This is a Windows system installed file with Windows File Protection (WFP) enabled.
There are 48 versions of dllhost.exe in the wild, the latest version being 6.3.9600.16384 (winblue_rtm.130821-1623). It is started as a Windows Service called 'Aplikacja systemowa modelu COM+' with the name 'COMSysApp' and described as “Administra la configuración y el seguimiento de los componentes del Modelo de objetos componentes (COM+). Si se detiene el servicio, la mayoría de los componentes COM+ no funcionarán correctamente. Si se deshabilita este servicio, no se podrá iniciar ningún servicio que dependa específicamente de él.”. . The average file size is about 7.39 KB. The file is a digitally signed and issued to Microsoft Corporation by Microsoft Corporation. During the process's lifecycle, the typical CPU resource utilization is less than 0.01%, the average private memory consumption is about 4.28 MB with the maximum memory reaching around 12.22 MB. Addionally, typically read and write I/O disk operations is about 7.67 KB per minute for reads and 14.05 KB per minute for writes.
The COM Surrogate is a fancy name for Sacrificial process for a COM object that is run outside of the process that requested it. Explorer uses the COM Surrogate when extracting thumbnails, for example. If you go to a folder with thumbnails enabled, Explorer will fire off a COM Surrogate and use it to compute the thumbnails for the documents in the folder. It does this because Explorer has learned not to trust thumbnail extractors; they have a poor track record for stability.
(Note, the behaviors below are for all versions of dllhost.exe, select a unique version for details.)
Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)
United States installs about 47.24% of COM Surrogate.
