Should I block it?

No, this file is 100% safe to run.

Additional versions

6.3.9600.17031 (winblue_gdr.140221-1952)	14.44%
6.3.9600.16384 (winblue_rtm.130821-1623)	9.17%
6.3.9600.16384 (winblue_rtm.130821-1623)	0.28%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.83%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.28%
6.2.9200.16384 (win8_rtm.120725-1247)	66.67%
6.2.9200.16384 (win8_rtm.120725-1247)	7.78%
6.2.8400.0 (winmain_win8rc.120518-1423)	0.28%
6.2.8400.0 (winmain_win8rc.120518-1423)	0.28%

Relationships

Parent process

svchost.exe (Host Process for Windows Services by Microsoft Corporation)

Related files

das.dll (Device Association Service by Microsoft)

PE file structure

Show functions

Import table

advapi32.dll

ConvertStringSecurityDescriptorToSecurityDescriptorW, TraceMessage, GetTraceLoggerHandle, GetTraceEnableLevel, GetTraceEnableFlags, RegisterTraceGuidsW, UnregisterTraceGuids, RegGetValueW, RegOpenKeyExW, DuplicateToken, EventWrite, SetThreadToken, ConvertSecurityDescriptorToStringSecurityDescriptorW, RegCloseKey

api-ms-win-core-errorhandling-l1-1-1.dll

GetLastError, SetUnhandledExceptionFilter, UnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0.dll

DuplicateHandle, CloseHandle

api-ms-win-core-heap-l1-2-0.dll

HeapFree, HeapAlloc, GetProcessHeap

api-ms-win-core-heap-obsolete-l1-1-0.dll

LocalFree

api-ms-win-core-libraryloader-l1-1-1.dll

GetModuleHandleA, FreeLibrary, LoadLibraryExW, GetProcAddress

api-ms-win-core-libraryloader-l1-2-0.dll

GetModuleHandleA, FreeLibrary, LoadLibraryExW, GetProcAddress

api-ms-win-core-processthreads-l1-1-2.dll

OpenProcess, GetCurrentProcess, TerminateProcess, GetCurrentProcessId, GetCurrentThreadId, SetThreadToken

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter

api-ms-win-core-registry-l1-1-0.dll

RegGetValueW, RegCloseKey, RegOpenKeyExW

api-ms-win-core-string-l1-1-0.dll

CompareStringOrdinal

api-ms-win-core-synch-l1-2-0.dll

ResetEvent, AcquireSRWLockExclusive, EnterCriticalSection, InitializeSRWLock, LeaveCriticalSection, ReleaseSRWLockExclusive, DeleteCriticalSection, CreateEventW, AcquireSRWLockShared, ReleaseSRWLockShared, SetEvent, Sleep, WaitForSingleObject, InitializeCriticalSection

api-ms-win-core-sysinfo-l1-2-1.dll

GetSystemTimeAsFileTime, GetTickCount

api-ms-win-core-threadpool-l1-2-0.dll

SubmitThreadpoolWork, WaitForThreadpoolWaitCallbacks, WaitForThreadpoolWorkCallbacks, CloseThreadpoolWork, CreateThreadpoolWork, CloseThreadpoolWait, SetThreadpoolWait, CreateThreadpoolWait

api-ms-win-devices-query-l1-1-1.dll

DevGetObjectPropertiesEx, DevFreeObjectProperties

api-ms-win-eventing-classicprovider-l1-1-0.dll

GetTraceLoggerHandle, UnregisterTraceGuids, TraceMessage, RegisterTraceGuidsW, GetTraceEnableLevel, GetTraceEnableFlags

api-ms-win-eventing-provider-l1-1-0.dll

EventWrite

api-ms-win-security-base-l1-2-0.dll

DuplicateToken

api-ms-win-security-sddl-l1-1-0.dll

ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSecurityDescriptorToStringSecurityDescriptorW

