» pwmtr32v.dll
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

pwmtr32v.dll

ThinkPad Power Manager

Lenovo (Japan) Ltd.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘PWMTRV’. This is installed with ThinkPad EasyEject Utility.

File name:

pwmtr32v.dll

Publisher:

Lenovo Group Limited (signed by Lenovo (Japan) Ltd.)

Product:

ThinkPad Power Manager

Description:

ThinkPad Power Manager Background Monitor and Tray Battery Gauge

Version:

1, 0, 0, 0

MD5:

6c82c3fe1e02325dc468e07a3d972ce0

SHA-1:

e31f76dc954ee8227e17a19159dc4de218b85530

SHA-256:

ad48414e1d49d45b23cbba07a260c4096e6a4a93e2be9c23e96700d50acab748

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

4/26/2024 5:30:43 PM UTC (today)

File size:

257.5 KB (263,728 bytes)

Product version:

1, 0, 0, 0

Original file name:

PWRMGRTR.DLL

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\Program Files\thinkpad\utilities\pwmtr32v.dll

Digital Signature

Signed by:

Lenovo (Japan) Ltd.

Authority:

VeriSign, Inc.

Valid from:

11/7/2006 8:00:00 AM

Valid to:

11/8/2007 7:59:59 AM

Subject:

CN=Lenovo (Japan) Ltd., OU=Research & Development 1, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Lenovo (Japan) Ltd., L=Yamato-shi, S=Kanagawa, C=JP

Issuer:

CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa (c)04, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

4D3F41B8F9DD4F74BEF0B262A06C34DB

File PE Metadata

Compilation timestamp:

3/17/2007 10:14:32 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

6144:xEvWFHH0xi9g0/q9th7siD2g5pdOVwcN5:x0eH4aoF4

Entry address:

0x22DC0

Entry point:

83, 7C, 24, 08, 01, 75, 05, E8, 7A, 03, 00, 00, FF, 74, 24, 04, 8B, 4C, 24, 10, 8B, 54, 24, 0C, E8, CD, FE, FF, FF, 59, C2, 0C, 00, 50, 64, FF, 35, 00, 00, 00, 00, 8D, 44, 24, 0C, 2B, 64, 24, 0C, 53, 56, 57, 89, 28, 8B, E8, A1, A4, 5E, 03, 10, 33, C5, 50, FF, 75, FC, C7, 45, FC, FF, FF, FF, FF, 8D, 45, F4, 64, A3, 00, 00, 00, 00, C3, 50, 64, FF, 35, 00, 00, 00, 00, 8D, 44, 24, 0C, 2B, 64, 24, 0C, 53, 56, 57, 89, 28, 8B, E8, A1, A4, 5E, 03, 10, 33, C5, 50, 89, 65, F0, FF, 75, FC, C7, 45, FC, FF, FF, FF, FF... 
[+]

Entropy:

6.0699

Code size:

156 KB (159,744 bytes)

Startup File (All Users Run)

Registry location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:

PWMTRV

Command:

rundll32 C:\Program Files1\thinkpad\utilit~1\pwmtr32v.dll,pwrmgrbkgndmonitor

The file pwmtr32v.dll has been discovered within the following programs.

ThinkPad EasyEject Utility by Lenovo

The ThinkPad EasyEject Utility comes pre-installed on Lenovo ThinkPads and enables you to remove multiple devices quickly from your notebook, eliminating the hassle of stopping one device at a time before unplugging it.

support.lenovo.com/en_US/downloads/detail.page?LegacyDocID=MIGR-44035

6% remove it

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.