CmdID

CmdID / Files

unlodctr.exe

Unload PerfMon Counters file version info

Program on Windows 12 known copies with hashes Command unlodctr

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real unlodctr.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionUnload PerfMon Counters

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\unlodctr.exe · signed by Microsoft Windows

2fdaa18a3a6ff93705a81a008208c29465cfb47cd73f336316a22bf977c3635d

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\unlodctr.exe · signed by Microsoft Windows

d2c4ae7431cb0f950246d3a0935b6f349887a9373d61b968caae8f7439d4b191

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\unlodctr.exe · signed by Microsoft Windows

68e5607d0aa1a52bff70fe53c7eb0c5d27b342886bcbfea7fbfefd4168951f9b

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\unlodctr.exe · signed by Microsoft Windows

e8eeac85a29eb75a4cf41509ea982ae1b6256d0c7cdff3299ed3df3ce34356d9

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\unlodctr.exe · signed by Microsoft Windows

706e3960a71410262d58e5c3fa31b1f0122d3d0694ed9d9cac14d2795f0b5881

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\unlodctr.exe · signed by Microsoft Windows

cc507bb7ae21b2400d4ecc64bef7d697ebced8933f3c5afed964fed302cb6de8

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\unlodctr.exe · signed by Microsoft Windows

47cf991ca0f91adcd98af1bade9e2bce82600d842237404bd6a5313a539b2e13

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\unlodctr.exe · signed by Microsoft Windows

9b602bd2cf08116f97e1027dd3e298ce5e2b68e80bed44f036f05b69a3fef611

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\unlodctr.exe · signed by Microsoft Windows

2f5fb0ea5ac2181b55c0530c28fabe5955049b80006ded555900023d902a07ed

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\unlodctr.exe · signed by Microsoft Windows

b397cb97fdd6dacbee6021d7e3a982a8419c2f61cc5803ea80b6169ce669d121

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\unlodctr.exe · not signed

5bfceb053fde7dc45d89694a71c2dc427dcc96124e29e8e31e5afb5299a05725

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\unlodctr.exe · not signed

f36f7889935b195b032fbc2df3f696f83d151dcf62629ebbc05eeb4d013e963d

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.