tracerpt.exe

  • File Path: C:\WINDOWS\SysWOW64\tracerpt.exe
  • Description: Event Trace Report Tool

Hashes

Type Hash
MD5 84B8707021CDA784A713F6D30B0028EA
SHA1 85937C721CAE8B987059CA5BD2B4CCFEB3692612
SHA256 420C6F7B9423866BBE1A256334B4A64F627CACDD28AB657E988FE8A88082568B
SHA384 4AE688921D9CC2B119DD5FFE0FBDC41BAE9189E0BD76F375ED742A44770067C9254FC1D00FAD59F5CE4827E2A2668D91
SHA512 0305B709BAA40A70FF16AF3FB17B0B4474AC85159969A323AA3855C8F784E8DCD95B384D84ECF5756C81BF82B2E4F91EC59C880B0D78B36AF0C04B7A105B3C70
SSDEEP 6144:XR5aQMz8IcE1nBgXuS7hJEHjJqWj+e6e1rQbxv76xtDj1go9yWZ:BTMz8Ic+nBauqr8Exv76b31gC
IMP 7F152B73F28DD1DA0AFEDE261CE9FC21
PESHA1 FA468CA1D106654463A9E187A7F8486C051C5424
PE256 655FE78A97558DE3A5C1A28ED881521B7114E9FB7363FC66D2FB5CBEA1A8B621

Runtime Data

Usage (stdout):


Microsoft r TraceRpt.Exe (10.0.22000.1)

Usage:
  C:\WINDOWS\SysWOW64\tracerpt.exe <[-l] <value [value [...]]>|-rt <session_name [session_name [...]]>> [options]

Options:
  -?                            Displays context sensitive help.
  -config <filename>            Settings file containing command options.
  -y                            Answer yes to all questions without prompting.
  -f <XML|HTML>                 Report format.
  -of <CSV|EVTX|XML>            Dump format, the default is XML.
  -en <ANSI|Unicode>            Output file encoding. Only allowed with CSV
                                output format.
  -df <filename>                Microsoft specific counting/reporting schema
                                file.
  -import <filename [filename [...]]> Event Schema import file.
  -int <filename>               Dump interpreted event structure into
                                specified file.
  -rts                          Report raw timestamp in event trace header. 
                                Can only be used with -o, not -report or
                                -summary.
  -tmf <filename>               Trace Message Format definition file
  -tp <value>                   TMF file search path.  Multiple paths can be
                                used, separated with ';'.
  -i <value>                    Specifies the provider image path.  The
                                matching PDB will be located in the Symbol
                                Server. Multiple paths can be used, separated
                                with ';'.
  -pdb <value>                  Specifies the symbol server path.  Multiple
                                paths can be used, separated with ';'.
  -gmt                          Convert WPP payload timestamps to GMT time
  -rl <value>                   System Report Level from 1 to 5, the default
                                value is 1.
  -summary [filename]           Summary report text file. Default is
                                summary.txt.
  -o [filename]                 Text output file. Default is dumpfile.xml.
  -report [filename]            Text output report file. Default is
                                workload.xml.
  -lr                           Less restrictive; use best effort for events
                                not matching event schema.
  -export [filename]            Event Schema export file. Default is
                                schema.man.
  [-l] <value [value [...]]>    Event Trace log file to process.
  -rt <session_name [session_name [...]]> Real-time Event Trace Session data
                                source.

