# cmd.exe

Application Process: Microsoft Corporation

Also called cmd, command prompt, command.com

Windows, Application

Windows Command Prompt. It runs batch files and built-in commands. The window is usually conhost.exe. It is not PowerShell.

## What you need to know

This is Command Prompt. PowerShell is a different host. conhost.exe is the window.

cmd.exe interprets batch and built-in commands. A flashing cmd at logon is a script, often from Startup or a vendor installer. powershell.exe is not this file.

- **Safe?**: The host is. The .bat may not be

  **Same as powershell?**: No

  **Why conhost?**: That is the console window

Feex says

If cmd.exe opens and closes at sign-in, I would look at the Startup folder and Task Scheduler for a .bat. Ending cmd once will not remove the trigger.

## What is cmd.exe?

cmd.exe is the Windows command interpreter. command.com is the 16-bit ancestor and is not what current Task Manager shows.

## What does it do?

It runs .bat and .cmd files, builtin commands, and other exes. The visual window is conhost.exe on current Windows.

## Why is it running?

You opened Command Prompt, a script ran, or an installer used a batch step. A hidden cmd.exe with /c and a download URL is a command-line investigation.

## Is it safe?

Host is legitimate. Command line is the question

System32\cmd.exe is Windows. Safety is the parent and the /c argument. Filename mills that mark every cmd.exe as risk are not helping.

A legitimate copy normally runs from:

`C:\Windows\System32\cmd.exe`

- SysWOW64 has a 32-bit cmd
- Window host: conhost.exe
- Not powershell.exe

## Can I end it?

Stops that batch

Ending cmd.exe stops the interpreter. If a task or a shortcut restarts it, find that trigger.

## Can I remove it?

No

Do not delete cmd.exe. Windows and installers still call it. Restrict scripts by removing the shortcut, not the interpreter.

## Should it start with Windows?

A Startup .bat is the usual auto cmd. Autoruns can show it. cmd itself is not a service.

## Normal resource behavior

These are contextual labels, not universal averages.

- **CPU**: Follows the command

  **Memory**: Small

  **Disk**: Follows the command

  **Network**: Only if the command uses it

## File information

| Executable name        | cmd.exe                     |
| ---------------------- | --------------------------- |
| Common legitimate path | C:\Windows\System32\cmd.exe |
| Publisher              | Microsoft Corporation       |
| Signature expectation  | Signed by Microsoft Windows |

## Common problems

### Flash at logon

Enable a pause in the batch or use Autoruns. Killing cmd after the flash does nothing to the shortcut.

### People confuse it with PowerShell ISE

Different host, different profile, different policy.

## Troubleshooting

Diagnose before you change anything destructive.

### Read the full command line

Task Manager Details. /c plus a Temp path is the payload.

### Do not replace cmd.exe from a "fix"

System file replacements are a malware pattern.

## Technical details

Technical details

| Image name  | cmd.exe     |
| ----------- | ----------- |
| Window host | conhost.exe |

## Related

These entities connect to this article. Type is shown on every link.

[powershell.exe: Application Process](https://feex.it/wiki/process/powershell.exe)[conhost.exe: Windows Process](https://feex.it/wiki/process/conhost.exe)[Windows PowerShell: Application](https://feex.it/wiki/software/windows-powershell)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: cmd ](https://learn.microsoft.com/windows-server/administration/windows-commands/cmd)· Command Prompt
- [Microsoft Learn: console ](https://learn.microsoft.com/windows/console/console-host)· conhost relationship
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark.

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Type**: Application Process

  **Publisher**: Microsoft Corporation

  **Executable**: cmd.exe

  **Typical path**: C:\Windows\System32\cmd.exe

  **Mapped by Feex**: Seen on Windows PCs in Foxhole

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/process/cmd.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)