Should I block it?

No, this file is 100% safe to run.

Additional versions

6.3.9600.17031 (winblue_gdr.140221-1952)	14.44%
6.3.9600.16384 (winblue_rtm.130821-1623)	9.17%
6.3.9600.16384 (winblue_rtm.130821-1623)	0.28%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.83%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.28%
6.2.9200.16384 (win8_rtm.120725-1247)	66.67%
6.2.9200.16384 (win8_rtm.120725-1247)	7.78%
6.2.8400.0 (winmain_win8rc.120518-1423)	0.28%
6.2.8400.0 (winmain_win8rc.120518-1423)	0.28%

Relationships

Parent process

svchost.exe (Host Process for Windows Services by Microsoft Corporation)

Related files

das.dll (Device Association Service by Microsoft)

PE file structure

Show functions

Import table

advapi32.dll

ConvertStringSecurityDescriptorToSecurityDescriptorW, TraceMessage, GetTraceLoggerHandle, GetTraceEnableLevel, GetTraceEnableFlags, RegisterTraceGuidsW, UnregisterTraceGuids, RegGetValueW, RegOpenKeyExW, DuplicateToken, EventWrite, SetThreadToken, ConvertSecurityDescriptorToStringSecurityDescriptorW, RegCloseKey

api-ms-win-core-errorhandling-l1-1-1.dll

GetLastError, SetUnhandledExceptionFilter, UnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0.dll

DuplicateHandle, CloseHandle

api-ms-win-core-heap-l1-2-0.dll

HeapFree, HeapAlloc, GetProcessHeap

api-ms-win-core-heap-obsolete-l1-1-0.dll

LocalFree

api-ms-win-core-libraryloader-l1-1-1.dll

GetModuleHandleA, FreeLibrary, LoadLibraryExW, GetProcAddress

api-ms-win-core-libraryloader-l1-2-0.dll

GetModuleHandleA, FreeLibrary, LoadLibraryExW, GetProcAddress

api-ms-win-core-processthreads-l1-1-2.dll

OpenProcess, GetCurrentProcess, TerminateProcess, GetCurrentProcessId, GetCurrentThreadId, SetThreadToken

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter

api-ms-win-core-registry-l1-1-0.dll

RegGetValueW, RegCloseKey, RegOpenKeyExW

api-ms-win-core-string-l1-1-0.dll

CompareStringOrdinal

api-ms-win-core-synch-l1-2-0.dll

ResetEvent, AcquireSRWLockExclusive, EnterCriticalSection, InitializeSRWLock, LeaveCriticalSection, ReleaseSRWLockExclusive, DeleteCriticalSection, CreateEventW, AcquireSRWLockShared, ReleaseSRWLockShared, SetEvent, Sleep, WaitForSingleObject, InitializeCriticalSection

api-ms-win-core-sysinfo-l1-2-1.dll

GetSystemTimeAsFileTime, GetTickCount

api-ms-win-core-threadpool-l1-2-0.dll

SubmitThreadpoolWork, WaitForThreadpoolWaitCallbacks, WaitForThreadpoolWorkCallbacks, CloseThreadpoolWork, CreateThreadpoolWork, CloseThreadpoolWait, SetThreadpoolWait, CreateThreadpoolWait

api-ms-win-devices-query-l1-1-1.dll

DevGetObjectPropertiesEx, DevFreeObjectProperties

api-ms-win-eventing-classicprovider-l1-1-0.dll

GetTraceLoggerHandle, UnregisterTraceGuids, TraceMessage, RegisterTraceGuidsW, GetTraceEnableLevel, GetTraceEnableFlags

api-ms-win-eventing-provider-l1-1-0.dll

EventWrite

api-ms-win-security-base-l1-2-0.dll

DuplicateToken

api-ms-win-security-sddl-l1-1-0.dll

ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSecurityDescriptorToStringSecurityDescriptorW

