powershell.exe

Application ProcessMicrosoft Corporation

Also called powershell, windows powershell

WindowsApplication

Windows PowerShell 5.1. pwsh.exe is PowerShell 7. They can both be present. The console window is often conhost.exe.

What you need to know

This is Windows PowerShell 5.1. The script on the command line is the risk, not the host name.

powershell.exe is Windows PowerShell. pwsh.exe is the newer PowerShell. conhost.exe draws the window. A hidden powershell.exe from a word macro is a command-line story.

Safe?: The host is. The script may not be
Same as pwsh?: No. pwsh is PowerShell 7
Why is conhost there?: That is the console window

Feex says

I never call powershell.exe malware because it is running. I read the command line. A signed host launching a Temp script is the problem.

What is powershell.exe?

powershell.exe is Windows PowerShell 5.1, shipped with Windows. It is not pwsh.exe, which you install as PowerShell 7 from Microsoft.

What does it do?

It runs scripts and cmdlets. Execution policy can block unsigned local scripts. A bypass on the command line is a red flag if you did not type it.

Why is it running?

You opened a prompt, a scheduled task, or an installer launched a script. Fileless malware also uses this host. Path plus command line decide the story.

Is it safe?

Host is legitimate. Script is the question

System32 or SysWOW64 powershell.exe is the Windows host. Safety is the parent process and the -Command / -EncodedCommand line. Filename-only verdicts fail here.

A legitimate copy normally runs from:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

PowerShell 7 is pwsh.exe
32-bit host lives under SysWOW64
Always read the arguments

Can I end it?

Stops that script

Ending powershell.exe kills that session. If a task restarts it, find the task. Ending conhost.exe only drops the window.

Can I remove it?

Do not delete powershell.exe. Restrict script execution with policy if this is a locked-down PC. Windows servicing expects the host.

Should it start with Windows?

A Startup PowerShell with a hidden window is a persistence check. An interactive shortcut you created is fine.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: Follows the script
Memory: Can grow on large object pipelines
Disk: Follows the script
Network: Follows the script

File information

powershell.exe file information
Executable name	powershell.exe
Common legitimate path	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

EncodedCommand at logon

Copy the line and decode it in a safe editor. That is the payload, not "PowerShell is a virus".

Confused with cmd

Batch files are cmd.exe. PowerShell profiles are a different startup file.

Troubleshooting

Diagnose before you change anything destructive.

Inspect parent PID

winword launching powershell is an Office macro story. explorer launching it after you clicked a shortcut is you.

Do not disable PowerShell to stop one script

Remove the task or the document. The host is a tool.

Technical details

powershell.exe technical details
Image name	powershell.exe
Sibling	pwsh.exe (PowerShell 7)

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: PowerShell · Windows PowerShell and pwsh
Microsoft Learn: conhost · Console window host
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.