explorer.exe

by Microsoft

Operating Systemcritical risk

Summary

Windows Explorer is the default Windows shell providing the desktop, taskbar, Start menu, and file browser. It is the primary user interface process and runs once per interactive logon session.

explorer.exe is the 187th most commonly executed Windows program in EchoTrail's dataset, observed 83,334 times across enterprise environments. It typically runs from C:\Windows and it is most often launched by userinit.exe.

187th

most commonly executed Windows program

83,334

observed executions

medium

statistical confidence

Behavior

Top Paths

C:\Windows69.57%
C:\Windows\SysWOW6430.38%
C:\Users\...0.05%
C:\Windows\Temp\...<0.01%

Top Hashes (SHA256)

107060bab6d8dff0fdf91777f84453b8336fdc4c30ca189ab9d58e8801c9e92414.4%
b2b8b4b9a37644531d9d887473f01da2ffedc86938f93349e758ff359802756110.14%
7db95180cfe5706e905e1c343cb2cfd3438402c5918d911f1ed8d5a79ac475ae7.08%
3ca90412a7e4871ab0160ea9e94093f094c0b9a6988674af3352160516aa1f8a5.13%
1dc1df17a9d74d68b73943a408671e7945d1f2a63841621758e2511eea8f09b84.61%
89493f13e3a4ab8b6406643212479cfaa2073c335025a092a39c2b30d325c5d43.83%
06b71d6f3a96fb82443f3c7e27bd00c98ddb902df8ebdf0b3e73b152155a70e23.25%
d2faf086a07a6a72461d62aa9ccd4b18e4c6b4de253236efba339b5920844fae3.09%
afae363afbc03ced0715fa5c25f4e7273d1271cde81a1edcc3b8cb0a1f41671d2.76%
d5bc504277172be5c54b60ad5c13209dc1f729131def084de3ec8c72e54c58ef2.74%

Process Ancestry

Top Grandparents

Top Parents

Top Children

Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.

Security Analysis

What does explorer.exe normally do?

Located in C:\Windows (not System32). Parent is userinit.exe (which exits after launching explorer, so parent may appear empty in some tools). Also launched by svchost.exe in some RDP/service scenarios. One instance per interactive user session. Runs under the logged-on user account.

When is explorer.exe suspicious?

Running from any path other than C:\Windows. Multiple instances for a single user session (beyond normal restarts). Running as SYSTEM or other service accounts. Parent process other than userinit.exe or svchost.exe. Spawning unusual child processes not associated with normal shell operations. Name masquerading (expl0rer.exe, explorers.exe).

How do attackers abuse explorer.exe?

Process injection: explorer.exe is one of the most common injection targets because it is always running and trusted. Attackers inject code into explorer.exe to inherit its user-level access and network connections. Name/path masquerading: malware frequently uses the explorer.exe name in a different directory. COM object hijacking: modifying registry entries for COM objects loaded by explorer.exe to achieve persistence. Shell extension abuse: malicious shell extensions loaded by explorer.exe.

Detection guidance

High-confidence: explorer.exe running from any path other than C:\Windows. explorer.exe with a parent other than userinit.exe (accounting for the parent-exit caveat). explorer.exe running as SYSTEM. Medium-confidence: Sysmon Event ID 8 (CreateRemoteThread) targeting explorer.exe. Unusual DLLs loaded by explorer.exe (Event ID 7). Multiple explorer.exe instances for a single user.

False positive notes

ConnectWise and similar RMM tools may launch explorer.exe for remote desktop sessions. svchost.exe as parent can be legitimate in RDP scenarios. Explorer restarts (via Task Manager or crashes) will show a new instance.

MITRE ATT&CK techniques

T1055 T1036.005 T1036.004 T1547.001

Related Processes

svchost.exe userinit.exe winlogon.exe

Ask Rocky about explorer.exe

Rocky answers questions about explorer.exe grounded in this same dataset — free, no account needed.

Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.

Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.