regedt32.exe
Summary
Registry Editor Utility
regedt32.exe is the 5035th most commonly executed Windows program in EchoTrail's dataset, observed 18 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by cmd.exe.
5035th
most commonly executed Windows program
18
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Windows\System3266.67%
- C:\Windows\SysWOW6433.33%
Top Hashes (SHA256)
- 418bbe71fb6f3093adf8874fccf236ce21fd3c95be3277d5836e9cce43b5d5e950%
- 99dd30fe985593bfd3f2d7a1837fc8c0bb528c9d3be919bd2788bf50c740a59f25%
- 9e6a5efe9f3404bb8039cb33934a7fa8a91199f80f7b15298f4f40a85446878c16.67%
- 29e7de537955adf3a991d5c0c6b34e52400b0a955de3d1b666ea8711e4a2df908.33%
Process Ancestry
Top Grandparents
- explorer.exe41.18%
- chrome.exe17.65%
- firefox.exe17.65%
- userinit.exe17.65%
- svchost.exe5.88%
Top Parents
- cmd.exe38.89%
- explorer.exe22.22%
- nmap-7.70-setup.exe16.67%
- RuntimeBroker.exe5.56%
Top Children
- regedit.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about regedt32.exe
Rocky answers questions about regedt32.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.