kernel32.dll

WaitForSingleObject, CloseHandle, CloseThreadpoolWait, CreateThreadpoolWait, SetThreadpoolWait, InitializeSRWLock, AcquireSRWLockExclusive, ReleaseSRWLockExclusive, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, ResetEvent, LeaveCriticalSection, CreateThreadpoolWork, SubmitThreadpoolWork, WaitForThreadpoolWorkCallbacks, CloseThreadpoolWork, OpenProcess, DuplicateHandle, GetCurrentProcess, InterlockedIncrement, InterlockedDecrement, AcquireSRWLockShared, ReleaseSRWLockShared, HeapAlloc, WaitForThreadpoolWaitCallbacks, LocalFree, LoadLibraryExW, FreeLibrary, CompareStringOrdinal, TerminateProcess, UnhandledExceptionFilter, GetTickCount, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, GetModuleHandleA, GetProcessHeap, SetUnhandledExceptionFilter, InterlockedCompareExchange, InterlockedExchange, Sleep, HeapFree, SetEvent, CreateEventW, GetLastError, GetProcAddress

msvcrt.dll

DllMain

rpcrt4.dll

NdrMesTypeEncode2, NdrAsyncServerCall, NdrServerCall2, RpcServerUseProtseqEpW, I_RpcMapWin32Status, RpcServerRegisterIf3, RpcServerUnregisterIfEx, RpcAsyncCompleteCall, MesEncodeIncrementalHandleCreate, MesIncrementalHandleReset, RpcExceptionFilter, MesHandleFree, I_RpcBindingInqLocalClientPID, RpcImpersonateClient, RpcRevertToSelf, I_RpcExceptionFilter, UuidFromStringW, NdrMesTypeAlignSize2, RpcSsDestroyClientContext, RpcStringFreeW, RpcStringBindingComposeW, RpcBindingFromStringBindingW, RpcBindingSetOption, RpcBindingFree, NdrClientCall2

dasHost.exe

Device Association Framework Provider Host by Microsoft

Remove dasHost.exe

Version:	6.2.9200.16384 (win8_rtm.120725-1247)
MD5:	b278b76ff26be911dd369724612f2d03
SHA1:	08ae55cb8d137e3f1a88b0345d4e59c912876161
SHA256:	515f606ae0ea88b0ce971377d5067424181e81a7b08b9686db53454fac07b354

This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is dasHost.exe?

Device Association Framework Provider Host enables pairing between the system and wired or wireless devices. This service is new for Windows 8.

Overview

dashost.exe executes as a process with LOCAL SERVICE privileges typically within the context of its parent svchost.exe (Host Process for Windows Services by Microsoft Corporation). The assembly utilizes the .NET run-time framework (which is required to be installed on the PC). This version is installed on Windows 8 and is compiled as a 64 bit program.

Details

File name:	dashost.exe
Publisher:	Microsoft Corporation
Product name:	Device Association Framework Provider Host
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\dashost.exe
File version:	6.2.9200.16384 (win8_rtm.120725-1247)
Product version:	6.2.9200.16384
Size:	66.5 KB (68,096 bytes)
Digital DNA
File packed:	No
Code language:	Microsoft Visual C# / Basic .NET
.NET CLR:	Yes
.NET NGENed:	No

