windows update replaced conhost.exe but the file is not included in the update binary

We‘re performing file security analysis based on the source (where files are coming from).

A Windows 10 update installs a new conhost.exe but we cannot find out where the file is coming from. It doesn't seem to be in the .cab file of the update.

This is what we did:

1. install windows 10 1809 v2 (c:\windows\system32\conhost.exe md5 is 4c41666923a14dc687deee3b143afb55)
2. let Windows install update kb4501835 (windows10.0-kb4501835-x64_a8a91185c1cf9b9fefa6e9e07fc3d74c45fb2fee)
3. After finishing the installation of this update and rebooting, c:\windows\system32\conhost.exe md5 hash is c221707e5ce93515ac87507e19181e2a

Where‘s that conhost.exe coming from?
Windows 10 update history just says that it installed the Update kb4501835. So we manually downloaded kb4501835-x64 from here, expanded it to a temp dir, expanded the resulting file Windows10.0-KB4501835-x64_PSFX.cab to another temp dir. (commands used: c:\Windows\System32\expand.exe -R %FILE% -F:* 1\)

In this tmp directory, we found two conhost.exe with md5 d810493b38380e30855f1e9e7d395000 andebf996ce7169609d9b892b5a79297611

So neither of the two conhost.exes in the kb4501835-x64 has the md5 c221707e5ce93515ac87507e19181e2a

Question:
Where is that new conhost.exe coming from if it‘s not in the update .CAB? We can verify the .cat based signature with signtool, so yes, it‘s apparently from Microsoft and signed and everything is alright, but we need to know the origin of files that are replaced on disk.

Any hint?