The ExplorerFactory class is exposed by ExplorerFrame.dll through its DllGetClassObject function. Instances are creatable, using such well-documented COM functions as CoCreateInstance, by anyone who knows the CLSID:

CLSID_ExplorerFactory {78428474-473B-4660-9068-F2AA7F6CB227}

The class implements only one interface: IExplorerFactory. The implementation for ExplorerFactory is in a sense an in-process wrapper around a choice of ExplorerFactoryServer implementations in one or another EXPLORER.EXE process.