Windows file
conhost.exe (Console Window Host): genuine Windows file, or a copy using its name?
conhost.exe is the Console Window Host, the Windows program that runs the Command Prompt window and other console programs. One copy per console program is normal. The file in System32 is safe. A copy elsewhere, or one using a lot of CPU, needs checking.
Prefer to check it yourself? The manual checks follow.
conhost.exe in C:\Windows\System32, signed by Microsoft, is safe. Several copies at once are normal, because each console program gets its own. Do not delete it or end it while a console program is working.
Its name has been used by a crypto-miner, called Conhost Miner by security researchers. The name proves nothing: check the folder, the signature and how much CPU it uses.
- Task Manager name
- Console Window Host (conhost.exe)
- Description in the file
- Console Window Host
- Genuine folder
- C:\Windows\System32\conhost.exe
- Signed by
- Microsoft (110 Microsoft builds are known, signed and unsigned entries in Microsoft's own index)
- Started by
- Windows, when a console program such as cmd.exe starts
- Windows releases
- Windows 10 1507 to Windows 11 26H1
- Several copies
- Normal; one per console program
What Console Window Host does
conhost.exe is the server for the Windows console programming interface and, historically, the window in which console programs such as Command Prompt (cmd.exe) show their text. Microsoft Learn describes it as both the API server for all Windows Console APIs and the classic user interface for command-line applications. Programs started by third parties that use a command line, such as Nvidia's WebHelper.exe or Plex's PlexScriptHost.exe, get their own copy too.
Its code belonged to csrss.exe, the Client Server Runtime Subsystem, in Windows XP and earlier. Microsoft split it out for security and isolation. Besides the reliability gain, a crash of the console no longer endangers the critical csrss.exe process, and the console window can use the visual style of the current Windows. Windows 7 introduced the arrangement in which conhost.exe sits between csrss.exe and the console program, which lets it draw the scroll bars correctly, and Windows 10 and 11 still use it.
Microsoft's documentation says conhost.exe will keep servicing console API calls while the window itself can be handed to a terminal such as Windows Terminal through a pseudoconsole. So a copy of conhost.exe may run even when you see another terminal window. The file also supports dragging files and folders into the Command Prompt window to paste their path.
About .exe files. An .exe file is a program. It runs as a process you can see in Task Manager, so its name, folder and publisher are what to check.
How to check a conhost.exe
Three checks need nothing installed.
- Where the file is. In Task Manager, Details tab, right-click conhost.exe and choose Open file location. The genuine file is in C:\Windows\System32 and nowhere else. A copy in a user folder, AppData, Temp or ProgramData is not Windows.
- Who signed it and which program started it. The signer must be Microsoft Windows and the status Valid. A genuine copy belongs to a console program, so you can name the program that started it. The command prints the path and parent process of every copy:
Get-CimInstance Win32_Process -Filter "Name='conhost.exe'" | Select-Object ProcessId, ParentProcessId, ExecutablePath, CommandLine | Format-List - What the copy is doing. Genuine copies use almost no CPU while their program is idle. Note the parent process of a busy copy and look at the parent in Process Explorer from Microsoft Sysinternals: it is a portable program, download and run it, no install needed.
- Compare the file with Microsoft's builds. Use the checker on this page: it computes the SHA-256 in your browser and compares it with the known Microsoft builds.
These checks show whether the file is the Windows one. They cannot show that code was not injected into a genuine running copy; for that run Microsoft Defender's full scan and, if the signs below apply, the offline scan.
Check your conhost.exe
Choose the conhost.exe you are unsure about. Its SHA-256 checksum is calculated in your browser and compared with the 110 Microsoft builds indexed from Windows releases and updates.
The file stays on your computer. Nothing is uploaded: the checksum is computed locally.
Warning signs and what they mean
| What you see | What it means |
|---|---|
| conhost.exe outside C:\Windows\System32 | Not the Windows file. A program is borrowing the name; the original executable of the Conhost Miner malware ran a separate copy that looked legitimate unless the folder was checked. |
| Signature missing, invalid or not Microsoft's | The file was replaced or is not from Microsoft. |
| Several copies, each with high CPU, and a slow PC with fans running | The typical effect of a crypto-miner: it uses your processor to calculate cryptocurrency for someone else. If the copies belong to a console program you recognise, see the problems section first. |
| Programs crashing, video stuttering, general slowness together with the signs above | Reported effects of the Conhost Miner; not proof by itself, many ordinary faults look the same. |
| A copy started by something that has no console, such as a service or the system itself | Elastic's detection rule treats conhost.exe started by processes such as lsass.exe, services.exe or winlogon.exe as a sign of code injection or a fake copy. |
Everyday problems with conhost.exe
Why are several conhost.exe running?
That is normal. Each Command Prompt window creates its own copy, and so does every third-party program that uses a command line, such as Nvidia's WebHelper.exe or Plex's PlexScriptHost.exe.
Each copy ends when its console program ends.
How much memory and CPU should it use?
