Firefox spawns a DllHost.exe process when downloading ZIP files

Question

I'm running Windows 7 Professional 32-bit. When downloading a ZIP file in Firefox, a DllHost.exe process appears. The command line is this:

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

It is always the same ProcessID, and the process is related to wininet.dll (C:\Windows\System32\wininet.dll). The Name of the AppID key in the registry is "WinInetCacheServer".

This doesn't seem to happen when downloading .exe files, though.

What is this WinInetCacheServer and what is it doing on my system? It definitely was not there before, I think this whole thing appeared after installing Internet Explorer 10 via Windows Update.

I know that wininet.dll seems to be legit Microsoft stuff, but when a new process that has not been around before suddenly appears, my alarm flags go up. Any recommendations?

Answer 1

Dev Center on msdn.microsoft.com confirms that this is intended:

The WinINet functions have simple, yet flexible, built-in caching support. Any data retrieved from the network is cached on the hard disk and retrieved for subsequent requests. The application can control the caching on each request.

It also mentions, that there are certain rules, for example

• "The cache-control directives and application set flags determine what may be cached (...)"
• "In general, responses to the GET verb are cached if the requirements listed above are met. Responses to PUT and POST verbs are not cached under any circumstances."
• "Https is cached by default."

So yes, this is a legit process from windows, but if you want to identify the behaviour and how it is controlled, -> why a .zip is cached and an .exe is not, you will have to dig a little deeper into this topic.