regedit.exe
Sources: 300M+ executions observed in the wild.
Summary
Windows Registry Editor - GUI tool for viewing and modifying the Windows registry.
regedit.exe is the 1003rd most commonly executed Windows program in EchoTrail's dataset, observed 2,052 times across enterprise environments. It typically runs from C:\Windows and it is most often launched by bomgar-scc.exe.
Get this in your tools
The same record for regedit.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/regedit.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Windows75.58%
- C:\Windows\SysWOW6424.42%
Top Hashes (SHA256)
- 33b0ed8a05fda2ba39e8aaa86b38cd289f412c7c1b04519016ba9a60a8ba0d6140%
- d5de45decfd0fa08ac12f5725dfc7e5af1e3ed0325559101990fdcf02c43944116.01%
- 476bb8e2150e6878a44688bd33b0897de077271a7e2d6f28f20c9a4bb74860e37.08%
- 254b18a8cc6589af666ee17ce4e76c67350aecf578206cc7678745ed47a32d635.39%
- 432412a22725c3737ef71e972ffbde90f71fe23bdc124edb8038ed6232f769954.54%
- dce18e2279073ba64a6f35d17120fdca9a4902faef0c99cd96a5d673209e132f3.99%
- 5ed3039b9675075ad5696305b511dceac690a9305e73b8afb49a0ff3187ed1d23.44%
- d67043429a29b21307e1655db2512dc36280fffb26feeb3cf618e604c655b7ea3.34%
- 8eca20b56293ad31401a5ffb5b70ce4a3412c16f5093b441cc7b209efcb4c95f2.69%
- 7acc4a0b686d829d4d4c8afbf9e38e562be5a6f708a1c2273358aa7e41e1cb972.39%
Process Ancestry
Top Grandparents
- bomgar-scc.exe62.12%
- userinit.exe8.44%
- svchost.exe7.56%
- explorer.exe6.41%
- gpscript.exe0.81%
- services.exe0.61%
- msiexec.exe0.41%
- winlogon.exe0.41%
- cmd.exe0.34%
Top Parents
- cmd.exe21.25%
- explorer.exe11.4%
- RuntimeBroker.exe7.07%
- msiexec.exe1.75%
- regedt32.exe0.73%
- regsvr32.exe0.19%
- drvinst.exe0.15%
Security Analysis
What does regedit.exe normally do?
Used by administrators to inspect and modify registry settings. Can import/export .reg files.
When is regedit.exe suspicious?
Exporting SAM, SECURITY, or SYSTEM hives. Importing .reg files from temp directories. Running from scripts or automated tools.
How do attackers abuse regedit.exe?
Attackers use "regedit /e" to export registry hives containing credentials or security settings. Registry modifications are central to many persistence techniques (Run keys, services, COM hijacking). Can import malicious .reg files for persistence.
Detection guidance
Monitor for regedit export operations targeting sensitive hives. Alert on regedit invocations with /s (silent import) flag from scripts.
False positive notes
IT administrators regularly use regedit for troubleshooting and configuration.
Related Processes
Ask Rocky about regedit.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for regedit.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.