CmdID

CmdID / Files

dllhst3g.exe

COM Surrogate file version info

Program on Windows 12 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real dllhst3g.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionCOM Surrogate

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\dllhst3g.exe · signed by Microsoft Windows

461f9accc31c27b08850d5c12b44ab3e4b092267c6f6027fb13826af7864484b

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\dllhst3g.exe · signed by Microsoft Windows

e5b5417fd58e7f9c9d2edc41d2e9c5e9a5cf1a0b269e7b9ba0c83e9ec2aed176

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\dllhst3g.exe · signed by Microsoft Windows

360e11757029f102bf9defaf60b24f96a8c4b6726c0b9ec9ece4bbae89f3af7b

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dllhst3g.exe · signed by Microsoft Windows

9d71a9edd75017c6effd7bc8fcaff5022d615c83b3dda2b3073415b697efe645

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\dllhst3g.exe · signed by Microsoft Windows

b91f27afb88887f2c3830cfb211fd604d39a93d1e5d4f0da9df248292b13663b

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\dllhst3g.exe · signed by Microsoft Windows

f26887181af8a1d9b86ccb7ee8ffd250e4f7e84548a7869902a4774c5ddbed42

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\dllhst3g.exe · signed by Microsoft Windows

a4dc2c67c733df3b9d7e4b9b4b7c300374ee6922ccd5dbd21acfdc4e4d2068d1

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dllhst3g.exe · signed by Microsoft Windows

f814061ad1ff183b6a8ac3df9a8377e042f527c9a15d276ccc0493fb47aa8962

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\dllhst3g.exe · signed by Microsoft Windows

a56a69cb90ea87f18aec873d5852483050c00a26fcf4a54255fb541006860b72

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\dllhst3g.exe · signed by Microsoft Windows

b9c234164a34312d92034b49bb8bc29c8f676c3cd974375490438120cafbf6fe

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\dllhst3g.exe · not signed

0a441bda10f1dd3df9c7018df3c1047a043190f01a96facd27582e0ca4d5a44a

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\dllhst3g.exe · not signed

cc191cd38453b51036ee1b39eca47a298486c6c181aff4ce205382a229bd7e30

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name dllhst3g.exe
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)