InstallAgentUserBroker.exe
Summary
RMM Agent User Broker - mediates between the system-level RMM agent and the user session.
InstallAgentUserBroker.exe is the 627th most commonly executed Windows program in EchoTrail's dataset, observed 7,040 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by svchost.exe.
Behavior
Top Paths
- C:\Windows\System32100%
Top Hashes (SHA256)
- 12a73506712d6a74bbf817f7eed3dec6169bcef615967aa4bb24aae97bd2abb564.11%
- 572c21788c10616cd0a44705b9ac310c0d730d1630310586a2b7eed98b52a9f48.04%
- 4cfa7f631f1ad5a77bdb8235442c2894845e02c40d8cd5c3c74a3ee0afe3ed6e6.59%
- 71b9fc9d46f8dcb8a2a8989cf4081713f9946aefcdb56969b893647a39a8cb0f4.17%
- 63f49bb1c987d0ee7ad088edcb429811d08dca9fb94e559304eff3a52f5b50c93.39%
- d8f575bad0680bd6bc12fe12d89f904af701dc925f533908419e908fe4ee1d192.89%
- 2c06b6224aa7964a2e93a645f5c1ec953a843a72d1fe7dbb97cbecc77ebf31372.17%
- 856474ab3a88aaf7ad05af9aa389f8b20d3b3940f46cb16790629756a1fb60ff2%
- 83dbb4b8a022d08d272a3c1fc302c2c6978e7e390b4a634edde9914f9dabdcbe1.87%
- 5524a92a941ecf3fa2e0e18081faad315b97f07aa689342e93a7595a3530622c1.15%
Process Ancestry
Top Grandparents
- services.exe100%
Top Parents
- svchost.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about InstallAgentUserBroker.exe
Rocky answers questions about InstallAgentUserBroker.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.