Skip to content

cmd.exe

Application ProcessMicrosoft Corporation

Also called cmd, command prompt, command.com

WindowsApplication

Windows Command Prompt. It runs batch files and built-in commands. The window is usually conhost.exe. It is not PowerShell.

What you need to know

This is Command Prompt. PowerShell is a different host. conhost.exe is the window.

cmd.exe interprets batch and built-in commands. A flashing cmd at logon is a script, often from Startup or a vendor installer. powershell.exe is not this file.

Safe?
The host is. The .bat may not be
Same as powershell?
No
Why conhost?
That is the console window
Feex says
If cmd.exe opens and closes at sign-in, I would look at the Startup folder and Task Scheduler for a .bat. Ending cmd once will not remove the trigger.

What is cmd.exe?

cmd.exe is the Windows command interpreter. command.com is the 16-bit ancestor and is not what current Task Manager shows.

What does it do?

It runs .bat and .cmd files, builtin commands, and other exes. The visual window is conhost.exe on current Windows.

Why is it running?

You opened Command Prompt, a script ran, or an installer used a batch step. A hidden cmd.exe with /c and a download URL is a command-line investigation.

Is it safe?

Host is legitimate. Command line is the question

System32\cmd.exe is Windows. Safety is the parent and the /c argument. Filename mills that mark every cmd.exe as risk are not helping.

A legitimate copy normally runs from:

C:\Windows\System32\cmd.exe

  • SysWOW64 has a 32-bit cmd
  • Window host: conhost.exe
  • Not powershell.exe

Can I end it?

Stops that batch

Ending cmd.exe stops the interpreter. If a task or a shortcut restarts it, find that trigger.

Can I remove it?

No

Do not delete cmd.exe. Windows and installers still call it. Restrict scripts by removing the shortcut, not the interpreter.

Should it start with Windows?

A Startup .bat is the usual auto cmd. Autoruns can show it. cmd itself is not a service.

Normal resource behavior

These are contextual labels, not universal averages.

CPU
Follows the command
Memory
Small
Disk
Follows the command
Network
Only if the command uses it

File information

cmd.exe file information
Executable name cmd.exe
Common legitimate path C:\Windows\System32\cmd.exe
Publisher Microsoft Corporation
Signature expectation Signed by Microsoft Windows

Common problems

Flash at logon

Enable a pause in the batch or use Autoruns. Killing cmd after the flash does nothing to the shortcut.

People confuse it with PowerShell ISE

Different host, different profile, different policy.

Troubleshooting

Diagnose before you change anything destructive.

Read the full command line

Task Manager Details. /c plus a Temp path is the payload.

Do not replace cmd.exe from a "fix"

System file replacements are a malware pattern.

Technical details

Technical details
cmd.exe technical details
Image name cmd.exe
Window host conhost.exe

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Was this article useful?