More details

Network connections

[TCP] 172.30.20.170:2869

[UDP] listens on port 51494

[UDP] listens on port 53353

[UDP] listens on port 54098

[UDP] listens on port 58375

[UDP] listens on port 65394

[UDP] listens on port 51352

[UDP] listens on port 64947

[UDP] listens on port 60674

[UDP] listens on port 50272

[UDP] listens on port 56200

[UDP] listens on port 60507

[UDP] listens on port 53372

[UDP] listens on port 62970

[UDP] listens on port 58604

[UDP] listens on port 63232

[UDP] listens on port 50248

[UDP] listens on port 58843

[UDP] listens on port 53986

[UDP] listens on port 54354

[UDP] listens on port 51037

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00054557%	0.028634%
Kernel CPU:	0.00033293%	0.013761%
User CPU:	0.00021265%	0.014873%
Kernel CPU time:	863,986 ms/min	100,923,805ms/min
CPU cycles:	151,815/sec	17,470,203/sec
Context switches:	4/sec	284/sec
Memory
Private memory:	4.93 MB	21.59 MB
Private (maximum):	11.43 MB
Private (minimum):	7.67 MB
Non-paged memory:	4.93 MB	21.59 MB
Virtual memory:	69.6 MB	140.96 MB
Virtual memory (peak):	79.46 MB	169.69 MB
Working set:	9.86 MB	18.61 MB
Working set (peak):	12.48 MB	37.95 MB
Page faults:	18,473/min	2,039/min
I/O
I/O read transfer:	448 Bytes/sec	1.02 MB/min
I/O read operations:	2/sec	343/min
I/O write transfer:	1.18 KB/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	2.57 KB/sec	448.09 KB/min
I/O other operations:	26/sec	1,671/min
Resource allocations
Threads:	12	12
Handles:	339	600

Process properties

Integrety level:	System
Platform:	64-bit
Command lines:	dashost.exe {fdd9114d-bba4-4814-a0e7339014fada21} dashost.exe {29d39127-16e5-4dd0-8d353843acf84051} dashost.exe {f7b4f0ad-81e9-466d-a660db4cb1429eb0} dashost.exe {bb15f565-ff0c-4f39-a1c424194d0226d3} dashost.exe {d9594edd-425b-4e5a-841f4bcaf1f685fc} dashost.exe {91d1814b-ea4b-4ef1-95a2f3597ade787c} dashost.exe {65c3b8cf-5e4f-4161-b4f0bf8ce288bae3} (200 more)
Owner:	LOCAL SERVICE
Parent process:	svchost.exe (by Microsoft)

Threads

Averages

ntdll.dll
Total CPU:	0.01851311%	0.272967%
Kernel CPU:	0.00913063%	0.107585%
User CPU:	0.00938249%	0.165382%
CPU cycles:	407,721/sec	5,741,424/sec
Context switches:	4/sec	79/sec
Memory:	1.74 MB	1.16 MB
dashost.exe (main module)
Total CPU:	0.00014478%
Kernel CPU:	0.00009785%
User CPU:	0.00004693%
CPU cycles:	1,263/sec
Memory:	80 KB
SSDPAPI.dll
Total CPU:	0.00007872%
Kernel CPU:	0.00002485%
User CPU:	0.00005388%
CPU cycles:	1,849/sec
Memory:	72 KB

Common loaded modules

These are modules that are typiclaly loaded within the context of this process.

Distribution by Windows OS

OS version	distribution
Windows 8	26.50%
Windows 8.1	23.50%
Windows 8 Pro	15.50%
Windows 8.1 Pro	9.50%
Windows 8 Single Language	5.50%
Windows 8.1 Single Language	4.50%
Windows 8 Pro with Media Center	3.50%
Windows 8.1 Pro with Media Center	3.00%
Windows 8 Enterprise	2.50%
Windows 8.1 Enterprise	1.00%
Windows 8.1 Pro Preview	1.00%
Windows 8 Pro N	1.00%
Windows 8.1 N	0.50%
Windows 8.1 Enterprise Evaluation	0.50%
Windows 8 Enterprise N	0.50%
Windows 8 Enterprise Evaluation	0.50%
Windows 8.1 Single Language Preview	0.50%
Windows 8.1 Pro Preview with Media Center	0.50%

Distribution by country

United States installs about 40.20% of Device Association Framework Provider Host.

Distribution by PC manufacturer

PC Manufacturer	distribution
Hewlett-Packard	16.41%
ASUS	16.03%
Lenovo	14.50%
Acer	12.98%
Dell	12.98%
Toshiba	12.98%
Sony	6.11%
GIGABYTE	2.67%
Intel	2.29%
Samsung	1.91%
Alienware	0.76%
American Megatrends	0.38%

Remove Adware and Spyware Programs, FREE Download!