Versions

6.3.9600.16384 (winblue_rtm.130821-1623)	1.53%
6.3.9600.16384 (winblue_rtm.130821-1623)	5.89%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.08%
6.2.9200.16384 (win8_rtm.120725-1247)	2.42%
6.2.9200.16384 (win8_rtm.120725-1247)	12.58%
6.2.9200.16384 (win8_rtm.120725-1247)	12.74%
6.2.9200.16384 (win8_rtm.120725-1247)	0.48%
6.2.8102.0 (winmain_win8m3.110823-1455)	0.16%
6.1.7600.16385 (win7_rtm.090713-1255)	4.11%
6.1.7600.16385 (win7_rtm.090713-1255)	2.10%
6.1.7600.16385 (win7_rtm.090713-1255)	4.60%
6.1.7600.16385 (win7_rtm.090713-1255)	2.02%
6.1.7600.16385 (win7_rtm.090713-1255)	2.34%
6.1.7600.16385 (win7_rtm.090713-1255)	0.32%
6.1.7600.16385 (win7_rtm.090713-1255)	4.84%
6.1.7600.16385 (win7_rtm.090713-1255)	0.16%
6.1.7600.16385 (win7_rtm.090713-1255)	0.48%
6.1.7600.16385 (win7_rtm.090713-1255)	2.26%
6.1.7600.16385 (win7_rtm.090713-1255)	0.65%
6.1.7600.16385 (win7_rtm.090713-1255)	0.89%
6.1.7600.16385 (win7_rtm.090713-1255)	2.10%
6.1.7600.16385 (win7_rtm.090713-1255)	23.15%
6.1.7600.16385 (win7_rtm.090713-1255)	0.65%
6.1.7600.16385 (win7_rtm.090713-1255)	1.45%
6.1.7600.16385 (win7_rtm.090713-1255)	2.34%
6.1.7600.16385 (win7_rtm.090713-1255)	0.08%
6.1.7600.16385 (win7_rtm.090713-1255)	0.81%
6.1.7600.16385 (win7_rtm.090713-1255)	8.79%

This is a Windows system installed file with Windows File Protection (WFP) enabled.

There are 28 versions of conhost.exe in the wild, the latest version being 6.3.9600.16384 (winblue_rtm.130821-1623). conhost.exe is run as a standard windows process with the logged in user's account privileges. The average file size is about 306.8 KB. During the process's lifecycle, the typical CPU resource utilization is about 0.0012% including both foreground and background operations, the average private memory consumption is about 1000.67 KB with the maximum memory reaching around 3.03 MB. Addionally, typically read and write I/O disk operations is about 33 Bytes per minute for reads and 34 Bytes per minute for writes.

conhost.exe is the new host process for console windows. Previously those were handled by csrss.exe which is the “Client Server Runtime Process”, a process running with system-level privileges. Starting with Windows Vista, Microsoft made some very substantial improvements and changes in regard to security. One of those changes was that applications running in different “levels” or as different users weren't allowed to exchange data freely.