The Windows Process Journey — conhost.exe (Console Window Host)

“conhost.exe” is an executable aka the “Console Window Host”, which is located at “%windir%\System32\conhost.exe”. The goal of “conhost.exe” is to provide an interface between “cmd.exe” (https://medium.com/@boutnaru/the-windows-process-journey-cmd-exe-windows-command-processor-501be17ba81b) and “explorer.exe” (ahttps://medium.com/@boutnaru/the-windows-process-journey-explorer-exe-windows-explorer-9a96bc79e183).

Thus, “conhost.exe” is both the server application (for Windows Console API) and also the classic Windows user interface for working with CLI (command line interface) application. Historically, those were the job of “csrss.exe” (https://medium.com/@boutnaru/the-windows-process-journey-csrss-exe-client-server-runtime-subsystem-cb5fa34c47db) but they were extracted for isolation and security reasons (https://learn.microsoft.com/en-us/windows/console/definitions).

Moreover, one of the duties of “conhost.exe” is to provide the ability to “drag and drop” folders/files into “cmd.exe”. By the way, every 3rd party application can use “conhost.exe” (https://www.lifewire.com/conhost-exe-4158039). When “conhost.exe” is started with the permissions of the user which “cmd.exe” was started with.

Lastly, we can have multiple instances of “conhost.exe”. For each instance of “cmd.exe” (which is not a descendant of another “cmd.exe”) there will be an instance of “conhost.exe”. Also, in case of a 64-bit system even if a 32-bit “cmd.exe” an instance of a 64-bit “conhost.exe” is going to be started. A demonstration of those points is shown in the screenshot below (taken using “Process Explorer”).

See you next time ;-) You can also follow me on twitter — @boutnaru (https://twitter.com/boutnaru).