When Windows Explorer is killed on Win 10, and then manually relaunched with an elevated account, it is actually re-launched by svchost.exe 5 seconds later via a temporary task C:\Windows\Tasks\CreateExplorerShellUnelevatedTask.job […]
Article Link: http://www.hexacorn.com/blog/2017/12/07/svchost-exe-explorer-exe-on-win10/