iexplore.exe
Summary
Internet Explorer web browser (legacy). Largely deprecated and replaced by Edge. Still present on many systems for backward compatibility and enterprise web application access.
iexplore.exe is the 191st most commonly executed Windows program in EchoTrail's dataset, observed 80,252 times across enterprise environments. It typically runs from C:\Program Files (x86)\Internet Explorer and it is most often launched by iexplore.exe.
Behavior
Top Paths
- C:\Program Files (x86)\Internet Explorer56.21%
- C:\Program Files\internet explorer43.79%
Top Hashes (SHA256)
- 74561199a186d36a6169d753bb88886be326e63416e75930f8ff929e93dd12ea12.53%
- 7ccf5cf491eca6fb2d4178b86547f2fb88aca108927f1743962e14dbac2d945510.11%
- d013bfe71cc889b512844e249678abe0535dfb2961dd601b7677e6101d6b8f959.6%
- 6eda2f58189675e23011e5a39fcbfdd4aa8846feb99c5e347bbd3071f30bd5ed6.8%
- 8333f6172a6bfe0acb32641d4bd272e0fcc6eb9a09f7da184487066a26a063726.43%
- 4b15e5d66e2500549bc55c8cb0d6d1667cbc00ed0040b1b54f815232130a60db5.62%
- 8dea16e513f70e1a98be6ec48439b5499d2c740247716f6bcb990b7c305ec0a05.26%
- e582676ec900249b408ab4e37976ae8c443635a7da77755daf6f896a172856a34.81%
- c8df7006dcb7239aa9ce3124f03b48613719d243c24d805483001d7006422c554.67%
- b4a0b6c720f9d4422cfffff0774475d6bc7e47c43fe5ab5962c205f40287e07a3.35%
Process Ancestry
Top Grandparents
- svchost.exe31.07%
- explorer.exe27.85%
- services.exe22.61%
- userinit.exe12.23%
- OUTLOOK.EXE3.47%
- iexplore.exe1.26%
- OpenWith.exe0.14%
- winlogon.exe0.12%
- lync.exe0.12%
- KeePass.exe0.1%
Top Parents
- iexplore.exe56.32%
- svchost.exe24.05%
- explorer.exe17%
- OUTLOOK.EXE1.73%
- rundll32.exe0.16%
- OpenWith.exe0.09%
- lync.exe0.06%
- KeePass.exe0.05%
- chrome.exe0.04%
- MSOXMLED.EXE0.03%
Top Children
- iexplore.exe61.38%
- Dashlane.exe18.14%
- ie_to_edge_stub.exe3.57%
- IESettingSync.exe2.79%
- msedge.exe2.66%
- mfpmp.exe1.9%
- AcroRd32.exe1.43%
- WerFault.exe1.09%
- rundll32.exe0.87%
- ssvagent.exe0.79%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does iexplore.exe normally do?
Located in C:\Program Files\Internet Explorer or C:\Program Files (x86)\Internet Explorer.
When is iexplore.exe suspicious?
Spawning shells. DLL sideloading. Being launched by unusual parents or scheduled tasks.
How do attackers abuse iexplore.exe?
Legacy browser with known vulnerabilities. DLL sideloading. COM object abuse. IE is frequently used in exploitation due to its legacy attack surface.
Detection guidance
Monitor for shell spawning. Consider whether IE should be running at all in the environment — many organizations have deprecated it.
False positive notes
Some legacy enterprise web applications still require IE. Outlook may launch IE for certain content.
Related Processes
Ask Rocky about iexplore.exe
Rocky answers questions about iexplore.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.