clrhost.dll
In Proc server for managed servers in the Windows Runtime file version info
Library on Windows 2 known copies with hashes
Is it the real clrhost.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionIn Proc server for managed servers in the Windows Runtime
2 known copies
10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\clrhost.dll · signed by Microsoft Windows
2d51e6e95c92776c4217aab5db68e1e464ea73fae27c9825f3ee5241d634b87010.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\clrhost.dll · signed by Microsoft Windows
af2df32c528d59c999958d8a4020c24c48e363ed175c0f66c684ecc746608508From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.