tphkload.exe
by Lenovo
Driver/Hardware
Summary
Lenovo ThinkPad Hotkey Loader - loads ThinkPad special function key handlers.
tphkload.exe is the 1056th most commonly executed Windows program in EchoTrail's dataset, observed 1,795 times across enterprise environments. It typically runs from C:\Program Files\Lenovo\HOTKEY and it is most often launched by services.exe.
1056th
most commonly executed Windows program
1,795
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Program Files\Lenovo\HOTKEY90.86%
- C:\Windows\System32\DriverStore\FileRepository\fn.inf_amd64_a6dc7343c725f003\driver5.91%
- C:\Windows\System32\DriverStore\FileRepository\fn.inf_amd64_869da559d9f23739\driver2.95%
- C:\Windows\System32\DriverStore\FileRepository\fn.inf_amd64_c7fd03342aa4d253\driver0.28%
Top Hashes (SHA256)
- 07ddf944ad395c2412f4c5fb01056671ec2246a284d00be9b3541dd0bee6045133.15%
- 328d08607a48d6a4be0fe457e3243fec383584f107dc2cfd970652715eaf468831.2%
- 33c6ac0e879b6916e155dd1970c1879a0f3f7aa66e693e792c341b8126b03f9817.83%
- 78baca3576ae07b9b132ca05fa0d6090d46856601b6aefb9ec8bdfdd1d2af1416.18%
- 8d83f28cfbe3f2c082e762ae1f2162e260ac102ec0e3c4b0c2760494167218835.91%
- 2247f76b036f0ee279568d79a001fe5eef1f9d9af1145047632791a9ebbb5ea52.95%
- c4992acb4bb2bbb7249b52791bf4e5ed67ac854998733a7bbc6ceb3275d6726d1.34%
- 53fee2f251ba3c3e7117c6cd0458c33e73443d2bbb57cf4e9de9a92e932524a81.17%
- 1ee1272820b15967a46e99493b1621841e1a3f2513bdbd30f8b40a52f665686a0.28%
Process Ancestry
Top Grandparents
- wininit.exe99.94%
- services.exe0.06%
Top Parents
- services.exe99.94%
- tphkload.exe0.06%
Top Children
- tposd.exe42.7%
- tpnumlkd.exe37.8%
- shtctky.exe16.89%
- setup.exe0.03%
- WerFault.exe0.02%
- tphkload.exe<0.01%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about tphkload.exe
Rocky answers questions about tphkload.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.