kernel32.dll

WaitForSingleObject, CloseHandle, CloseThreadpoolWait, CreateThreadpoolWait, SetThreadpoolWait, InitializeSRWLock, AcquireSRWLockExclusive, ReleaseSRWLockExclusive, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, ResetEvent, LeaveCriticalSection, CreateThreadpoolWork, SubmitThreadpoolWork, WaitForThreadpoolWorkCallbacks, CloseThreadpoolWork, OpenProcess, DuplicateHandle, GetCurrentProcess, InterlockedIncrement, InterlockedDecrement, AcquireSRWLockShared, ReleaseSRWLockShared, HeapAlloc, WaitForThreadpoolWaitCallbacks, LocalFree, LoadLibraryExW, FreeLibrary, CompareStringOrdinal, TerminateProcess, UnhandledExceptionFilter, GetTickCount, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, GetModuleHandleA, GetProcessHeap, SetUnhandledExceptionFilter, InterlockedCompareExchange, InterlockedExchange, Sleep, HeapFree, SetEvent, CreateEventW, GetLastError, GetProcAddress

msvcrt.dll

DllMain

rpcrt4.dll

NdrMesTypeEncode2, NdrAsyncServerCall, NdrServerCall2, RpcServerUseProtseqEpW, I_RpcMapWin32Status, RpcServerRegisterIf3, RpcServerUnregisterIfEx, RpcAsyncCompleteCall, MesEncodeIncrementalHandleCreate, MesIncrementalHandleReset, RpcExceptionFilter, MesHandleFree, I_RpcBindingInqLocalClientPID, RpcImpersonateClient, RpcRevertToSelf, I_RpcExceptionFilter, UuidFromStringW, NdrMesTypeAlignSize2, RpcSsDestroyClientContext, RpcStringFreeW, RpcStringBindingComposeW, RpcBindingFromStringBindingW, RpcBindingSetOption, RpcBindingFree, NdrClientCall2

dasHost.exe

Device Association Framework Provider Host by Microsoft

Remove dasHost.exe

Version:	6.3.9600.16384 (winblue_rtm.130821-1623)
MD5:	cd95892713570725f4cbba99f07cddf2
SHA1:	576050fdf7204763cdbc211d1f1c8f70910f7be5

This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is dasHost.exe?

Device Association Framework Provider Host enables pairing between the system and wired or wireless devices. This service is new for Windows 8.

Overview

dashost.exe executes as a process with LOCAL SERVICE privileges typically within the context of its parent svchost.exe (Host Process for Windows Services by Microsoft Corporation). The assembly utilizes the .NET run-time framework (which is required to be installed on the PC). and is compiled as a 64 bit program.

Details

File name:	dashost.exe
Publisher:	Microsoft Corporation
Product name:	Device Association Framework Provider Host
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\dashost.exe
File version:	6.3.9600.16384 (winblue_rtm.130821-1623)
Product version:	6.3.9600.16384
Size:	90.5 KB (92,672 bytes)
Build date:	8/22/2013 5:49 AM
Digital DNA
File packed:	No
Code language:	Microsoft Visual C# / Basic .NET
.NET CLR:	Yes
.NET NGENed:	No

