dllhost.exe
COM Surrogate by Microsoft Corporation (Signed)
| Version: | 5.1.2600.5512 (xpsp.080413-2108) |
| MD5: | 0a9ba6af531afe7fa5e4fb973852d863 |
| SHA1: | 5d0b0222b0f37a85d64b9283611e940313e21348 |
| SHA256: | 8a8116429189d631fc00596278c92a363ec734f0cde76f52c7456fdc9c56e384 |
This is a Windows system installed file with Windows File Protection (WFP) enabled.
What is dllhost.exe?
The COM Surrogate is a fancy name for Sacrificial process for a COM object that is run outside of the process that requested it. Explorer uses the COM Surrogate when extracting thumbnails, for example. If you go to a folder with thumbnails enabled, Explorer will fire off a COM Surrogate and use it to compute the thumbnails for the documents in the folder. It does this because Explorer has learned not to trust thumbnail extractors; they have a poor track record for stability.
Overview
dllhost.exe runs as a service under the name Aplikacja systemowa modelu COM+ (COMSysApp) with extensive SYSTEM privileges (full administrator access). The file is digitally signed by Microsoft Corporation. This version is installed on Windows XP and is compiled as a 32 bit program.
Details
| File name: | dllhost.exe |
| Publisher: | Microsoft Corporation |
| Product name: | COM Surrogate |
| Description: | Microsoft® Windows® Operating System |
| Typical file path: | C:\Windows\System32\dllhost.exe |
| File version: | 5.1.2600.5512 (xpsp.080413-2108) |
| Product version: | 5.1.2600.5512 |
| Size: | 5 KB (5,120 bytes) |
| Certificate |
| Issued to: | Microsoft Corporation |
| Authority (CA): | Microsoft Corporation |
| Expiration date: | Tuesday, July 9, 2013 |
| Digital DNA |
| PE subsystem: | Windows GUI |
| Entropy: | 4.980855 |
| File packed: | No |
| Code language: | Microsoft Visual C++ |
| .NET CLR: | No |
More details
Behaviors
Services
Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)
- 'COMSysApp' (Aplikacja systemowa modelu COM+)
- 'PrlVssProvider'
- Symantec SymSnap VSS Provider
- 'COMSysApp'
Network connections
[UDP] listens on port 1325
Resource utilization
(Note: statistics below are averages based on a minimum sample size of 200 unique participants)
Averages
| CPU |
| Total CPU: | 0.00212966% | |
| Kernel CPU: | 0.00093213% | |
| User CPU: | 0.00119753% | |
| Kernel CPU time: | 667 ms/min | |
| Context switches: | 10/sec | |
| Memory |
| Private memory: | 4.9 MB | |
| Private (maximum): | 8.5 MB | |
| Private (minimum): | 5.85 MB | |
| Non-paged memory: | 4.9 MB | |
| Virtual memory: | 43.53 MB | |
| Virtual memory (peak): | 45.25 MB | |
| Working set: | 6.11 MB | |
| Working set (peak): | 9.23 MB | |
| Page faults: | 5,980/min | |
| I/O |
| I/O read transfer: | 3.09 KB/sec | |
| I/O read operations: | 5/sec | |
| I/O write transfer: | 6 Bytes/sec | |
| I/O write operations: | 1/sec | |
| I/O other transfer: | 64 Bytes/sec | |
| I/O other operations: | 2/sec | |
| Resource allocations |
| Threads: | 12 | |
| Handles: | 206 | |
| GUI GDI count: | 5 | |
| GUI USER count: | 4 | |
Process properties
| Integrety level: | Undefined |
| Platform: | 32-bit |
| Command lines: |
- C:\Windows\System32\dllhost.exe /processiC:{02d4b3f1-fd88-11d1-960d-00805fc79235}
