Lenovo.Modern.ImController.PluginHost.Device.exe
Summary
Lenovo Vantage Device Plugin Host - hosts device management plugins for Lenovo Vantage.
Lenovo.Modern.ImController.PluginHost.Device.exe is the 379th most commonly executed Windows program in EchoTrail's dataset, observed 21,104 times across enterprise environments. It typically runs from C:\Program Files\Lenovo\ImController\PluginHost and it is most often launched by Lenovo.Modern.ImController.exe.
Behavior
Top Paths
- C:\Program Files\Lenovo\ImController\PluginHost60.14%
- C:\Program Files (x86)\Lenovo\ImController\PluginHost39.16%
- C:\Windows\Lenovo\ImController\PluginHost860.4%
- C:\Windows\Lenovo\ImController\PluginHost0.3%
Top Hashes (SHA256)
- df11b70bbce2f714e9c59ada481f7afe316037db15a64adc44613bafe537675024.47%
- 21763e6dac072a0d27b2f9e4a53d8f2f2ea1ff8b36d7d689982940ad3bad79d017.65%
- fc5212703ef51a8c523f483ede7cf6613c894c0bee53bc61e7242607d2cbb47315.53%
- 996e7614a622a490eca73a5c956e7b47bcc53e78f7d97e671f2a614ad5fa5eae9.84%
- ee5f9bf1ee9f3e70bf30e465899d8eccbb5b75f7b68f9c1947341d2c10995a7c9.15%
- 4f249be090b4e199d35dc69252be669472defdf0954bc01676686f416b89808f5.56%
- beda48eb78aed6843f624a117f2c3392565deae882033eb002860d9ab57710172.67%
- ecb691ea3bcfdea5a5c405f7a68909bcb4fd8e10f2ef6d936e6a4a4469d87f8d2.07%
- b1f46fa2ca8f2c56606f131519d16a64ac9489dc4c087ebcc17772faf89eaba51.67%
- 1827fb02b543418e0480c86a78995a274891b49ba08b6b25dca05bc9a2f80fa41.59%
Process Ancestry
Top Grandparents
- services.exe99.98%
- cmd.exe0.02%
Top Parents
Top Children
- icacls.exe32.79%
- mofcomp.exe28.5%
- mefwdetect.exe6.58%
- getw10ver.exe5.41%
- detectwmi.exe4.82%
- fwchksd.exe4.33%
- setup.exe0.71%
- rundll32.exe0.52%
- schtasks.exe0.28%
- cmd.exe0.23%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about Lenovo.Modern.ImController.PluginHost.Device.exe
Rocky answers questions about Lenovo.Modern.ImController.PluginHost.Device.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.