# powershell.exe

Application Process: Microsoft Corporation

Also called powershell, windows powershell

Windows, Application

Windows PowerShell 5.1. pwsh.exe is PowerShell 7. They can both be present. The console window is often conhost.exe.

## What you need to know

This is Windows PowerShell 5.1. The script on the command line is the risk, not the host name.

powershell.exe is Windows PowerShell. pwsh.exe is the newer PowerShell. conhost.exe draws the window. A hidden powershell.exe from a word macro is a command-line story.

- **Safe?**: The host is. The script may not be

  **Same as pwsh?**: No. pwsh is PowerShell 7

  **Why is conhost there?**: That is the console window

Feex says

I never call powershell.exe malware because it is running. I read the command line. A signed host launching a Temp script is the problem.

## What is powershell.exe?

powershell.exe is Windows PowerShell 5.1, shipped with Windows. It is not pwsh.exe, which you install as PowerShell 7 from Microsoft.

## What does it do?

It runs scripts and cmdlets. Execution policy can block unsigned local scripts. A bypass on the command line is a red flag if you did not type it.

## Why is it running?

You opened a prompt, a scheduled task, or an installer launched a script. Fileless malware also uses this host. Path plus command line decide the story.

## Is it safe?

Host is legitimate. Script is the question

System32 or SysWOW64 powershell.exe is the Windows host. Safety is the parent process and the -Command / -EncodedCommand line. Filename-only verdicts fail here.

A legitimate copy normally runs from:

`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe`

- PowerShell 7 is pwsh.exe
- 32-bit host lives under SysWOW64
- Always read the arguments

## Can I end it?

Stops that script

Ending powershell.exe kills that session. If a task restarts it, find the task. Ending conhost.exe only drops the window.

## Can I remove it?

No

Do not delete powershell.exe. Restrict script execution with policy if this is a locked-down PC. Windows servicing expects the host.

## Should it start with Windows?

A Startup PowerShell with a hidden window is a persistence check. An interactive shortcut you created is fine.

## Normal resource behavior

These are contextual labels, not universal averages.

- **CPU**: Follows the script

  **Memory**: Can grow on large object pipelines

  **Disk**: Follows the script

  **Network**: Follows the script

## File information

| Executable name        | powershell.exe                                            |
| ---------------------- | --------------------------------------------------------- |
| Common legitimate path | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| Publisher              | Microsoft Corporation                                     |
| Signature expectation  | Signed by Microsoft Windows                               |

## Common problems

### EncodedCommand at logon

Copy the line and decode it in a safe editor. That is the payload, not "PowerShell is a virus".

### Confused with cmd

Batch files are cmd.exe. PowerShell profiles are a different startup file.

## Troubleshooting

Diagnose before you change anything destructive.

### Inspect parent PID

winword launching powershell is an Office macro story. explorer launching it after you clicked a shortcut is you.

### Do not disable PowerShell to stop one script

Remove the task or the document. The host is a tool.

## Technical details

Technical details

| Image name | powershell.exe          |
| ---------- | ----------------------- |
| Sibling    | pwsh.exe (PowerShell 7) |

## Related

These entities connect to this article. Type is shown on every link.

[Windows PowerShell: Application](https://feex.it/wiki/software/windows-powershell)[cmd.exe: Application Process](https://feex.it/wiki/process/cmd.exe)[conhost.exe: Windows Process](https://feex.it/wiki/process/conhost.exe)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: PowerShell ](https://learn.microsoft.com/powershell/scripting/overview)· Windows PowerShell and pwsh
- [Microsoft Learn: conhost ](https://learn.microsoft.com/windows/console/console-host)· Console window host
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark.

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Type**: Application Process

  **Publisher**: Microsoft Corporation

  **Executable**: powershell.exe

  **Parent app**: [Windows PowerShell](https://feex.it/wiki/software/windows-powershell)

  **Mapped by Feex**: Seen on Windows PCs in Foxhole

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/process/powershell.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)