lodctr.exe

File Path: C:\Windows\system32\lodctr.exe
Description: Load PerfMon Counters

Hashes

Type	Hash
MD5	`38983AF776238A60E94DEEF341353378`
SHA1	`C67BD43CD017E9285CA9BCBA41AC3B922B163F26`
SHA256	`A68DC00716E93540692CE686922B1CF6D3F216FC9E0396C6D6B7291778DBA6ED`
SHA384	`F855A0F93B27B0ABB1070D6F042B8AA04B961E272B45FC1F5AD1124530B9E2CBC78DA6F67EB0CBA3A9831B89D90D988B`
SHA512	`F65BBC41151E5EE063815A4D6EBBB128286D5CBD63D3A562143865FBA0BD8ACF085F897F4C1B3FCDC0108D704A5944100A43580E403591819D369893DCCF4D1F`
SSDEEP	`768:iHUfeo733JISlfCczwkT/AEzQOGByniogtI0gq9J8wHplMcJ0/JECwmS2k:6U33LlJzdGByi9t/J5lMc+ECwmS2k`
IMP	`161F3C69B9F275480C338BBAB3DA4D6E`
PESHA1	`3BA6400DC7595E91F49C30AA7A82D0F0CF21EE2A`
PE256	`9D18CE526328DD917ABB9D0A8BD77E81BCC0BCDE4599C36A82B9163E3AC6CC17`

Runtime Data

Usage (stdout):

 
LODCTR 
       Updates registry values related to performance counters. 
Usage: 
       LODCTR <INI-filename> 
             Installs counter text strings. INI-filename is the name of the 
             initialization file that contains the counter name definitions 
             and explain text for an extensible counter DLL.

       LODCTR /C:<filename> 
             Upgrades counter text strings using <filename>

       LODCTR /H:<filename> 
             Upgrades help text strings using <filename>

       LODCTR /L:<LangID> 
             Specifies the language for the /C and /H commands

       LODCTR /S:<Backup-filename> 
             Saves the current perf registry strings and info to 
             <Backup-filename>

       LODCTR /R 
             Rebuilds perf registry from scratch based on current registry 
             settings and backup INI files.

       LODCTR /R:<filename> 
             Restores perf registry strings & info using <filename>

       LODCTR /T:<service-name> 
             Sets the specified performance counter provider as trusted.

       LODCTR /Q 
             Displays performance counter provider information.

       LODCTR /Q:<service-name> 
             Displays performance counter provider information for a 
             specific provider.

       LODCTR /E:<service-name> 
             Enables the performance counter provider.

       LODCTR /D:<service-name> 
             Disables the performance counter provider.

       LODCTR /M:<Counter-Manifest> [<Installation-Path>]
             Installs a v2.0 performance counter provider using the specified 
             XML manifest. 

             The installation requires a full path to the DLL containing the 
             performance counter resources (localized  strings). The path 
             to the DLL will be determined as follows:

             If the applicationIdentity attribute in the manifest is a full 
             path, that will be used.

             Otherwise, if <Installation-Path> is provided and is a full 
             path, that will be used.

             Otherwise, if <Counter-Manifest> is a full path, the directory 
             from <Counter-Manifest> will be combined with the DLL name from 
             the applicationIdentity attribute in the manifest.

             Otherwise, the current directory will be combined with the DLL 
             name from the applicationIdentity attribute in the manifest.

Note: Any arguments with spaces in the names must be enclosed within double 
quotation marks.

Loaded Modules:

Path
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\system32\lodctr.exe
C:\Windows\SYSTEM32\ntdll.dll

Signature

Status: Signature verified.
Serial: 3300000266BD1580EFA75CD6D3000000000266
Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

Original Filename: LODCTR.EXE.MUI
Product Name: Microsoft Windows Operating System
Company Name: Microsoft Corporation
File Version: 10.0.19041.1 (WinBuild.160101.0800)
Product Version: 10.0.19041.1
Language: English (United States)
Legal Copyright: Microsoft Corporation. All rights reserved.
Machine Type: 64-bit

File Scan

VirusTotal Detections: 0/75
VirusTotal Link: https://www.virustotal.com/gui/file/a68dc00716e93540692ce686922b1cf6d3f216fc9e0396c6d6b7291778dba6ed/detection

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

lodctr

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Allows you to register or save performance counter name and registry settings in a file and designate trusted services.

Syntax

lodctr <filename> [/s:<filename>] [/r:<filename>] [/t:<servicename>]

Parameters

Parameter	Description
`<filename>`	Specifies the name of the initialization file that registers the performance counter name settings and explanatory text.
/s:`<filename>`	Specifies the name of the file to which the performance counter registry settings and explanatory text are saved.
/r	Restores counter registry settings and explanatory text from current registry settings and cached performance files related to the registry.
/r:`<filename>`	Specifies the name of the file that restores the performance counter registry settings and explanatory text.<p>Warning: If you use this command, you’ll overwrite all performance counter registry settings and explanatory text, replacing them with the configuration defined in the specified file.
/t:`<servicename>`	Indicates that service `<servicename>` is trusted.
/?	Displays help at the command prompt.

Remarks

If the information that you supply contains spaces, use quotation marks around the text (for example, “file name 1”).

Examples

To save the current performance registry settings and explanatory text to file “perf backup1.txt”, type:

lodctr /s:"perf backup1.txt"

Additional References

Command-Line Syntax Key