Skip go content

powershell.exe

Application ProcessMicrosoft Corporation

Catalog search terms powershell, windows powershell

WindowsApplication

Windows PowerShell 5.1. pwsh.exe na PowerShell 7. Di two of dem fit dey present. Di console window na conhost.exe most times.

Wetin you need know

Dis na Windows PowerShell 5.1. Di script wey dey di command line na di risk, no bi di host name.

powershell.exe na Windows PowerShell. pwsh.exe na di newer PowerShell. conhost.exe dey draw di window. Hidden powershell.exe wey come from word macro na command-line mata.

E safe?
Check the running file path, signature, and publisher. Name alone no fit confirm say e safe.
E dey same as pwsh?
No. pwsh na PowerShell 7
Wetin make conhost dey dia?
Dat one na di console window
Feex tok say
I no dey ever call powershell.exe malware just sake of say e dey run. I dey read di command line. Signed host wey dey launch Temp script na di problem.

Wetin bi powershell.exe?

powershell.exe na Windows PowerShell 5.1, wey follow Windows come. E no bi pwsh.exe, wey you dey install as PowerShell 7 from Microsoft.

Wetin e dey do?

E dey run scripts and cmdlets. Execution policy fit block local scripts wey no get sign. Bypass for command line na red flag if no bi you type am.

Wetin make am dey run?

You open prompt, scheduled task, or installer launch script. Fileless malware still dey use dis host. Path plus command line dey decide di tori.

Inspect the running instance

Inside Windows PowerShell, this read-only query show matching process IDs, creation times and executable paths on this PC. (pcm)

Get-CimInstance -ClassName Win32_Process | Where-Object { $_.Name -eq 'powershell.exe' } | Select-Object ProcessId, ParentProcessId, CreationDate, Name, ExecutablePath | Format-List

No result or a path we no fit access is inconclusive. Protected processes fit restrict access, and process IDs fit be reused. Keep personal paths local. (pcm)

Use the file-identity guide to compare signatures and product metadata. A filename alone no fit establish safety. (pcm)

E dey safe?

Host legit. Na di script bi di question

System32 or SysWOW64 powershell.exe na di Windows host. Safety depend on di parent process and di -Command / -EncodedCommand line. Verdict wey dey look filename only dey fail here.

Compare the recorded location with the actual file. A familiar folder alone no fit establish identity. (pcm)

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

  • PowerShell 7 na pwsh.exe
  • 32-bit host dey live under SysWOW64
  • Always read di arguments

I fit end am?

E dey stop that script

To end powershell.exe go kill dat session. If task restart am, find di task. To end conhost.exe only dey commot di window.

I fit comot am?

No

No delete powershell.exe. Restrict script execution with policy if na locked-down PC bi dis. Windows servicing dey expect di host.

E suppose start with Windows?

Startup PowerShell with hidden window na persistence check. Interactive shortcut wey you create dey fine.

Measure resource use

Measure the current process rather than assume a universal baseline
CPU and memory Compare several observations for the same PID and workload. This entry get no independently measured universal baseline. (pcm)
Disk and network Attribute activity to the actual process and current task; a filename alone no fit establish expected destinations or transfer volume. (pcm)

File information

powershell.exe file information
Executable name powershell.exe
Recorded installation path C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Publisher Microsoft Corporation
Signature check Inspect the actual file; this entry no dey certify its certificate identity. (pcm)

Common wahala dem

EncodedCommand for logon

Copy di line make you decode am for safe editor. Na dat one bi di payload, no bi "PowerShell na virus".

Dey confuse am with cmd

Batch files na cmd.exe. PowerShell profiles na different startup file.

How to troubleshoot

Diagnose before you change anything wey fit scatter things.

Check parent PID

winword wey dey launch powershell na Office macro mata. explorer wey launch am after you click shortcut na you.

No disable PowerShell just to stop one script

Commot di task or di document. Di host na tool.

Technical details

Technical details
powershell.exe technical details
Image name powershell.exe
Sibling pwsh.exe (PowerShell 7)

Check the identity of running file

A filename alone no fit establish safety. Verify the actual path, signature and product identity. (pcm)

Sources and verification

Recorded source label: August 2026. Dis label no establish independent verification. How we dey do research.

Dis article make sense to you?

Yes or no dey enough. Choose reason if you want, or add short note.

Dis article make sense to you?