EchoTrail

notification_helper.exe

by Various
Web Browser

Sources: 300M+ executions observed in the wild and observed in the EchoTrail lab on Windows 11.

Summary

Browser Notification Helper - handles desktop notification delivery for web browsers.

notification_helper.exe is the 581st most commonly executed Windows program in EchoTrail's dataset, observed 8,387 times across enterprise environments. It typically runs from C:\Program Files (x86)\Google\Chrome\Application\74.0.3729.169 and it is most often launched by svchost.exe.

Get this in your tools

The same record for notification_helper.exe, by REST or as an MCP tool. Free key, no card.

Get a free key
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
  https://api.echotrail.io/v1/process/notification_helper.exe

Free returns the summary. Team returns the full record you see on this page. Endpoint docs

581st
most commonly executed Windows program
8,387
observed endpoint executions

Behavior

Top Paths

  • C:\Program Files (x86)\Google\Chrome\Application\74.0.3729.1693.17%
  • C:\Program Files (x86)\Google\Chrome\Application\79.0.3945.1302.73%
  • C:\Program Files (x86)\Google\Chrome\Application\75.0.3770.1002.6%
  • C:\Program Files (x86)\Google\Chrome\Application\73.0.3683.1032.53%
  • C:\Program Files (x86)\Google\Chrome\Application\87.0.4280.882.48%
  • C:\Program Files (x86)\Google\Chrome\Application\80.0.3987.1492.4%
  • C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.1162.38%
  • C:\Program Files (x86)\Google\Chrome\Application\81.0.4044.1382.23%
  • C:\Program Files (x86)\Google\Chrome\Application\76.0.3809.1002.02%
  • C:\Program Files (x86)\Google\Chrome\Application\77.0.3865.902.02%
  • C:\Program Files\Google\Chrome\Application\153.0.8010.37

Top Hashes (SHA256)

  • 1ba6174e9833778283cb1cc3a6309e915b364ce2aa3217d9a0bc38aff51ca9a23.04%
  • 04d6a798e190a9f9765a4b21be78a82ba79649331a2b18f743eef2202592c2092.9%
  • bc389dafa0b9561a51f3ab2fcab5c72e0992f02213ae18952ec5b3dc940bf4db2.77%
  • 8ce00e27cc43b7fbb19fcf0bc5f2c921e3618d5e80e28b36cc6473f9bb42a1a52.67%
  • 4e7b433b320febb148a7b835121edcfb0c1d1e087f4487ec44aaf0989d686c222.66%
  • 7ed6fd08863632949b6ee7b067cda2444ecfc2369cf6757e42f81688a2efb2e62.49%
  • 4f14abe126982d4064cf047e7870037e74eee6d9c6afdccdbac9723fa50d6f422.25%
  • d32441163d70a2e231b395b73ed19fd0ca1918e849b9097b40f20d800b64f7592.25%
  • 84442d9b0084729d8d29c1229d32480ae1678a772bce95c0ccf472db3e1f89a42.22%
  • b671859785c6b3a7c58930c4fddd6f27d0e77121bfdaceb789219ef1a84cf1432.17%
  • 5bfb9b5c9d314d9329b590596223ffcbd298f1f49f571bd599f61fe8c20cffa1

Process Ancestry

Top Grandparents

Top Parents

Top Children

Lab record

Installed from
winget Google.Chrome 153.0.8010.37
Publisher
Google LLC
Persistence
none
Network
none
Command lines
1 pattern (3 launches)
DLL loads
26 patterns (79 loads)
Registry writes
0 patterns (0 writes)
File writes
0 patterns (0 writes)
HTTP requests
0 patterns (0 requests)
TLS connections
0 patterns (0 handshakes)
Named pipes
0 patterns (0 events)
Process access
0 patterns (0 events)
Driver loads
0 patterns (0 loads)
PowerShell blocks
0 patterns (0 blocks)
Remote threads
0 patterns (0 events)
Audit events
0 patterns (0 events)

Full record on Team.

Ask Rocky about notification_helper.exe

Rocky is the free chat demo. It answers from this same dataset, no account needed.

This page is the Team-tier API record for notification_helper.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.