A few megabytes of memory; the old page gave under 10 MB as a rule of thumb, and heavy console output raises it. CPU use is close to zero unless the program it serves is printing a lot of text.
If a copy uses much more, find the program behind it before anything else.
How do I find which program is behind a busy copy?
Download Process Explorer from Microsoft, run it (no installation) and look at the parent of the conhost.exe entry. The parent is the program that needs the console, and it is usually the one to fix or remove.
High CPU or memory does not by itself mean malware: a faulty program or a script in a loop produces the same.
What does conhost.exe 0xffffffff -ForceV1 mean?
It is the command line that Task Manager shows for a conhost.exe that Windows started for a console program. Microsoft's console documentation describes a newer console and a legacy console and the ForceV2 setting that chooses between them, but it does not list the switches of conhost.exe, so we cannot quote Microsoft on -ForceV1 itself.
What matters for safety is the file, not the arguments. The conhost.exe in C:\Windows\System32 that carries a Microsoft signature is genuine whatever arguments it shows. A copy in another folder is the case to check.
conhost.exe versions by Windows release
The newest build indexed for each release, and the update that delivered it. 110 Microsoft builds in total are known.
| Windows release | File version | Delivered by | Size, 64-bit |
|---|---|---|---|
| Windows 11 26H1 | 10.0.28000.2952 | KB5124006, Sep 22, 2026 | 1,007,616 bytes |
| Windows 11 25H2 | 10.0.26100.5074 | original release | 1,007,616 bytes |
| Windows 11 24H2 | 10.0.26100.9549 | KB5124010, Sep 22, 2026 | 1,003,520 bytes |
| Windows 11 23H2 | 10.0.22621.5415 | KB5129242, Sep 14, 2026 | 1,044,480 bytes |
| Windows 11 22H2 | 10.0.22621.5415 | KB5066793, Oct 14, 2025 | 1,044,480 bytes |
| Windows 11 21H2 | 10.0.22000.2600 | KB5044280, Oct 8, 2024 | 1,028,096 bytes |
| Windows 10 22H2 | 10.0.19041.5198 | KB5066198, Sep 25, 2025 | 867,840 bytes |
| Windows 10 21H2 | 10.0.19041.7663 | KB5129236, Sep 14, 2026 | 867,840 bytes |
| Windows 10 21H1 | 10.0.19041.746 | original release | 843,264 bytes |
| Windows 10 20H2 | 10.0.19041.2546 | KB5026361, May 9, 2023 | 867,840 bytes |
Questions people ask
Is conhost.exe a virus?
No, the file in C:\Windows\System32 is a genuine Windows component, signed by Microsoft. Malware can use the name, though. A copy in another folder, without a Microsoft signature, or one that keeps the processor busy for a long time with no console program behind it is worth a scan. Use the file checker on this page to compare the SHA-256 with Microsoft's builds.
What is the Conhost Miner?
Security researchers gave that name to a crypto-mining tool that used a process named conhost.exe. Crypto-miners use the victim's hardware for complex calculations to earn cryptocurrency for criminals. Mining software is not illegal in itself, but without consent it is malicious. The file the miner runs looks like conhost.exe and is only recognised by its folder, which is not System32.
How does a crypto-miner get onto a PC?
Typically as a trojan hidden in a file that looks harmless. The old report named spam email attachments, fake updates and pirated or repacked software. Phishing emails are sent in thousands by bots and often pretend to be from a known organisation such as Amazon or the tax office. Ask whether you expected the message, check the From address, look for spelling mistakes and generic greetings.
How long can a miner run before it is noticed?
Weeks or even months, because many users blame the slowness on an ageing computer. In that time more malicious software can be installed. A scan can therefore find other infections as well as the miner, and the PC may be more exposed to further malware until it is cleaned.
Can I delete or disable conhost.exe?
No, do not delete the genuine file or end its processes while a console program is working, because that program loses its window. Windows manages the file and replaces it with updates. If a copy in another folder is malware, remove that copy by scanning, not the System32 file.
How do I remove a fake conhost.exe?
Run Microsoft Defender's full scan from Windows Security under Virus & threat protection, then the Microsoft Defender Offline scan, which restarts the PC and scans before Windows loads. Do not rely on manual deletion alone, because miners can change other parts of Windows to start again. Scan first, before acting on high CPU use that may come from a faulty program.
Why does it use high CPU?
Most often the program behind the copy is printing a lot of text or is stuck in a loop. Find the parent in Process Explorer first. If the copy is not in System32, is unsigned, and the PC is slow with fans running, treat it as a miner and run the scans described above.
Sources
- Microsoft Learn: Windows Console and Terminal definitions
- MITRE ATT&CK: Masquerading, match legitimate name or location (T1036.005)
- Elastic: Conhost spawned by suspicious parent process
- Microsoft Learn: Changes to the Windows Console in Windows Server
- Winbindex, the Windows binaries index (m417z)
Version data read on Oct 5, 2026.
Questions and experiences
Ask about this page: members and our editors answer. Reading is open; writing needs a free account.
…