explorer.exe

by Microsoft

Operating Systemcritical risk

Sources: 300M+ executions observed in the wild.

Summary

Windows Explorer is the default Windows shell providing the desktop, taskbar, Start menu, and file browser. It is the primary user interface process and runs once per interactive logon session.

explorer.exe is the 187th most commonly executed Windows program in EchoTrail's dataset, observed 83,334 times across enterprise environments. It typically runs from C:\Windows and it is most often launched by userinit.exe.

Get this in your tools

The same record for explorer.exe, by REST or as an MCP tool. Free key, no card.

Get a free key

curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
  https://api.echotrail.io/v1/process/explorer.exe

Free returns the summary. Team returns the full record you see on this page. Endpoint docs

187th

most commonly executed Windows program

83,334

observed endpoint executions

Behavior

Top Paths

C:\Windows69.57%
C:\Windows\SysWOW6430.38%
C:\Users\...0.05%
C:\Windows\Temp\...<0.01%

Top Hashes (SHA256)

107060bab6d8dff0fdf91777f84453b8336fdc4c30ca189ab9d58e8801c9e92414.4%
b2b8b4b9a37644531d9d887473f01da2ffedc86938f93349e758ff359802756110.14%
7db95180cfe5706e905e1c343cb2cfd3438402c5918d911f1ed8d5a79ac475ae7.08%
3ca90412a7e4871ab0160ea9e94093f094c0b9a6988674af3352160516aa1f8a5.13%
1dc1df17a9d74d68b73943a408671e7945d1f2a63841621758e2511eea8f09b84.61%
89493f13e3a4ab8b6406643212479cfaa2073c335025a092a39c2b30d325c5d43.83%
06b71d6f3a96fb82443f3c7e27bd00c98ddb902df8ebdf0b3e73b152155a70e23.25%
d2faf086a07a6a72461d62aa9ccd4b18e4c6b4de253236efba339b5920844fae3.09%
afae363afbc03ced0715fa5c25f4e7273d1271cde81a1edcc3b8cb0a1f41671d2.76%
d5bc504277172be5c54b60ad5c13209dc1f729131def084de3ec8c72e54c58ef2.74%

Process Ancestry

Top Grandparents

Top Parents

Top Children

Security Analysis

What does explorer.exe normally do?

Located in C:\Windows (not System32). Parent is userinit.exe (which exits after launching explorer, so parent may appear empty in some tools). Also launched by svchost.exe in some RDP/service scenarios. One instance per interactive user session. Runs under the logged-on user account.

When is explorer.exe suspicious?

Running from any path other than C:\Windows. Multiple instances for a single user session (beyond normal restarts). Running as SYSTEM or other service accounts. Parent process other than userinit.exe or svchost.exe. Spawning unusual child processes not associated with normal shell operations. Name masquerading (expl0rer.exe, explorers.exe).

How do attackers abuse explorer.exe?

Process injection: explorer.exe is one of the most common injection targets because it is always running and trusted. Attackers inject code into explorer.exe to inherit its user-level access and network connections. Name/path masquerading: malware frequently uses the explorer.exe name in a different directory. COM object hijacking: modifying registry entries for COM objects loaded by explorer.exe to achieve persistence. Shell extension abuse: malicious shell extensions loaded by explorer.exe.

Detection guidance

High-confidence: explorer.exe running from any path other than C:\Windows. explorer.exe with a parent other than userinit.exe (accounting for the parent-exit caveat). explorer.exe running as SYSTEM. Medium-confidence: Sysmon Event ID 8 (CreateRemoteThread) targeting explorer.exe. Unusual DLLs loaded by explorer.exe (Event ID 7). Multiple explorer.exe instances for a single user.

False positive notes

ConnectWise and similar RMM tools may launch explorer.exe for remote desktop sessions. svchost.exe as parent can be legitimate in RDP scenarios. Explorer restarts (via Task Manager or crashes) will show a new instance.

MITRE ATT&CK techniques

T1055 T1036.005 T1036.004 T1547.001

Related Processes

svchost.exe userinit.exe winlogon.exe

Ask Rocky about explorer.exe

Rocky is the free chat demo. It answers from this same dataset, no account needed.

This page is the Team-tier API record for explorer.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.