- C:\windows.0\system32\dllhost.exe /processiC:{02d4b3f1-fd88-11d1-960d-00805fc79235}
- C:\Windows\System32\dllhost.exe /processiC:{bd821f2b-189a-4980-8c02-e95c59219e35}
- C:\Windows\System32\dllhost.exe /processiC:{3d14228d-fbe1-11d0-995d-00c04fd919c1}
- C:\Windows\System32\dllhost.exe /processiC:{9a666cc3-6fbb-47c0-8921-fe42d156123a}
- C:\winxp\system32\dllhost.exe /processiC:{4e14fba2-2e22-11d1-9964-00c04fbbb345}
- C:\Windows\System32\dllhost.exe /processiC:{f85987c8-6e82-4b45-917e-1ee0276a0dd3}
- (12 more)
|
| Owner: | SYSTEM |
| Windows Service |
| Service name: | COMSysApp |
| Display name: | Aplikacja systemowa modelu COM+ |
| Description: | “Administra la configuración y el seguimiento de los componentes del Modelo de objetos componentes (COM+). Si se detiene el servicio, la mayoría de los componentes COM+ no funcionarán correctamente. Si se deshabilita este servicio, no se podrá iniciar ningún servicio que dependa específicamente de él.” |
| Type: | Win32OwnProcess |
| Parent processes: |
|
Threads
Averages
| dllhost.exe (main module) |
| Total CPU: | 0.00117082% | |
| Kernel CPU: | 0.00075866% | |
| User CPU: | 0.00041216% | |
| Memory: | 16 KB | |
| MSVCR80.dll |
| Total CPU: | 0.00041912% | |
| Kernel CPU: | 0.00023950% | |
| User CPU: | 0.00017962% | |
| Context switches: | 6/sec | |
| Memory: | 620 KB | |
| COMSVCS.DLL |
| Total CPU: | 0.00037587% | |
| Kernel CPU: | 0.00015127% | |
| User CPU: | 0.00022460% | |
| Memory: | 1.23 MB | |
| msvcrt.dll |
| Total CPU: | 0.00023215% | |
| Kernel CPU: | 0.00004458% | |
| User CPU: | 0.00018757% | |
| Memory: | 352 KB | |
| ole32.dll |
| Total CPU: | 0.00014520% | |
| Kernel CPU: | 0.00013552% | |
| User CPU: | 0.00000968% | |
| Memory: | 1.24 MB | |
| MSDTCPRX.dll |
| Total CPU: | 0.00006202% | |
| Kernel CPU: | 0.00001934% | |
| User CPU: | 0.00004269% | |
| Memory: | 436 KB | |
| ntdll.dll |
| Total CPU: | 0.00004957% | |
| Kernel CPU: | 0.00000000% | |
| User CPU: | 0.00004957% | |
| Memory: | 712 KB | |
Common loaded modules
These are modules that are typiclaly loaded within the context of this process.
Distribution by Windows OS
| OS version | distribution |
| Windows 7 Home Premium |
34.00% |
|
| Windows 8.1 |
19.00% |
|
| Windows 8.1 Pro |
10.00% |
|
| Windows 7 Ultimate |
9.50% |
|
| Windows 8.1 Single Language |
7.00% |
|
| Windows 7 Professional |
5.00% |
|
| Windows 8 Single Language |
3.50% |
|
| Windows 8 |
3.00% |
|
| Windows 8 Pro |
3.00% |
|
| Windows 8.1 Pro with Media Center |
2.00% |
|
| Windows Seven Black Edition |
1.00% |
|
| Windows Vista Home Premium |
1.00% |
|
| Windows 8.1 N |
0.50% |
|
| Windows 8 Enterprise N |
0.50% |
|
| Windows 7 Home Basic |
0.50% |
|
| Windows 8.1 Enterprise Evaluation |
0.50% |
|
Distribution by country
United States installs about 50.51% of COM Surrogate.
Distribution by PC manufacturer
| PC Manufacturer | distribution |
| Dell |
23.17% |
|
| Hewlett-Packard |
17.37% |
|
| ASUS |
13.90% |
|
| Acer |
11.20% |
|
| Toshiba |
10.04% |
|
| Lenovo |
10.04% |
|
| Sony |
7.72% |
|
| Alienware |
2.70% |
|
| Intel |
1.54% |
|
| Samsung |
1.16% |
|
| GIGABYTE |
1.16% |
|
