EchoTrail

iexplore.exe

by Microsoft
Web Browser

Sources: 300M+ executions observed in the wild and observed in the EchoTrail lab on Windows 11.

Summary

Internet Explorer web browser (legacy). Largely deprecated and replaced by Edge. Still present on many systems for backward compatibility and enterprise web application access.

iexplore.exe is the 191st most commonly executed Windows program in EchoTrail's dataset, observed 80,252 times across enterprise environments. It typically runs from C:\Program Files (x86)\Internet Explorer and it is most often launched by iexplore.exe.

Get this in your tools

The same record for iexplore.exe, by REST or as an MCP tool. Free key, no card.

Get a free key
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
  https://api.echotrail.io/v1/process/iexplore.exe

Free returns the summary. Team returns the full record you see on this page. Endpoint docs

191st
most commonly executed Windows program
80,252
observed endpoint executions

Behavior

Top Paths

  • C:\Program Files (x86)\Internet Explorer56.21%
  • C:\Program Files\internet explorer43.79%

Top Hashes (SHA256)

  • 74561199a186d36a6169d753bb88886be326e63416e75930f8ff929e93dd12ea12.52%
  • 7ccf5cf491eca6fb2d4178b86547f2fb88aca108927f1743962e14dbac2d945510.1%
  • d013bfe71cc889b512844e249678abe0535dfb2961dd601b7677e6101d6b8f959.6%
  • 6eda2f58189675e23011e5a39fcbfdd4aa8846feb99c5e347bbd3071f30bd5ed6.8%
  • 8333f6172a6bfe0acb32641d4bd272e0fcc6eb9a09f7da184487066a26a063726.43%
  • 4b15e5d66e2500549bc55c8cb0d6d1667cbc00ed0040b1b54f815232130a60db5.61%
  • 8dea16e513f70e1a98be6ec48439b5499d2c740247716f6bcb990b7c305ec0a05.26%
  • e582676ec900249b408ab4e37976ae8c443635a7da77755daf6f896a172856a34.81%
  • c8df7006dcb7239aa9ce3124f03b48613719d243c24d805483001d7006422c554.67%
  • b4a0b6c720f9d4422cfffff0774475d6bc7e47c43fe5ab5962c205f40287e07a3.35%
  • bb5e0cc7bae39baf9cef82ac88769d90a562f7a23fe6b97dc98dfbc8b7340cd6
  • 43f7fa5e22fa1a00989114e7d9b58cf1fb6dadf009bff45e70f1a48d06d9eb35

Code Signing

Signers by share of executions

  • Microsoft WindowsValid
    Catalog signed · 2 hashes
    100%
    Chain
    1. Microsoft Windows
    2. Microsoft Windows Production PCA 2011
    3. Microsoft Root Certificate Authority 2010
    Valid
    • Apr 16, 2026 to Oct 17, 2026
    Hashes
    • 43f7fa5e22fa1a00989114e7d9b58cf1fb6dadf009bff45e70f1a48d06d9eb3550% of executions, first seen Sep 25, 2026
    • bb5e0cc7bae39baf9cef82ac88769d90a562f7a23fe6b97dc98dfbc8b7340cd650% of executions, first seen Sep 25, 2026

Full certificate detail on Team.

Process Ancestry

Top Grandparents

Top Parents

Top Children

Lab record

Installed from
winget Mojang.MinecraftLauncher 2.0.0.0
Publisher
Microsoft Corporation
Persistence
none
Network
none
Command lines
2 patterns (2 launches)
DLL loads
116 patterns (118 loads)
Registry writes
41 patterns (79 writes)
File writes
0 patterns (0 writes)
HTTP requests
0 patterns (0 requests)
TLS connections
0 patterns (0 handshakes)
Named pipes
1 pattern (1 event)
Process access
1 pattern (1 event)
Driver loads
0 patterns (0 loads)
PowerShell blocks
0 patterns (0 blocks)
Remote threads
0 patterns (0 events)
Audit events
0 patterns (0 events)

Full record on Team.

Security Analysis

What does iexplore.exe normally do?

Located in C:\Program Files\Internet Explorer or C:\Program Files (x86)\Internet Explorer.

When is iexplore.exe suspicious?

Spawning shells. DLL sideloading. Being launched by unusual parents or scheduled tasks.

How do attackers abuse iexplore.exe?

Legacy browser with known vulnerabilities. DLL sideloading. COM object abuse. IE is frequently used in exploitation due to its legacy attack surface.

Detection guidance

Monitor for shell spawning. Consider whether IE should be running at all in the environment — many organizations have deprecated it.

False positive notes

Some legacy enterprise web applications still require IE. Outlook may launch IE for certain content.

MITRE ATT&CK techniques

T1189T1204.001T1574.002

Related Processes

explorer.exe

Ask Rocky about iexplore.exe

Rocky is the free chat demo. It answers from this same dataset, no account needed.

This page is the Team-tier API record for iexplore.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.