lodctr.exe
by Microsoft
System Utility
Summary
Windows Load Performance Counters - loads performance counter names and descriptions from a file.
lodctr.exe is the 1089th most commonly executed Windows program in EchoTrail's dataset, observed 1,687 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by msiexec.exe.
1089th
most commonly executed Windows program
1,687
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Windows\System3272.44%
- C:\Windows\SysWOW6427.56%
Top Hashes (SHA256)
- 7810a59464d4bd915b3225471ff32f8b4cec67d09bbbc90c67326ab264b9600741.85%
- 4570b812308c07f8c27151352ee8d9da805c58b1937cf690e9aec3f1d1ed312c14.13%
- 791956462e9da4d0bcdfbfd19b8fa55f36a278a9957912c5ffc80f1cc0379bc913.77%
- ee80b1d2fbffc368745799c460f5fe25de458034cfd8d67ae5f5e5eb81d1e5f55.53%
- 5b3b99523887c19ec261ab6f8c82e058007c4f8759a3582ce040edf291fb162b4.21%
- aeae0d1edc73e853a73fa9bc1a0836557e05910e777682d9b80e516b9c9e874d4.15%
- eeb15801cecfb3026d724ab593b0012dd75b1be23e2e82acd08d5cedd6d0f0413.07%
- 0a5fafc6f68945fb3613a7f46446f146827ed3d60ba0c8d3210055067d920b511.86%
- e64c1ce04a6ce1cfb212c723564b1faee575df75cb51c4e52fbe139bbeabab921.74%
- e500d8004edf43b4d64565c26fbcd5c708e23fc7661360616c8bb57a1b32a5891.56%
Process Ancestry
Top Grandparents
- ALsvc.exe49.59%
- msiexec.exe40.09%
- SophosUpdate.exe4.14%
- services.exe1.36%
- cmd.exe1.06%
- setup.exe0.3%
- LTSVC.exe0.23%
- QualysAgent.exe0.23%
- svchost.exe0.15%
- drvinst.exe0.08%
Top Parents
- msiexec.exe48.61%
- SophosUpdate.exe39.83%
- cmd.exe3.44%
- IAStorDataMgrSvc.exe0.71%
- NetFlowService.exe0.59%
- SWJobEngineSvc2.exe0.59%
- TiWorker.exe0.53%
- InstallUtil.exe0.47%
- nvwmi64.exe0.12%
- setup.exe0.12%
Top Children
- conhost.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about lodctr.exe
Rocky answers questions about lodctr.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.