regedit.exe
Summary
Windows Registry Editor - GUI tool for viewing and modifying the Windows registry.
regedit.exe is the 1003rd most commonly executed Windows program in EchoTrail's dataset, observed 2,052 times across enterprise environments. It typically runs from C:\Windows and it is most often launched by bomgar-scc.exe.
Behavior
Top Paths
- C:\Windows75.58%
- C:\Windows\SysWOW6424.42%
Top Hashes (SHA256)
- 33b0ed8a05fda2ba39e8aaa86b38cd289f412c7c1b04519016ba9a60a8ba0d6140%
- d5de45decfd0fa08ac12f5725dfc7e5af1e3ed0325559101990fdcf02c43944116.01%
- 476bb8e2150e6878a44688bd33b0897de077271a7e2d6f28f20c9a4bb74860e37.08%
- 254b18a8cc6589af666ee17ce4e76c67350aecf578206cc7678745ed47a32d635.39%
- 432412a22725c3737ef71e972ffbde90f71fe23bdc124edb8038ed6232f769954.54%
- dce18e2279073ba64a6f35d17120fdca9a4902faef0c99cd96a5d673209e132f3.99%
- 5ed3039b9675075ad5696305b511dceac690a9305e73b8afb49a0ff3187ed1d23.44%
- d67043429a29b21307e1655db2512dc36280fffb26feeb3cf618e604c655b7ea3.34%
- 8eca20b56293ad31401a5ffb5b70ce4a3412c16f5093b441cc7b209efcb4c95f2.69%
- 7acc4a0b686d829d4d4c8afbf9e38e562be5a6f708a1c2273358aa7e41e1cb972.39%
Process Ancestry
Top Grandparents
- bomgar-scc.exe62.12%
- userinit.exe8.44%
- svchost.exe7.56%
- explorer.exe6.41%
- gpscript.exe0.81%
- services.exe0.61%
- msiexec.exe0.41%
- winlogon.exe0.41%
- cmd.exe0.34%
Top Parents
- cmd.exe21.25%
- explorer.exe11.4%
- RuntimeBroker.exe7.07%
- msiexec.exe1.75%
- regedt32.exe0.73%
- regsvr32.exe0.19%
- drvinst.exe0.15%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does regedit.exe normally do?
Used by administrators to inspect and modify registry settings. Can import/export .reg files.
When is regedit.exe suspicious?
Exporting SAM, SECURITY, or SYSTEM hives. Importing .reg files from temp directories. Running from scripts or automated tools.
How do attackers abuse regedit.exe?
Attackers use "regedit /e" to export registry hives containing credentials or security settings. Registry modifications are central to many persistence techniques (Run keys, services, COM hijacking). Can import malicious .reg files for persistence.
Detection guidance
Monitor for regedit export operations targeting sensitive hives. Alert on regedit invocations with /s (silent import) flag from scripts.
False positive notes
IT administrators regularly use regedit for troubleshooting and configuration.
Related Processes
Ask Rocky about regedit.exe
Rocky answers questions about regedit.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.