More details

Network connections

[UDP] listens on port 65099

[UDP] listens on port 52600

[UDP] listens on port 63971

[UDP] listens on port 52409

[UDP] listens on port 55059

[UDP] listens on port 54719

[UDP] listens on port 58656

[UDP] listens on port 60531

[UDP] listens on port 64222

[UDP] listens on port 50362

[UDP] listens on port 58310

[UDP] listens on port 56170

[UDP] listens on port 59845

[UDP] listens on port 53813

[UDP] listens on port 49397

[UDP] listens on port 62890

[UDP] listens on port 51996

[UDP] listens on port 63626

[UDP] listens on port 63758

[UDP] listens on port 54885

[UDP] listens on port 55977

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00095405%	0.028634%
Kernel CPU:	0.00043412%	0.013761%
User CPU:	0.00051993%	0.014873%
Kernel CPU time:	59,586 ms/min	100,923,805ms/min
CPU cycles:	216,673/sec	17,470,203/sec
Context switches:	2/sec	284/sec
Memory
Private memory:	6.77 MB	21.59 MB
Private (maximum):	14.7 MB
Private (minimum):	10.49 MB
Non-paged memory:	6.77 MB	21.59 MB
Virtual memory:	70.56 MB	140.96 MB
Virtual memory (peak):	81.51 MB	169.69 MB
Working set:	13.55 MB	18.61 MB
Working set (peak):	15.21 MB	37.95 MB
Page faults:	16,601/min	2,039/min
I/O
I/O read transfer:	10 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	7.12 KB/sec	274.99 KB/min
I/O write operations:	2/sec	227/min
I/O other transfer:	8.11 KB/sec	448.09 KB/min
I/O other operations:	37/sec	1,671/min
Resource allocations
Threads:	4	12
Handles:	347	600

Process properties

Integrety level:	System
Platform:	64-bit
Command lines:	dashost.exe {a6ab7f73-2dce-430e-9e21eb1c260d0ee1} dashost.exe {3711fd26-7eed-42ba-9d626583ee3c2fc6} dashost.exe {103ba121-3685-447c-863fe67b58cf151c} dashost.exe {89f999b9-7a2c-4a04-b417bc8759d0f38a} dashost.exe {ea890114-a38a-428f-8c83dc94537712b8} dashost.exe {19be5c23-8729-4676-8f51788ab066ae92} dashost.exe {5e2350fa-18ce-487d-bcddacf6a33aa22f} (33 more)
Owner:	LOCAL SERVICE
Parent process:	svchost.exe (Host Process for Windows Services by Microsoft Corporation)

Threads

Averages

ntdll.dll
Total CPU:	0.02556903%	0.272967%
Kernel CPU:	0.01718910%	0.107585%
User CPU:	0.00837993%	0.165382%
CPU cycles:	168,227/sec	5,741,424/sec
Memory:	1.66 MB	1.16 MB
dashost.exe (main module)
Total CPU:	0.00014538%
Kernel CPU:	0.00014223%
User CPU:	0.00000314%
CPU cycles:	1,116/sec
Memory:	104 KB
SSDPAPI.dll
Total CPU:	0.00010282%
Kernel CPU:	0.00003383%
User CPU:	0.00006899%
CPU cycles:	2,156/sec
Memory:	76 KB

Common loaded modules

These are modules that are typiclaly loaded within the context of this process.

winhttp.dll (Windows HTTP Services by Microsoft)

Distribution by Windows OS

OS version	distribution
Windows 8	26.50%
Windows 8.1	23.50%
Windows 8 Pro	15.50%
Windows 8.1 Pro	9.50%
Windows 8 Single Language	5.50%
Windows 8.1 Single Language	4.50%
Windows 8 Pro with Media Center	3.50%
Windows 8.1 Pro with Media Center	3.00%
Windows 8 Enterprise	2.50%
Windows 8.1 Enterprise	1.00%
Windows 8.1 Pro Preview	1.00%
Windows 8 Pro N	1.00%
Windows 8.1 N	0.50%
Windows 8.1 Enterprise Evaluation	0.50%
Windows 8 Enterprise N	0.50%
Windows 8 Enterprise Evaluation	0.50%
Windows 8.1 Single Language Preview	0.50%
Windows 8.1 Pro Preview with Media Center	0.50%

Distribution by country

United States installs about 40.20% of Device Association Framework Provider Host.

Distribution by PC manufacturer

PC Manufacturer	distribution
Hewlett-Packard	16.41%
ASUS	16.03%
Lenovo	14.50%
Acer	12.98%
Dell	12.98%
Toshiba	12.98%
Sony	6.11%
GIGABYTE	2.67%
Intel	2.29%
Samsung	1.91%
Alienware	0.76%
American Megatrends	0.38%

Remove Adware and Spyware Programs, FREE Download!