CmdID

CmdID / Files

lodctr.exe

Load PerfMon Counters file version info

Program on Windows 12 known copies with hashes 1 Sigma rule names it Command lodctr

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real lodctr.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionLoad PerfMon Counters

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\lodctr.exe · signed by Microsoft Windows

a2646227a4f70ca5188424796a53e092718abe535a6299c0d5a0fdfa65092867

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\lodctr.exe · signed by Microsoft Windows

e56d0c81ef4df6b1c5ee32e65a60a0c692b1c54d60161d1bbaabedf4a935d908

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\lodctr.exe · signed by Microsoft Windows

3915bfb4520c2947e3dc9b4bdd4af56aabdeda1923b60f17a6e742a2231ea50d

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\lodctr.exe · signed by Microsoft Windows

a68dc00716e93540692ce686922b1cf6d3f216fc9e0396c6d6b7291778dba6ed

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\lodctr.exe · signed by Microsoft Windows

8f2a9cda849446e9312441429f26fc6a13c2428e512ee84c58fb837d2be8065f

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\lodctr.exe · signed by Microsoft Windows

af64080aaa7f5b9841828ddd6afcf78e03980445707c77917a20e5da7d407e9e

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\lodctr.exe · signed by Microsoft Windows

7810a59464d4bd915b3225471ff32f8b4cec67d09bbbc90c67326ab264b96007

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\lodctr.exe · signed by Microsoft Windows

914650f6dc5783422e107159e0b69a0917d43cd5016ecdc14f06577a11ff36f0

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\lodctr.exe · signed by Microsoft Windows

aeae0d1edc73e853a73fa9bc1a0836557e05910e777682d9b80e516b9c9e874d

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\lodctr.exe · signed by Microsoft Windows

e64c1ce04a6ce1cfb212c723564b1faee575df75cb51c4e52fbe139bbeabab92

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\lodctr.exe · not signed

be3ee03e1829dd4a86af9037f4d85529ed32d5940ab22e2b7c4c675424cd016b

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\lodctr.exe · not signed

eeb15801cecfb3026d724ab593b0012dd75b1be23e2e82acd08d5cedd6d0f041

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name lodctr.exe
mediumRebuild Performance Counter Values Via Lodctr.EXENasreddine Bencherchali (Nextron Systems)