chrome.exe
Summary
Google Chrome web browser. Chrome uses a multi-process architecture where the main browser process spawns multiple child chrome.exe processes for renderer, GPU, utility, and extension isolation. This results in many simultaneous chrome.exe instances being normal.
chrome.exe is the 5th most commonly executed Windows program in EchoTrail's dataset, observed 11,040,784 times across enterprise environments. It typically runs from C:\Program Files (x86)\Google\Chrome\Application and it is most often launched by chrome.exe.
Behavior
Top Paths
- C:\Program Files (x86)\Google\Chrome\Application97.38%
- C:\Users\...1.43%
- C:\Program Files\Google\Chrome\Application1.19%
- C:\...<0.01%
- C:\Windows\Temp\...<0.01%
Top Hashes (SHA256)
- fccf1b67404134894afaaf4b7d21d7352280332aea1faa7afacd65dbd33696a74.07%
- aa53ffb6fda174b3999a2b637ed9bde70ae2d7c7e1d19af95fb605c420bf2efc3.58%
- d93a144f94731f0f9e5f034bcb8fac4002c028068522870a0e3e43c07c4c21732.73%
- 272c60bec125da9b3edb89dee321a5d6a83a37d69ecf66b84bc4ff256b525dae2.43%
- 5616ff15b3f5df4e18d28771ccdae19173873009f2318761aa9f9e573b9d9acc2.16%
- 5589064ff7b1591359dc9b537bc7569c9c3688357340287b1560b4c3a65235482.13%
- c10027d801f70d9a347b38e4949f4650c12d307a8e7c0579f6f7198cac3905791.98%
- 98a8c0168e17133fd6cc240c1af3dd5fed3e0c3c677dfabfb28c93974595c4111.97%
- fd8c15460abcda6b44fb970a84426617368bb2925f0c2b9e410dff20feb923d11.9%
- 1fa5a6c8438a4e6d373d39c96b77c0c84540d38b80628effdec89e77d02d7e571.87%
Process Ancestry
Top Grandparents
- explorer.exe82.67%
- OUTLOOK.EXE5.02%
- chrome.exe4.23%
- KeePass.exe3.22%
- cmd.exe1.48%
- userinit.exe0.75%
- RuntimeBroker.exe0.32%
- svchost.exe0.22%
- lync.exe0.19%
Top Parents
- chrome.exe98.91%
- explorer.exe0.47%
- OUTLOOK.EXE0.27%
- KeePass.exe0.11%
- lync.exe0.01%
- RuntimeBroker.exe0.01%
- EXCEL.EXE0.01%
- WINWORD.EXE0.01%
- Discord.exe<0.01%
Top Children
- chrome.exe98.23%
- Softphone.exe0.74%
- cmd.exe0.57%
- crashpad_handler.exe0.08%
- EXCEL.EXE0.08%
- Zoom.exe0.02%
- WINWORD.EXE0.01%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does chrome.exe normally do?
Located in C:\Program Files (x86)\Google\Chrome\Application or C:\Program Files\Google\Chrome\Application. Parent is almost always chrome.exe itself (child processes of the main browser process) or explorer.exe (user launching the browser). Common parents also include Outlook.exe (clicking links in email). Many simultaneous instances are normal due to multi-process architecture.
When is chrome.exe suspicious?
Chrome.exe spawning cmd.exe, powershell.exe, or other shells — while not impossible (e.g., developer tools), this is uncommon for normal browsing. Chrome.exe running from a non-standard path (user temp, AppData outside expected Chrome paths). Scheduled tasks launching chrome.exe. chrome.exe making unusual process creations beyond its normal renderer/GPU/utility children.
How do attackers abuse chrome.exe?
DLL search order hijacking: a malicious DLL placed in the Chrome application directory gets loaded when Chrome starts. Drive-by downloads: browser exploitation can lead to payload execution, though modern Chrome sandboxing makes this increasingly rare. Chrome as a launch vector: users downloading and executing malicious files through Chrome. Headless Chrome abuse: attackers may use Chrome in headless mode for credential phishing or web scraping.
Detection guidance
Medium-confidence: chrome.exe spawning shells (cmd.exe, powershell.exe). Scheduled tasks or services launching chrome.exe (potential persistence or automation abuse). Lower-confidence: chrome.exe spawning any non-Chrome child process. The multi-process architecture means most chrome.exe child processes are other chrome.exe instances — anything else warrants a look. DLL sideloading: monitor for unsigned DLLs loaded from the Chrome application directory.
False positive notes
Many simultaneous chrome.exe instances are completely normal. Chrome updates may spawn installer processes. Some developer workflows involve Chrome launching command-line tools. Browser extensions can trigger various system interactions.
Related Processes
Ask Rocky about chrome.exe
Rocky answers questions about chrome.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.