conhost.exe

by Microsoft

Operating System

Summary

Console Window Host (conhost.exe) provides the windowing and input infrastructure for console applications. Every process that opens a console (cmd.exe, powershell.exe, or any console application) gets a corresponding conhost.exe instance. It manages the console window, text rendering, and input buffer.

conhost.exe is the 1st most commonly executed Windows program in EchoTrail's dataset, observed 63,659,763 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by cmd.exe.

1st

most commonly executed Windows program

63,659,763

observed executions

high

statistical confidence

Behavior

Top Paths

C:\Windows\System32100%

Top Hashes (SHA256)

4668bb2223ffb983a5f1273b9e3d9fa2c5ce4a0f1fb18ca5c1b285762020073c34.36%
f30686dd09b81d4080ab58def209173772fa132fa3762688274270afa640787220.27%
6651ab6c5c6d85c86b0c6c532115662e09f338fa8cc1233e1434139346f25ef69.12%
1e1c6a5a22ab34375811740e6fd0918f475c1395960e48972059977ddec75f3b7.34%
6bd1f5ab9250206ab3836529299055e272ecaa35a72cbd0230cb20ff1cc309024.56%
046f7a1b4de67562547ed9a180a72f481fc41e803de49a96d7d7c731964d53a03.73%
a26a1ffb81a61281ffa55cb7778cc3fb0ff981704de49f75f51f18b283fba7a22.82%
baf97b2a629723947539cff84e896cd29565ab4bb68b0cec515eb5c5d6637b692.68%
04b6a35bc504401989b9e674c57c9e84d0cbdbbd9d8ce0ce83d7ceca0b7175ed2.25%
3c1c6d813d2b031d988204155fc198fe4f32ff56c05dabbcfcd5486131f4fb9d2.19%

Process Ancestry

Top Grandparents

Top Parents

Top Children

Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.

Security Analysis

What does conhost.exe normally do?

Located exclusively in C:\Windows\System32. Launched by any process that creates a console — most commonly cmd.exe, powershell.exe, quser.exe, netsh.exe, and management agents. Very high execution count is expected because every console application invocation spawns a conhost.exe. Should almost never have meaningful child processes.

When is conhost.exe suspicious?

Running from any path other than C:\Windows\System32. Having child processes other than WerFault.exe. Being the parent of shells, network tools, or reconnaissance commands (this would indicate injection or masquerading). Name misspellings (c0nhost.exe, conhosts.exe).

How do attackers abuse conhost.exe?

Name masquerading: malware uses names like conhosts.exe or c0nhost.exe. Path masquerading: legitimate filename placed outside System32. Process injection: because conhost.exe is ubiquitous and trusted, attackers may inject into it to inherit its trusted status. However, direct abuse of conhost.exe is relatively uncommon compared to other OS processes.

Detection guidance

conhost.exe running from any path other than System32 is a high-confidence indicator. conhost.exe spawning child processes (other than WerFault.exe) is unusual and worth investigating. Given its very high execution volume, conhost.exe detections should focus on path and child process anomalies rather than parent process analysis.

False positive notes

Extremely high volume — tens of millions of executions is normal. Every console command spawns one. Do not alert on conhost.exe execution count or frequency. The memory space of conhost.exe can contain command-line history of its parent console process, which can be useful in forensic analysis.

Related Processes

cmd.exe powershell.exe

Ask Rocky about conhost.exe

Rocky answers questions about conhost.exe grounded in this same dataset — free, no account needed.

Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.

Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.