LegionLoader dllhost.exe Executing Malicious CPL Applet (Signed Binary Proxy)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the execution of the dllhost.exe process with command-line arguments referencing .cpl files or the 'COpenControlPanel' string. This behavior is indicative of potential malicious activity where attackers use Control Panel files (which are essentially DLLs) to proxy code execution, potentially to bypass security controls or masquerade as legitimate system activity.