Process
startmenuexperiencehost.exe
StartMenuExperienceHost.exe is the process that renders the Windows Start menu. Windows split it out from the rest of the shell so the Start menu stays responsive on its own. It runs per user and is a routine part of the desktop.
File identity
- File type
- PE32+ executable
- Magic
- PE32+ executable (GUI)
- Original name
- startmenuexperiencehost.exe
- Internal name
- startmenuexperiencehost
- Product
- Microsoft® Windows® Operating System
- Status
- Signed
- Publisher
- Microsoft Corporation
- Signer
- Microsoft Windows
- Issuer
- Microsoft Windows Production PCA 2011
- Signature rate
- 100%
10.0.26100.8328 (WinBuild.160101.0800)100%
220.50 KB100%
Execution context
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe100%
Not observed.
Not observed.
1100%
Session 1100%
SeChangeNotifyPrivilege100%
Ancestry
Not observed.
Not observed.
Not observed.
Not observed.
Behavior
Not observed.
Not observed.
Not observed.
Indicators
Not observed.
Analysis
StartMenuExperienceHost.exe draws and runs the Start menu as a separate packaged (UWP) system app, isolated from explorer.exe and the other shell hosts so a problem in one does not freeze the others. It runs as the logged-on user, launched as part of the session, from a Windows SystemApps package folder rather than System32, and is signed by Microsoft.
Legitimately, StartMenuExperienceHost is present on every interactive desktop and is suspended when not in use. It renders UI rather than launching programs, so it does not normally start other processes or reach the network.
StartMenuExperienceHost.exe is a baseline process with a fixed identity, the logged-on user's account, a packaged Microsoft signature, no children, and no network, so any deviation is easy to see. The realistic abuse is impersonation (T1036.005), where malware uses the name from a path outside the genuine packaged location.
As a persistent per-user process it could also be an injection target (T1055). A StartMenuExperienceHost that loads unusual modules, reaches the network, or spawns programs is acting outside its UI role.
- Image path outside the Windows
SystemAppspackage locationhigh - Unsigned image or a signer other than Microsofthigh
- Running as
NT AUTHORITY\SYSTEMrather than the logged-on userhigh - Spawning command shells or making outbound network connectionshigh
- More instances than interactive usersmed
Telemetry
Microsoft Windows 11 Enterprise Evaluation100%
- First seen
- 2026-06-08
- Last seen
- 2026-06-08
- Machines
- 1