unlodctr.exe

File Path: C:\WINDOWS\system32\unlodctr.exe
Description: Unload PerfMon Counters

Hashes

Type	Hash
MD5	`F9653878599717E490676EF3922893E8`
SHA1	`423980F613816EB9F0FFDEA4FD2A3C7D8F9364D4`
SHA256	`2FDAA18A3A6FF93705A81A008208C29465CFB47CD73F336316A22BF977C3635D`
SHA384	`31CEE773AAAA5959D95C64539494405163D848F329A0A12137E06E9C13204A33895CA0451EA0A3C0D4328F6573D2593B`
SHA512	`72600A74A004A13388ABEF8BE594F3C42750F4CF162DD5A1711738BD4C6B8F5AB6BA128A27E995E8E8B7A53B308C9713D89D6A92906FF1A86F9E754781A68EF4`
SSDEEP	`1536:tisUlubjSgyecWXFKieLcKNl+NHNVFXlMcrnmVwXLIk:ti/COlWXFHOYlMcrmy`
IMP	`1E94510F1E94CE4FF242C0CB74A35F9E`
PESHA1	`21887667D5D34762492707E167392A24BE83C310`
PE256	`31221D848740F60EBD7B9D38807C856DBD2C5EF1E015E36CE4B6130B7AC9C25E`

Runtime Data

Usage (stdout):

 
UNLODCTR 
       uninstalls a performance counter provider. 
Usage: 
       UNLODCTR <service-name> 
             uninstalls the v1.0 performance counter provider associated 
             with the <service-name> service.
       UNLODCTR /m:<manifest> 
             uninstall a v2.0 performance counter provider using the 
             provider GUID from the specified XML manifest.
       UNLODCTR /g:{ProviderGuid} 
             uninstall a v2.0 performance counter provider using the 
             specified provider GUID. The GUID should be specified in 
             registry form, i.e. {nnnnnnnn-nnnn...}
       UNLODCTR /p:<ProviderName> 
             uninstall a v2.0 performance counter provider matching the 
             specified provider name.

Note: any arguments with spaces in the names must be enclosed within double 
quotation marks.

Loaded Modules:

Path
C:\WINDOWS\System32\KERNEL32.DLL
C:\WINDOWS\System32\KERNELBASE.dll
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\system32\unlodctr.exe

Signature

Status: Signature verified.
Serial: 33000002ED2C45E4C145CF48440000000002ED
Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

Original Filename: UNLODCTR.EXE.MUI
Product Name: Microsoft Windows Operating System
Company Name: Microsoft Corporation
File Version: 10.0.22000.1 (WinBuild.160101.0800)
Product Version: 10.0.22000.1
Language: English (United States)
Legal Copyright: Microsoft Corporation. All rights reserved.
Machine Type: 64-bit

File Scan

VirusTotal Detections: 0/74
VirusTotal Link: https://www.virustotal.com/gui/file/2fdaa18a3a6ff93705a81a008208c29465cfb47cd73f336316a22bf977c3635d/detection

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

unlodctr

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Removes Performance counter names and Explain text for a service or device driver from the system registry.

[!WARNING] Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

Syntax

unlodctr <drivername>

Parameters

Parameter	Description
`<drivername>`	Removes the Performance counter name settings and Explain text for driver or service `<drivername>` from the Windows Server registry. If your `<drivername>` includes spaces, you must use quotation marks around the text, for example “Driver name”.
/?	Displays help at the command prompt.

Examples

To remove the current Performance counter names and Explain text for the Simple Mail Transfer Protocol (SMTP) service, type:

unlodctr SMTPSVC

Additional References

Command-Line Syntax Key