rstrui.exe
by Microsoft
Operating System
Sources: 300M+ executions observed in the wild.
Summary
System Restore UI — manages Windows restore points
rstrui.exe is the 1371st most commonly executed Windows program in EchoTrail's dataset, observed 911 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by bomgar-scc.exe.
Get this in your tools
The same record for rstrui.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/rstrui.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
1371st
most commonly executed Windows program
911
observed endpoint executions
Behavior
Top Paths
- C:\Windows\System32100%
Top Hashes (SHA256)
- 0bbd6778b2150292f3b61bd6b164e7747226776b8ccfcc485d5028a92a85594a50.61%
- 72f9dc01caa34419fe1874137df1fb44f4c132c5cebb62fde86f3b9da3fefc0316.87%
- b1aacd2735f524f8460c031a4f66e78fb09cffbc7350fac5695d448a287fb7cb10.03%
- daa6e9c22e556113d07813f151553df976e02cf1b11a84e0d925c709a7959f0a7.39%
- c31a147ca0d6bf00f9c93f6bcc84ec137ef1bfb22d00f23e9df0d432dd54fdb53.2%
- 277341b416424aea462f74ff03dd1a46deca687a6751ae9a2d5d5902c03bde6b2.32%
- 5ec5e3182e9458b4f8f72693ccbbe1060e8173476c54ca568a0a21e3ea46f0972.32%
- 5a0a9c08c2d07d2e370974c023a288f8e8526b43ebaf12151dce0b42a23368691.65%
- 68676bf040d791f06fdf4e1d4f5e0234243253b5d529e4b9df9448bc5314104e1.43%
- 28bb332d73ddd4147c6009cb10ac073b6072be2114554f85c5c37f557af0fc8b1.21%
Process Ancestry
Top Grandparents
- bomgar-scc.exe97.79%
- explorer.exe1.52%
- userinit.exe0.35%
- RuntimeBroker.exe0.23%
- runonce.exe0.12%
Top Parents
- bomgar-scc.exe98.9%
- explorer.exe0.44%
- rstrui.exe0.22%
- runonce.exe0.22%
Top Children
- rstrui.exe100%
Ask Rocky about rstrui.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for rstrui.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.