7b37e1df8264555ab7a716.23%
- 25c7fa3c0bf1171d5d0d008658d29002390e223d4ab83970c171979b568ca10d10.71%
- 3c2902afd1d11a8059760990be36089ae2d8aef64c92d7f97b1b8e399a04206910.09%
- 609a3a73a983a1c47511282d31d9fcfe7909950944ac5324344596215cd778aa6.01%
- 600ce1c55790616a8da94ad88f361f1760dc426ec9ae586779f1842f4e095c7b5.72%
- a77756ddb7640e2e48448f484044c86bd9019057ef1af1a2ee8e18edfaec6f1a4.83%
- ccaf410fa244592c9c75585b247deb823e7ed1be6ec2e713d1c2251c5a83bed12.05%
- 0b341000399849aff5a8d523006c5cc1ee5f9399e44bf09e7268814ea914eac01.88%
- 3e5358f2b429b143e39a1804413dbe5018a5e9a88fe763983302a59378dc3d111.44%
Process Ancestry
Top Grandparents
- services.exe98.38%
- svchost.exe1.62%
Top Parents
- svchost.exe97.66%
- browser_broker.exe2.34%
Top Children
- browser_broker.exe59.4%
- msiexec.exe3.15%
- rundll32.exe1.79%
- WinRAR.exe0.85%
- mshta.exe0.68%
- wusa.exe0.68%
- iexplore.exe0.6%
- AcroRd32.exe0.26%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about browser_broker.exe
Rocky answers questions about browser_broker.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.