kdbgctrl.exe

  • File Path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\kdbgctrl.exe
  • Description: Windows kernel debugger configuration utility

Hashes

Type Hash
MD5 1FAB8BF1AA6954B89DE2490BC6345A91
SHA1 46C5E6002DF74F9724539F99EF40C02B5EEC6E39
SHA256 FD5C21D94F7342E5F4080B9424FEC378DF62D827579DFDB534B38FDC8C8ACFBE
SHA384 D8F74AAFE84EF5BBED2783F92C193E2AD875F4E90CA866E8ECA81691A7769E7C84EDFBE0242BDAC3304704B260ADBE8A
SHA512 51FF5235643B729548BD88814F317806C004F2F26536E5CBD46CE8A94A4A7E2B87F286F2B940C951A10EFE66F8CC584C28E1B22EEA0C4376725EE1B06837D840
SSDEEP 768:LGpiXKk4PuNAhq/esZmpeQfWTeK8AUaW/8hXRG+Hg:tX3zAhq/BmpGTeK8IW8hXRG+A
IMP 697390BDE2745169AF6142896A42ADEA
PESHA1 566AED31E2599F6A7BBB5169B28F30E0C507DDCC
PE256 8E4F2301F783FFD44DF00F042C458CE46E27BF5E0B297C9081675F510D8DB56D

Runtime Data

Usage (stdout):

Usage: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\kdbgctrl.exe <options>
Options:
  -c          - Check kernel debugger
  -ca         - Check kernel debugger auto-enable
  -cb         - Check kernel debugger block-enable
  -cdb        - Check kernel DbgPrint buffer size
  -cu         - Check kernel debugger user exception handling
  -cx         - Check kernel debugger enable and exit with status
  -d          - Disable kernel debugger
  -da         - Disable kernel debugger auto-enable
  -db         - Disable kernel debugger block-enable
  -du         - Disable kernel debugger user exception handling
  -e          - Enable kernel debugger
  -ea         - Enable kernel debugger auto-enable
  -eb         - Enable kernel debugger block-enable
  -eu         - Enable kernel debugger user exception handling
  -sdb <size> - Set kernel DbgPrint buffer size
  -td <pid> <file> - Get a kernel triage dump

Loaded Modules:

Path
C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\kdbgctrl.exe
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\SYSTEM32\ntdll.dll

Signature

  • Status: Signature verified.
  • Serial: 33000002CF6D2CC57CAA65A6D80000000002CF
  • Thumbprint: 1A221B3B4FEF088B17BA6704FD088DF192D9E0EF
  • Issuer: CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: kdbgctrl.exe
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/75
  • VirusTotal Link: https://www.virustotal.com/gui/file/fd5c21d94f7342e5f4080b9424fec378df62d827579dfdb534b38fdc8c8acfbe/detection

File Similarity (ssdeep match)

File Score
C:\Program Files (x86)\Windows Kits\10\Debuggers\arm64\kdbgctrl.exe 41

MIT License. Copyright (c) 2020-2021 Strontic.