oobeldr.exe
by Microsoft
Operating System
Sources: 300M+ executions observed in the wild.
Summary
Windows Out-of-Box Experience Loader
oobeldr.exe is the 2472nd most commonly executed Windows program in EchoTrail's dataset, observed 172 times across enterprise environments. It typically runs from C:\Windows\System32\oobe.
Get this in your tools
The same record for oobeldr.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/oobeldr.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
2472nd
most commonly executed Windows program
172
observed endpoint executions
Behavior
Top Paths
- C:\Windows\System32\oobe100%
Top Hashes (SHA256)
- 9824a4bb6462c966956a72c4952eef32c6242c2fd183293d262a0d9bd25474ba30.18%
- b98e1ffb925bed48e9a4e0ab9d747f50fce056eebc3d43927ed0b5d3d34cfc7c23.08%
- 8f94e9cea5a514396145b68bc9a88dc968599edf9f74b1f502893bd17f228dd418.34%
- b5f65b8bc7dcb4f000e14d71ccc27caed1ce7f6f26d95b3e3f7a84b8022754516.51%
- 4f424dc5e0c16cbbac4a12c3750297f0f58697e102fb2001c655868ed829274f5.33%
- 2f54363f49acafabf78bba8086ece27869ba7ed0224b3cd5ac3aa6e97461c3a34.73%
- 67fe654b8b277df364e596c2ac7466bd307f28c244425aac7bc79f1de3269a5a4.73%
- 454d43d4370925d8306ac185714e0aeba0280e854a804348079dd8b48be641a12.96%
- a258f550503c4b85087234c95c8220c1a3abc9353779b93b08725db009e9c1ab2.37%
- 1a515b4e28e8bb7ef530457acb17f581a92052d8f60a239626a448ea50eac87f0.59%
Process Ancestry
Top Grandparents
- winlogon.exe100%
Top Children
- msoobe.exe100%
Ask Rocky about oobeldr.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for oobeldr.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.