EchoTrail

chrome.exe

by Google
Web Browser

Sources: 300M+ executions observed in the wild and observed in the EchoTrail lab on Windows 11.

Summary

Google Chrome web browser. Chrome uses a multi-process architecture where the main browser process spawns multiple child chrome.exe processes for renderer, GPU, utility, and extension isolation. This results in many simultaneous chrome.exe instances being normal.

chrome.exe is the 5th most commonly executed Windows program in EchoTrail's dataset, observed 11,040,784 times across enterprise environments. It typically runs from C:\Program Files (x86)\Google\Chrome\Application and it is most often launched by chrome.exe.

Get this in your tools

The same record for chrome.exe, by REST or as an MCP tool. Free key, no card.

Get a free key
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
  https://api.echotrail.io/v1/process/chrome.exe

Free returns the summary. Team returns the full record you see on this page. Endpoint docs

5th
most commonly executed Windows program
11,040,784
observed endpoint executions

Behavior

Top Paths

  • C:\Program Files (x86)\Google\Chrome\Application97.38%
  • C:\Users\...1.43%
  • C:\Program Files\Google\Chrome\Application1.19%
  • C:\...<0.01%
  • C:\Windows\Temp\...<0.01%

Top Hashes (SHA256)

  • fccf1b67404134894afaaf4b7d21d7352280332aea1faa7afacd65dbd33696a74.07%
  • aa53ffb6fda174b3999a2b637ed9bde70ae2d7c7e1d19af95fb605c420bf2efc3.58%
  • d93a144f94731f0f9e5f034bcb8fac4002c028068522870a0e3e43c07c4c21732.73%
  • 272c60bec125da9b3edb89dee321a5d6a83a37d69ecf66b84bc4ff256b525dae2.43%
  • 5616ff15b3f5df4e18d28771ccdae19173873009f2318761aa9f9e573b9d9acc2.16%
  • 5589064ff7b1591359dc9b537bc7569c9c3688357340287b1560b4c3a65235482.13%
  • c10027d801f70d9a347b38e4949f4650c12d307a8e7c0579f6f7198cac3905791.98%
  • 98a8c0168e17133fd6cc240c1af3dd5fed3e0c3c677dfabfb28c93974595c4111.97%
  • fd8c15460abcda6b44fb970a84426617368bb2925f0c2b9e410dff20feb923d11.9%
  • 1fa5a6c8438a4e6d373d39c96b77c0c84540d38b80628effdec89e77d02d7e571.87%
  • 1214a7b92e4c3a60173bd1c3982de0ee9685273af85258eaca2b8ee15fb42851

Process Ancestry

Top Grandparents

Top Parents

Top Children

Lab record

Installed from
winget Google.Chrome 153.0.8010.37
Publisher
Google LLC
Persistence
3 services, 3 scheduled tasks
Network
64 destinations
Command lines
26 patterns (296 launches)
DLL loads
162 patterns (9,091 loads)
Registry writes
141 patterns (3,112 writes)
File writes
573 patterns (6,289 writes)
HTTP requests
6 patterns (6 requests)
TLS connections
29 patterns (30 handshakes)
Named pipes
28 patterns (959 events)
Process access
4 patterns (370 events)
Driver loads
0 patterns (0 loads)
PowerShell blocks
0 patterns (0 blocks)
Remote threads
0 patterns (0 events)
Audit events
0 patterns (0 events)

Full record on Team.

Security Analysis

What does chrome.exe normally do?

Located in C:\Program Files (x86)\Google\Chrome\Application or C:\Program Files\Google\Chrome\Application. Parent is almost always chrome.exe itself (child processes of the main browser process) or explorer.exe (user launching the browser). Common parents also include Outlook.exe (clicking links in email). Many simultaneous instances are normal due to multi-process architecture.

When is chrome.exe suspicious?

Chrome.exe spawning cmd.exe, powershell.exe, or other shells — while not impossible (e.g., developer tools), this is uncommon for normal browsing. Chrome.exe running from a non-standard path (user temp, AppData outside expected Chrome paths). Scheduled tasks launching chrome.exe. chrome.exe making unusual process creations beyond its normal renderer/GPU/utility children.

How do attackers abuse chrome.exe?

DLL search order hijacking: a malicious DLL placed in the Chrome application directory gets loaded when Chrome starts. Drive-by downloads: browser exploitation can lead to payload execution, though modern Chrome sandboxing makes this increasingly rare. Chrome as a launch vector: users downloading and executing malicious files through Chrome. Headless Chrome abuse: attackers may use Chrome in headless mode for credential phishing or web scraping.

Detection guidance

Medium-confidence: chrome.exe spawning shells (cmd.exe, powershell.exe). Scheduled tasks or services launching chrome.exe (potential persistence or automation abuse). Lower-confidence: chrome.exe spawning any non-Chrome child process. The multi-process architecture means most chrome.exe child processes are other chrome.exe instances — anything else warrants a look. DLL sideloading: monitor for unsigned DLLs loaded from the Chrome application directory.

False positive notes

Many simultaneous chrome.exe instances are completely normal. Chrome updates may spawn installer processes. Some developer workflows involve Chrome launching command-line tools. Browser extensions can trigger various system interactions.

MITRE ATT&CK techniques

T1189T1204.001T1574.002

References

Related Processes

chrome_updater.exeexplorer.exe

Ask Rocky about chrome.exe

Rocky is the free chat demo. It answers from this same dataset, no account needed.

This page is the Team-tier API record for chrome.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.