dllhost.exe
COM Surrogate by Microsoft Corporation (Signed)
| Version: | 6.0.6000.16386 (vista_rtm.061101-2205) |
| MD5: | bed93f434cd291dec110901f7343e000 |
| SHA1: | 3be99d7dba1bea2ab71a7976b319d31a28a7b328 |
| SHA256: | e47365043f44b0fb62c9552c24c18725ae60797d1a80230d26d52eedc7e5e42e |
This is a Windows system installed file with Windows File Protection (WFP) enabled.
What is dllhost.exe?
The COM Surrogate is a fancy name for Sacrificial process for a COM object that is run outside of the process that requested it. Explorer uses the COM Surrogate when extracting thumbnails, for example. If you go to a folder with thumbnails enabled, Explorer will fire off a COM Surrogate and use it to compute the thumbnails for the documents in the folder. It does this because Explorer has learned not to trust thumbnail extractors; they have a poor track record for stability.
Overview
dllhost.exe runs as a service under the name Aplikacja systemowa modelu COM+ (COMSysApp) within the local user context within the context of the Service Host (SvcHost). The file is digitally signed by Microsoft Corporation. This version is designed to run on Windows Vista and is compiled as a 64 bit program.
Details
| File name: | dllhost.exe |
| Publisher: | Microsoft Corporation |
| Product name: | COM Surrogate |
| Description: | Microsoft® Windows® Operating System |
| Typical file path: | C:\Windows\System32\dllhost.exe |
| File version: | 6.0.6000.16386 (vista_rtm.061101-2205) |
| Product version: | 6.0.6000.16386 |
| Size: | 8.5 KB (8,704 bytes) |
| Certificate |
| Issued to: | Microsoft Corporation |
| Authority (CA): | Microsoft Corporation |
| Expiration date: | Tuesday, July 9, 2013 |
| Digital DNA |
| PE subsystem: | Windows GUI |
| Entropy: | 4.980855 |
| File packed: | No |
| Code language: | Microsoft Visual C++ |
| .NET CLR: | No |
More details
Behaviors
Services
Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)
- 'COMSysApp' (Aplikacja systemowa modelu COM+)
- 'PrlVssProvider'
- Symantec SymSnap VSS Provider
- 'COMSysApp'
Resource utilization
(Note: statistics below are averages based on a minimum sample size of 200 unique participants)
Averages
| CPU |
| Total CPU: | 0.00002713% | |
| Kernel CPU: | 0.00001557% | |
| User CPU: | 0.00001155% | |
| Kernel CPU time: | 624,004 ms/min | |
| Memory |
| Private memory: | 3.43 MB | |
| Private (maximum): | 7.14 MB | |
| Private (minimum): | 5.32 MB | |
| Non-paged memory: | 3.43 MB | |
| Virtual memory: | 62.65 MB | |
| Virtual memory (peak): | 64.68 MB | |
| Working set: | 5.34 MB | |
| Working set (peak): | 7.21 MB | |
| Page faults: | 2,159/min | |
| Resource allocations |
| Threads: | 5 | |
| Handles: | 101 | |
| GUI GDI count: | 9 | |
| GUI USER count: | 4 | |
Process properties
| Integrety level: | Undefined |
| Platform: | 64-bit |
| Command line: | C:\Windows\System32\dllhost.exe /processiC:{a79db36d-6218-48e6-9ec9-dcba9a39bf00} |
| Owner: | User |
| Windows Service |
| Service name: | COMSysApp |
| Display name: | Aplikacja systemowa modelu COM+ |
| Description: | “Administra la configuración y el seguimiento de los componentes del Modelo de objetos componentes (COM+). Si se detiene el servicio, la mayoría de los componentes COM+ no funcionarán correctamente. Si se deshabilita este servicio, no se podrá iniciar ningún servicio que dependa específicamente de él.” |
| Type: | Win32OwnProcess |
| Parent process: | svchost.exe (Host Process for Windows Services by Microsoft Corporation) |
Distribution by Windows OS
| OS version | distribution |
| Windows 7 Home Premium |
34.00% |
|
| Windows 8.1 |
19.00% |
|
| Windows 8.1 Pro |
10.00% |
|
| Windows 7 Ultimate |
9.50% |
|
| Windows 8.1 Single Language |
7.00% |
|
| Windows 7 Professional |
5.00% |
|
| Windows 8 Single Language |
3.50% |
|
| Windows 8 |
3.00% |
|
| Windows 8 Pro |
3.00% |
|
| Windows 8.1 Pro with Media Center |
2.00% |
|
| Windows Seven Black Edition |
1.00% |
|
| Windows Vista Home Premium |
1.00% |
|
| Windows 8.1 N |
0.50% |
|
| Windows 8 Enterprise N |
0.50% |
|
| Windows 7 Home Basic |
0.50% |
|
| Windows 8.1 Enterprise Evaluation |
0.50% |
|
Distribution by country
United States installs about 50.51% of COM Surrogate.
Distribution by PC manufacturer
| PC Manufacturer | distribution |
| Dell |
23.17% |
|
| Hewlett-Packard |
17.37% |
|
| ASUS |
13.90% |
|
| Acer |
11.20% |
|
| Toshiba |
10.04% |
|
| Lenovo |
10.04% |
|
| Sony |
7.72% |
|
| Alienware |
2.70% |
|
| Intel |
1.54% |
|
| Samsung |
1.16% |
|
| GIGABYTE |
1.16% |
|
