Should I block it?

No, this file is 100% safe to run.

Additional versions

1.40	33.33%
1.31	11.11%
1.20	11.11%
1.20	33.33%
1.11	11.11%

Relationships

Child processes

Related files

PE file structure

Show functions

Import table

advapi32.dll

RegEnumKeyExW, CreateProcessAsUserW, ImpersonateLoggedOnUser, SetTokenInformation, DuplicateTokenEx, StartServiceCtrlDispatcherW, RegisterServiceCtrlHandlerExW, SetServiceStatus, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegQueryInfoKeyW, RegCloseKey, RegOpenKeyExW, RegQueryValueExW, RevertToSelf

crypt32.dll

CertFreeCertificateContext, CertFindCertificateInStore, CryptQueryObject, CertCloseStore

kernel32.dll

lstrlenW, lstrcmpiW, WTSGetActiveConsoleSessionId, OpenEventW, WaitForSingleObject, ConnectNamedPipe, DisconnectNamedPipe, SetEvent, GetCurrentProcess, LocalAlloc, LocalFree, GetShortPathNameW, LoadLibraryW, GetProcAddress, CreateNamedPipeW, CreateEventW, FreeLibrary, GetModuleFileNameW, CompareStringW, CompareStringA, GetTimeZoneInformation, FlushFileBuffers, CreateFileA, GetLocaleInfoW, HeapSize, IsValidLocale, EnumSystemLocalesA, GetLocaleInfoA, GetUserDefaultLCID, GetDateFormatA, GetTimeFormatA, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, WriteConsoleW, GetConsoleOutputCP, GetVersionExW, GetLastError, Sleep, SetThreadPriority, CloseHandle, GetCommandLineA, GetStartupInfoA, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetModuleHandleW, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetFileType, DeleteCriticalSection, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, GetCurrentThread, HeapCreate, HeapDestroy, VirtualFree, HeapFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, SetFilePointer, GetConsoleCP, GetConsoleMode, EnterCriticalSection, LeaveCriticalSection, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, MultiByteToWideChar, FatalAppExitA, SetConsoleCtrlHandler, InterlockedExchange, LoadLibraryA, InitializeCriticalSectionAndSpinCount, HeapAlloc, VirtualAlloc, HeapReAlloc, RtlUnwind, SetStdHandle, WriteConsoleA, SetEnvironmentVariableA

ole32.dll

CoInitializeEx, CoUninitialize, CoInitializeSecurity

setupapi.dll

SetupDiGetClassDevsW, SetupDiEnumDeviceInfo, SetupDiGetDeviceRegistryPropertyW, SetupDiDestroyDeviceInfoList

shlwapi.dll

StrRChrW, PathFileExistsW

userenv.dll

CreateEnvironmentBlock, DestroyEnvironmentBlock

wintrust.dll

WinVerifyTrust

wtsapi32.dll

WTSQueryUserToken

tphkload.exe

On Screen Display by Lenovo(Japan)Ltd. (Signed)

Remove tphkload.exe

Version:	1.31
MD5:	c91c8bd1cbecafe706d4423a2786f20f
SHA1:	25c2b2f3d3a7d037f592dd06c2fc08c7f6757310

What is tphkload.exe?

Thinkpad On Screen Display utility for Windows displays the result of using of ThinkPad function keys on the desktop screen. This program also provides some enhancements of ThinkPad function keys. Previously, the On Screen Display program was installed during the installation of the ThinkPad Configuration Utility. Starting with the latest versions of the ThinkPad Configuration Utility programs, the On Screen Display program must be installed with it's own setup program.

About tphkload.exe (from Lenovo(Japan)Ltd.)

“Previously, the On Screen Display program was installed during the installation of the ThinkPad Configuration Utility. Starting with the latest versions of the ThinkPad Configuration Utility programs,”

Details

File name:	tphkload.exe
Publisher:	Lenovo Group Limited
Product name:	On Screen Display
Description:	ThinkPad Message Client Loader
Typical file path:	C:\Program Files\lenovo\hotkey\tphkload.exe
File version:	1.31
Size:	142.39 KB (145,808 bytes)
Build date:	9/5/2012 11:26 PM
Certificate
Issued to:	Lenovo(Japan)Ltd.
Authority (CA):	VeriSign
Effective date:	Tuesday, October 5, 2010
Expiration date:	Thursday, October 6, 2011
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
.NET CLR:	No

More details

Programs

The following programs will install this file

On Screen Display

Lenovo

8% remove

“This program displays the result of using of ThinkPad function keys on the desktop screen. This program also provides some enhancements of ThinkPad function keys. Previously, the On Screen Display program was installed during the installation of the ThinkPad Configuration Utility. Starting with the latest versions of the ThinkPad Configuration Utility programs, the On Screen Display program must be installed with it's own setup program ...”

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'TPHKLOAD' (Lenovo Hotkey Client Loader)
TPHKLOAD

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00001439%	0.028634%
Kernel CPU:	0.00001097%	0.013761%
User CPU:	0.00000342%	0.014873%
Kernel CPU time:	250 ms/min	100,923,805ms/min
CPU cycles:	3,009/sec	17,470,203/sec
Memory
Private memory:	4.19 MB	21.59 MB
Private (maximum):	2.16 MB
Private (minimum):	136 KB
Non-paged memory:	4.19 MB	21.59 MB
Virtual memory:	49.99 MB	140.96 MB
Virtual memory (peak):	54.02 MB	169.69 MB
Working set:	1.98 MB	18.61 MB
Working set (peak):	9.32 MB	37.95 MB
Page faults:	23,559/min	2,039/min
I/O
I/O read transfer:	285 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	0 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	2 Bytes/sec	448.09 KB/min
I/O other operations:	1/sec	1,671/min
Resource allocations
Threads:	6	12
Handles:	250	600

Process properties

Integrety level:	System
Platform:	64-bit
Command line:	"C:\Program Files\lenovo\hotkey\tphkload.exe"
Owner:	SYSTEM
Windows Service
Service name:	TPHKLOAD
Display name:	Lenovo Hotkey Client Loader
Type:	Win32OwnProcess
Parent process:	services.exe (by Microsoft)

Threads