Windows COM may launch the legitimate dllhost.exe system surrogate to host a registered DLL COM server. A hijacked or malicious COM registration can redirect activation to attacker-controlled code; separately, malware may impersonate the dllhost.exe name or path. The binary itself does not create a COM hijack, establish persistence, or make activity invisible.
RESTRICTED_ACCESS_BLUR_MARKER