Process
shellexperiencehost.exe
ShellExperienceHost.exe renders parts of the modern Windows shell, such as the action center, notifications, and other system UI surfaces drawn with the Universal Windows Platform. It runs per user as part of the desktop and is a routine, low-profile process.
File identity
- File type
- PE32+ executable
- Magic
- PE32+ executable (GUI)
- Original name
- ShellExperienceHost.exe
- Internal name
- ShellExperienceHost
- Product
- Microsoft® Windows® Operating System
- Status
- Signed
- Publisher
- Microsoft Corporation
- Signer
- Microsoft Windows
- Issuer
- Microsoft Windows Production PCA 2011
- Signature rate
- 100%
10.0.26100.8457 (WinBuild.160101.0800)100%
521.00 KB100%
Execution context
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe100%
Not observed.
Not observed.
1100%
Session 1100%
SeChangeNotifyPrivilege100%
Ancestry
Not observed.
Not observed.
Not observed.
Not observed.
Behavior
Not observed.
Not observed.
Not observed.
Not observed.
Indicators
Not observed.
Analysis
ShellExperienceHost.exe is a packaged (UWP) system app that draws shell surfaces beyond the classic taskbar and desktop, working alongside explorer.exe and the other modern shell hosts. It runs as the logged-on user and is launched as part of the session. As a packaged system app it runs from a Windows SystemApps package folder rather than System32, and is signed by Microsoft.
Legitimately, ShellExperienceHost is present on every interactive desktop, drawing UI rather than launching programs. It is suspended when idle on modern Windows, which is normal.
ShellExperienceHost.exe is a baseline process. Its value is a steady identity, the logged-on user's account, a packaged Microsoft signature, no children, and no network, so deviations stand out. The realistic abuse is impersonation (T1036.005), where malware borrows the name from a path outside the genuine packaged location.
As a persistent per-user process it could also be injected into (T1055). A ShellExperienceHost that loads unusual modules, reaches the network, or spawns programs is acting outside its UI role.
- Image path outside the Windows
SystemAppspackage locationhigh - Unsigned image or a signer other than Microsofthigh
- Running as
NT AUTHORITY\SYSTEMrather than the logged-on userhigh - Spawning command shells or making outbound network connectionshigh
- More instances than interactive usersmed
Telemetry
Microsoft Windows 11 Enterprise Evaluation100%
- First seen
- 2026-06-08
- Last seen
- 2026-06-08
- Machines
- 1