home

dpmhost.exe

Lenovo Information Products (Shenzhen) Co.,Ltd

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘PWRAGD’.
Publisher:
Lenovo Information Products (Shenzhen) Co.,Ltd  (signed and verified)

MD5:
8be7b3c89addb4d371c9f37c3c9ff236

SHA-1:
2cd376594ccfff1797ddc38e092548ff37da2f02

SHA-256:
2256651f3c7cd89f3de9abea10602fd315127378a6f7a666282452d33e374171

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/26/2024 11:34:13 PM UTC  (a few moments ago)

File size:
70.6 KB (72,256 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\thinkpad\utilities\dpmhost.exe

Digital Signature
Signed by:
Lenovo Information Products (Shenzhen) Co.,Ltd

Authority:
VeriSign, Inc.

Valid from:
3/12/2009 5:30:00 AM

Valid to:
6/3/2012 5:29:59 AM

Subject:
CN="Lenovo Information Products (Shenzhen) Co.,Ltd", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Lenovo Information Products (Shenzhen) Co.,Ltd", L=Shenzhen, S=Guangdong, C=CN

Issuer:
CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa (c)04, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
7F01FB34D50690995E6F42C0771CE87F

File PE Metadata
Compilation timestamp:
8/12/2009 12:59:11 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

Entry address:
0x2387

Entry point:
E8, 28, 26, 00, 00, E9, 17, FE, FF, FF, 51, 53, 55, 56, 57, FF, 35, 88, 0D, 41, 00, E8, 85, 20, 00, 00, FF, 35, 84, 0D, 41, 00, 8B, F0, 89, 74, 24, 18, E8, 74, 20, 00, 00, 8B, F8, 3B, FE, 59, 59, 0F, 82, 84, 00, 00, 00, 8B, DF, 2B, DE, 8D, 6B, 04, 83, FD, 04, 72, 78, 56, E8, 4B, 27, 00, 00, 8B, F0, 3B, F5, 59, 73, 4A, B8, 00, 08, 00, 00, 3B, F0, 73, 02, 8B, C6, 03, C6, 3B, C6, 72, 10, 50, FF, 74, 24, 14, E8, DE, 26, 00, 00, 85, C0, 59, 59, 75, 17, 8D, 46, 10, 3B, C6, 72, 43, 50, FF, 74, 24, 14, E8, C7, 26...
 
[+]

Entropy:
6.2973

Code size:
40 KB (40,960 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
PWRAGD

Command:
C:\Program Files1\thinkpad\utilit~1\dpmhost.exe


Scan dpmhost.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.