unlodctr.exe
by Microsoft
System Utility
Summary
Windows Unload Performance Counters - removes performance counter names and descriptions.
unlodctr.exe is the 1315th most commonly executed Windows program in EchoTrail's dataset, observed 1,014 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by SophosUpdate.exe.
1315th
most commonly executed Windows program
1,014
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Windows\System3292.6%
- C:\Windows\SysWOW647.4%
Top Hashes (SHA256)
- 9b602bd2cf08116f97e1027dd3e298ce5e2b68e80bed44f036f05b69a3fef61168.41%
- 34743faa235fce518f6de5c0c3ebdcb8caedc3dc8b2f700eaf259732713dc0246.71%
- f36f7889935b195b032fbc2df3f696f83d151dcf62629ebbc05eeb4d013e963d5.13%
- b397cb97fdd6dacbee6021d7e3a982a8419c2f61cc5803ea80b6169ce669d1215.03%
- 47cf991ca0f91adcd98af1bade9e2bce82600d842237404bd6a5313a539b2e133.36%
- a1ac0b0fdd8566f641d1ef80bf60ecad3625237a57e5f6b4c8a02740eebff0c42.57%
- dad591ca09bf5726212590e4ac6baf48fb7834136dcc2192ef04c68805adcd112.07%
- 6f76400ef2ccd76ecb67c9d005b094e7380dc321adf0d9f805943b6677f746eb1.68%
- afb4f78e997570ead44db1deb1f7ae550f7b8c3e9b62780be0a33e5a7a1ac0cf1.28%
- 5e10d3a2f580fe4298ccab926910e0f4e7e3622a258d0c6efa73a5e1fdad7b3f0.79%
Process Ancestry
Top Grandparents
- ALsvc.exe86.33%
- SophosUpdate.exe4.73%
- msiexec.exe2.37%
- cmd.exe2.23%
- Uninstall.exe0.66%
- QualysAgent.exe0.39%
- setup.exe0.39%
- drvinst.exe0.13%
- SystemSettings.exe0.13%
Top Parents
- SophosUpdate.exe66.17%
- msiexec.exe20.02%
- cmd.exe3.55%
- SWJobEngineSvc2.exe1.08%
- NetFlowService.exe0.99%
- InstallUtil.exe0.79%
- Uninstall.exe0.59%
- setup.exe0.2%
- rundll32.exe0.1%
Top Children
- conhost.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about unlodctr.exe
Rocky answers questions about unlodctr.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.