reg.exe
Summary
Registry Console Tool (reg.exe) is the command-line interface for viewing, adding, modifying, and deleting Windows registry keys and values. It provides direct access to the registry for scripting and automation.
reg.exe is the 120th most commonly executed Windows program in EchoTrail's dataset, observed 180,832 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by Yammer.exe.
Behavior
Top Paths
- C:\Windows\System3289.27%
- C:\Windows\SysWOW6410.73%
Top Hashes (SHA256)
- 6b3ef0286b7f12b6dbd3bfe07f2473de16b30f2496a45985901f035cb509435f54.7%
- e15ed545e21b304df6a31e8c01f74495b43ac275ea9572911c1fd286a363e4af10.63%
- 19316d4266d0b776d9b2a05d5903d8cbc8f0ea1520e9c2a7e6d5960b6fa4dcaf10.13%
- c0e25b1f9b22de445298c1e96ddfcead265ca030fa6626f61a4a4786cc4a3b7d6.11%
- 928693d84d652dc15b3fcdc6576d790053755c5181ce6708b1110de12adae4a14.02%
- 405a70c2b6081e6fed2a4bab7b0c233fff022acbbb3d2cc92cb8876d052db9e43.4%
- 224a746aee2957c3fca376f4457cfc044c1ec99e75756195b27cab396174e2db3.15%
- c6a168c81654f5901e864c8fd61fa54f084cd8b2e0a8ac1b83eacf9eb4484f751.02%
- 4ed2a27860fa154415f65452ff1f94bd6af762982e2f3470030c504dc3c8a3541.01%
- 849f54dc526ea18d59abaf4904cb11bc15b982d2952b971f2e1b6fbf8c974b390.71%
Process Ancestry
Top Grandparents
- Update.exe89.98%
- services.exe2.59%
- explorer.exe1.58%
- powershell.exe0.43%
- cmd.exe0.4%
- Nuix-Config.exe0.38%
- Yammer.exe0.29%
- wscript.exe0.22%
- PylumLoader.exe0.22%
- nvnodejslauncher.exe0.18%
Top Parents
- Yammer.exe68.18%
- cmd.exe14.85%
- powershell.exe5.06%
- Skype.exe2.13%
- msiexec.exe1.88%
- RingCentral.exe0.93%
- cscript.exe0.9%
- Discord.exe0.62%
- Nuix-Config.exe0.6%
- optimumdesk.exe0.52%
Top Children
- conhost.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does reg.exe normally do?
Located in C:\Windows\System32 or C:\Windows\SysWOW64. In this dataset, heavily used by Yammer.exe and Skype.exe (reading/writing app settings). Also launched by cmd.exe and powershell.exe for administration. Spawns conhost.exe.
When is reg.exe suspicious?
Modifying Run/RunOnce keys (HKLM\Software\Microsoft\Windows\CurrentVersion\Run) — persistence. Querying or exporting SAM, SECURITY, or SYSTEM hives (reg save HKLM\SAM) — credential access. Disabling security features (reg add ... DisableAntiSpyware, DisableRealtimeMonitoring). Modifying firewall or UAC registry settings. Adding Image File Execution Options (IFEO) debugger entries.
How do attackers abuse reg.exe?
Persistence: adding entries to Run/RunOnce keys, Winlogon registry values, or shell extension handlers to execute malware at startup or logon. Credential theft: reg save HKLM\SAM, reg save HKLM\SECURITY, reg save HKLM\SYSTEM to extract password hashes offline. Defense evasion: disabling Windows Defender, AMSI, UAC, or firewall via registry modifications. Discovery: reg query to enumerate installed software, security configurations, and system settings.
Detection guidance
High-confidence: reg save targeting SAM, SECURITY, or SYSTEM hives. reg add modifying Windows Defender or AMSI registry keys to disable them. reg add to Run/RunOnce keys with paths to temp or user profile directories. Medium-confidence: reg add to IFEO keys (potential debugger persistence). reg query targeting security product configuration keys. Monitor Sysmon Event ID 13 (RegistryValueSet) and Event ID 12 (RegistryObject create/delete) for the underlying registry changes.
False positive notes
Applications (Yammer, Skype, Office) read and write their own registry settings heavily. Software installers modify many registry keys during installation. GPO enforcement modifies registry settings. Focus on specific high-value registry paths rather than all reg.exe activity.
Related Processes
Ask Rocky about reg.exe
Rocky answers questions about reg.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.