Examples:
  tracerpt logfile1.etl logfile2.etl -o logdump.xml -of XML
  tracerpt logfile.etl -o logdmp.xml -of XML -lr -summary logdmp.txt -report logrpt.xml
  tracerpt logfile1.etl logfile2.etl -o -report
  tracerpt logfile.etl counterfile.blg -report logrpt.xml -df schema.xml
  tracerpt -rt "NT Kernel Logger" -o logfile.csv -of CSV


Loaded Modules:

Path
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\System32\wow64.dll
C:\WINDOWS\System32\wow64base.dll
C:\WINDOWS\System32\wow64con.dll
C:\WINDOWS\System32\wow64cpu.dll
C:\WINDOWS\System32\wow64win.dll
C:\WINDOWS\SysWOW64\tracerpt.exe

Signature

  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: TraceRpt.Exe
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.22000.1 (WinBuild.160101.0800)
  • Product Version: 10.0.22000.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/73
  • VirusTotal Link: https://www.virustotal.com/gui/file/420c6f7b9423866bbe1a256334b4a64f627cacdd28ab657e988fe8a88082568b/detection

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.


tracerpt

The tracerpt command parses Event Trace Logs, log files generated by Performance Monitor, and real-time Event Trace providers. It also generates dump files, report files, and report schemas.

Syntax

tracerpt <[-l] <value [value [...]]>|-rt <session_name [session_name [...]]>> [options]

Parameters

Parameters Description
-config <filename> Specifies which settings file to load, which includes your command options.
-y Specifies to answer yes to all questions, without prompting.
-f <XML | HTML> Specifies the report file format.
-of <CSV | EVTX | XML> Specifies the dump file format. The default is *XML.
-df <filename> Specifies to create a Microsoft-specific counting/reporting schema file.
-int <filename> Specifies to dump the interpreted event structure to the specified file.
-rts Specifies to add the report raw timestamp in the event trace header. Can only be used with -o. It’s not supported with -report or -summary.
-tmf <filename> Specifies which Trace Message Format definition file to use.
-tp <value> Specifies the TMF file search path. Multiple paths may be used, separated by a semicolon (;).
-i <value> Specifies the provider image path. The matching PDB will be located in the Symbol Server. Multiple paths can be used, separated by a semicolon (;).
-pdb <value> Specifies the symbol server path. Multiple paths can be used, separated by a semicolon (;).
-gmt Specifies to convert WPP payload timestamps to Greenwich Mean Time.
-rl <value> Specifies the System Report Level from 1 to 5. Default is 1.
-summary [filename] Specifies to create a summary report text file. The filename, if not specified, is summary.txt.
-o [filename] Specifies to create a text output file. The filename, if not specified, is dumpfile.xml.
-report [filename] Specifies to create a text output report file. The filename, if not specified, is workload.xml.
-lr Specifies to be less restrictive. This uses best efforts for events that don’t match the events schema.
-export [filename] Specifies to create an Event Schema export file. The filename, if not specified, is schema.man.
[-l] <value [value […]]> Specifies the Event Trace log file to process.
-rt <session_name [session_name […]]> Specifies the Real-time Event Trace Session data sources.
-? Displays help at the command prompt.

Examples

To create a report based on the two event logs logfile1.etl and logfile2.etl, and to create the dump file logdump.xml in XML format, type:

tracerpt logfile1.etl logfile2.etl -o logdump.xml -of XML

To create a report based on the event log logfile.etl, to create the dump file logdmp.xml in XML format, to use best efforts to identify events not in the schema, and to produce a summary report file logdump.txt and a report file, logrpt.xml, type:

tracerpt logfile.etl -o logdmp.xml -of XML -lr -summary logdmp.txt -report logrpt.xml

To use the two event logs logfile1.etl and logfile2.etl to produce a dump file, and to report file with the default filenames, type:

tracerpt logfile1.etl logfile2.etl -o -report

To use the event log logfile.etl and the performance log counterfile.blg to produce the report file logrpt.xml and the Microsoft-specific XML schema file schema.xml, type:

tracerpt logfile.etl counterfile.blg -report logrpt.xml -df schema.xml

To read the real-time Event Trace Session NT Kernel Logger and to produce the dump file logfile.csv in CSV format, type:

tracerpt -rt NT Kernel Logger -o logfile.csv -of CSV

Additional References


MIT License. Copyright (c) 2020-2021 Strontic.