Should I block it?

No, this file is 100% safe to run.

Additional versions

1.0.1222	7.69%
1.0.1222	10.26%
1.0.1222	28.21%
1.0.1222	12.82%
1.0.1222	12.82%
1.0.1222	7.69%
1.0.1222	15.38%
1.0.1222	2.56%
1.0.1222	2.56%

(Note, CyberLink publishes each variation of this file with the same version, but the hashes are unique.)

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

clhnserviceforpowerdvd.exe (CLHNServiceForPowerDVD Module by CyberLink)

PE file structure

Show functions

Import table

advapi32.dll

OpenThreadToken, GetTokenInformation, OpenProcessToken, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, GetLengthSid, CopySid, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, RegEnumValueW, RegQueryInfoKeyW, RegEnumKeyExW, RegCreateKeyExW, RegDeleteKeyW, RegOpenKeyExW, StartServiceCtrlDispatcherW, ControlService, DeleteService, CreateServiceW, ChangeServiceConfig2W, RegDeleteValueW, RegSetValueExW, RegCloseKey, RegQueryValueExW, SetServiceStatus, RegisterServiceCtrlHandlerW, RegisterEventSourceW, ReportEventW, DeregisterEventSource, OpenSCManagerW, OpenServiceW, CloseServiceHandle

iphlpapi.dll

SetIpTTL

kernel32.dll

OutputDebugStringW, GetCPInfo, SetStdHandle, EnterCriticalSection, LeaveCriticalSection, GetCurrentThread, GetCurrentProcess, CloseHandle, lstrcatW, lstrcpyW, LoadLibraryW, GetProcAddress, lstrcpynW, LoadLibraryExW, GetLastError, FindResourceW, LoadResource, SizeofResource, lstrlenA, MultiByteToWideChar, FreeLibrary, GetModuleHandleW, GetShortPathNameW, InterlockedIncrement, DeleteCriticalSection, InitializeCriticalSection, GetModuleFileNameW, OutputDebugStringA, lstrlenW, GetCommandLineW, lstrcmpiW, GetCurrentThreadId, InterlockedDecrement, GetOEMCP, GetACP, GetStringTypeW, GetStringTypeA, LCMapStringW, FlushFileBuffers, LoadLibraryA, IsBadCodePtr, IsBadReadPtr, SetUnhandledExceptionFilter, SetFilePointer, WideCharToMultiByte, WriteFile, RtlUnwind, HeapFree, HeapAlloc, HeapReAlloc, GetModuleHandleA, GetStartupInfoW, GetVersion, ExitProcess, TlsSetValue, TlsAlloc, SetLastError, TlsGetValue, GetModuleFileNameA, GetEnvironmentVariableA, GetVersionExA, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, IsBadWritePtr, TerminateProcess, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetEnvironmentStrings, GetCommandLineA, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, LCMapStringA

ole32.dll

CoCreateInstance, CoRevokeClassObject, CoRegisterClassObject, CoTaskMemRealloc, CoTaskMemAlloc, CoTaskMemFree, CoInitializeSecurity, CoUninitialize, CoInitialize

user32.dll

DispatchMessageW, MessageBoxW, LoadStringW, GetMessageW, PostThreadMessageW, CharNextW

CLHNServiceForPowerDVD12.exe

CLHNServiceForPowerDVD12 Module by CyberLink (Signed)

Remove CLHNServiceForPowerDVD12.exe

Version:	1.0.1222
MD5:	b30a02ebc936b0f270e77d72f7c839cc
SHA1:	4767b7e2f320c0af01b7ecb429f8789dc207c1cd

Overview

clhnserviceforpowerdvd12.exe runs as a service under the name CLHNServiceForPowerDVD12 with extensive SYSTEM privileges (full administrator access). This is typically installed with the program CyberLink Media Suite 10 published by CyberLink Corp.. The file is digitally signed by CyberLink which was issued by the VeriSign certificate authority (CA).

Details

File name:	clhnserviceforpowerdvd12.exe
Publisher:	CyberLink Corp.
Product name:	CLHNServiceForPowerDVD12 Module
Typical file path:	C:\Program Files\cyberlink\powerdvd12\kernel\dmp\clhnserver\clhnserviceforpowerdvd12.exe
File version:	1.0.1222
Size:	88.52 KB (90,640 bytes)
Certificate
Issued to:	CyberLink
Authority (CA):	VeriSign
Digital DNA
File packed:	No
.NET CLR:	No

More details

Programs

The following program will install this file

CyberLink Media Suite 10

CyberLink Corp.

7% remove

“Packed with the tools you need, you’ll be able to enjoy Blu-ray and DVD movies, create your own Hollywood productions, share videos and photos to your social communities, organize your media in ways and burn discs to back up your content. With Media Suite, there are no limits to what you can do! CyberLink Media Suite has everything you need to elevate your digital life. One powerful yet easy-to-use solution lets you organize, play, edi...”

Behaviors

Service

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'CLHNServiceForPowerDVD12'

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00003444%	0.028634%
Kernel CPU:	0.00002741%	0.013761%
User CPU:	0.00000703%	0.014873%
Kernel CPU time:	47 ms/min	100,923,805ms/min
CPU cycles:	1,790/sec	17,470,203/sec
Memory
Private memory:	1.08 MB	21.59 MB
Private (maximum):	2.41 MB
Private (minimum):	592 KB
Non-paged memory:	1.08 MB	21.59 MB
Virtual memory:	29.74 MB	140.96 MB
Virtual memory (peak):	32.87 MB	169.69 MB
Working set:	610 KB	18.61 MB
Working set (peak):	4.11 MB	37.95 MB
Page faults:	1,338/min	2,039/min
I/O
I/O read transfer:	27 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O other transfer:	2 Bytes/sec	448.09 KB/min
I/O other operations:	1/sec	1,671/min
Resource allocations
Threads:	4	12
Handles:	72	600

Process properties

Integrety level:	System
Platform:	64-bit
Command lines:	"C:\Program Files\cyberlink corp\powerdvd12\kernel\dmp\clhnserver\clhnserviceforpowerdvd12.exe" "C:\Program Files\cyberlink\powerdvd12\kernel\dmp\clhnserver\clhnserviceforpowerdvd12.exe"
Owner:	SYSTEM
Windows Service
Service name:	CLHNServiceForPowerDVD12
Description:	“CLHNServiceForPowerDVD12”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads