Should I block it?

No, this file is 100% safe to run.

Additional versions

1.0.1222	7.69%
1.0.1222	10.26%
1.0.1222	28.21%
1.0.1222	12.82%
1.0.1222	12.82%
1.0.1222	7.69%
1.0.1222	15.38%
1.0.1222	2.56%
1.0.1222	2.56%

(Note, CyberLink publishes each variation of this file with the same version, but the hashes are unique.)

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Child processes

Related files

clhnserviceforpowerdvd.exe (CLHNServiceForPowerDVD Module by CyberLink)

PE file structure

Show functions

Import table

advapi32.dll

OpenThreadToken, GetTokenInformation, OpenProcessToken, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, GetLengthSid, CopySid, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, RegEnumValueW, RegQueryInfoKeyW, RegEnumKeyExW, RegCreateKeyExW, RegDeleteKeyW, RegOpenKeyExW, StartServiceCtrlDispatcherW, ControlService, DeleteService, CreateServiceW, ChangeServiceConfig2W, RegDeleteValueW, RegSetValueExW, RegCloseKey, RegQueryValueExW, SetServiceStatus, RegisterServiceCtrlHandlerW, RegisterEventSourceW, ReportEventW, DeregisterEventSource, OpenSCManagerW, OpenServiceW, CloseServiceHandle

iphlpapi.dll

SetIpTTL

kernel32.dll

OutputDebugStringW, GetCPInfo, SetStdHandle, EnterCriticalSection, LeaveCriticalSection, GetCurrentThread, GetCurrentProcess, CloseHandle, lstrcatW, lstrcpyW, LoadLibraryW, GetProcAddress, lstrcpynW, LoadLibraryExW, GetLastError, FindResourceW, LoadResource, SizeofResource, lstrlenA, MultiByteToWideChar, FreeLibrary, GetModuleHandleW, GetShortPathNameW, InterlockedIncrement, DeleteCriticalSection, InitializeCriticalSection, GetModuleFileNameW, OutputDebugStringA, lstrlenW, GetCommandLineW, lstrcmpiW, GetCurrentThreadId, InterlockedDecrement, GetOEMCP, GetACP, GetStringTypeW, GetStringTypeA, LCMapStringW, FlushFileBuffers, LoadLibraryA, IsBadCodePtr, IsBadReadPtr, SetUnhandledExceptionFilter, SetFilePointer, WideCharToMultiByte, WriteFile, RtlUnwind, HeapFree, HeapAlloc, HeapReAlloc, GetModuleHandleA, GetStartupInfoW, GetVersion, ExitProcess, TlsSetValue, TlsAlloc, SetLastError, TlsGetValue, GetModuleFileNameA, GetEnvironmentVariableA, GetVersionExA, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, IsBadWritePtr, TerminateProcess, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetEnvironmentStrings, GetCommandLineA, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, LCMapStringA

ole32.dll

CoCreateInstance, CoRevokeClassObject, CoRegisterClassObject, CoTaskMemRealloc, CoTaskMemAlloc, CoTaskMemFree, CoInitializeSecurity, CoUninitialize, CoInitialize

user32.dll

DispatchMessageW, MessageBoxW, LoadStringW, GetMessageW, PostThreadMessageW, CharNextW

CLHNServiceForPowerDVD12.exe

CLHNServiceForPowerDVD12 Module by CyberLink (Signed)

Remove CLHNServiceForPowerDVD12.exe

Version:	1.0.1222
MD5:	4c6406cf07d4ebb70c5774d55c6688fb
SHA1:	2ae9f35e72846d70e323750ec05601745b7103f1
SHA256:	3aa5db7a0e7bb54f3d0fa9d2cb952144a7a5fcac20a644646de7392d7eddb408

Overview

clhnserviceforpowerdvd12.exe runs as a service under the name CLHNServiceForPowerDVD12 with extensive SYSTEM privileges (full administrator access). This is typically installed with the program CyberLink PowerDVD 12 published by CyberLink Corp.. The file is digitally signed by CyberLink which was issued by the VeriSign certificate authority (CA).

Details

File name:	clhnserviceforpowerdvd12.exe
Publisher:	CyberLink Corp.
Product name:	CLHNServiceForPowerDVD12 Module
Typical file path:	C:\Program Files\cyberlink\powerdvd12\kernel\dmp\clhnserver\clhnserviceforpowerdvd12.exe
File version:	1.0.1222
Size:	85.29 KB (87,336 bytes)
Certificate
Issued to:	CyberLink
Authority (CA):	VeriSign
Digital DNA
File packed:	No
.NET CLR:	No

More details

Programs

The following program will install this file

CyberLink PowerDVD 12

CyberLink Corp.

11% remove

CyberLink PowerDVD 12 is a media player for Microsoft Windows. PowerDVD is distributed on physical media or by download from the Cyberlink website. It is often bundled with a variety of PC systems and peripheral devices (particularly optical drives).

Behaviors

Service

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'CLHNServiceForPowerDVD12'

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00039744%	0.028634%
Kernel CPU:	0.00032327%	0.013761%
User CPU:	0.00007417%	0.014873%
Kernel CPU time:	78,120 ms/min	100,923,805ms/min
CPU cycles:	2,464/sec	17,470,203/sec
Memory
Private memory:	1.84 MB	21.59 MB
Private (maximum):	4.64 MB
Private (minimum):	3.51 MB
Non-paged memory:	1.84 MB	21.59 MB
Virtual memory:	42.23 MB	140.96 MB
Virtual memory (peak):	45.6 MB	169.69 MB
Working set:	3.61 MB	18.61 MB
Working set (peak):	5.34 MB	37.95 MB
Page faults:	9,060/min	2,039/min
I/O
I/O read transfer:	120 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O other transfer:	3 Bytes/sec	448.09 KB/min
I/O other operations:	1/sec	1,671/min
Resource allocations
Threads:	4	12
Handles:	167	600
GUI GDI count:	4	103
GUI USER count:	3	49

Process properties

Integrety level:	System
Platform:	32-bit
Command line:	"C:\Program Files\cyberlink\powerdvd12\kernel\dmp\clhnserver\clhnserviceforpowerdvd12.exe"
Owner:	SYSTEM
Windows Service
Service name:	CLHNServiceForPowerDVD12
Description:	“CLHNServiceForPowerDVD12”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads