useroobebroker.exe
Summary
Windows User OOBE Broker - handles Out-of-Box Experience tasks during Windows setup and updates.
useroobebroker.exe is the 813th most commonly executed Windows program in EchoTrail's dataset, observed 3,736 times across enterprise environments. It typically runs from C:\Windows\System32\oobe and it is most often launched by svchost.exe.
Behavior
Top Paths
- C:\Windows\System32\oobe100%
Top Hashes (SHA256)
- ad938c303f12ea8d164433cc7ba46fc7b9ae00f6f899e308d4317dab46e2564260.83%
- b35eea5032d1aefe0251ac50c078c9fd04ed8ce645035f261ee2c0141d30615c9.91%
- 2a449e3d6a3954fb9765152be964a29b743665738f78b6b81ae5cb712876b8a47.15%
- 1eef97afd9e84c5f50f198445593678fa1941267a17d4836dae61e9fac1f0bdb4.66%
- 6888918159c79da40e8435080d82e49bcdc1519ae48601b51f2d883c7847950c2.81%
- 094a94052376352fd2fad2cc666e6b52178842202f8147bc3596b5b78a7d08372.78%
- fdbb7e8b952e66a0a6c16595964ec17908a9da84b9da09dcd5d6cb6c512632702.62%
- 2cf3f53e333643f0351c1fea65247d450a6cd98b79c50daf8844b77effa006702.36%
- 803eb6fd3ff3b2833f353db2bb41c5bae1a1a9f9011cad88b5e767963e4d12981.98%
- c391cce10aeec0887ad6af116ee22219d176b2ed93fa66912e004871dbdda1ff1.69%
Process Ancestry
Top Parents
- svchost.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about useroobebroker.exe
Rocky answers questions about useroobebroker.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.