Identifier / Programs / Windows
regini.exe
Modifies the registry from the command line or a script, and applies changes that were preset in one or more text files. Windows commands reference
LOLBAS ADS 2 Sigma rules name it 2 ATT&CK techniques 1 documented command 12 known copies with hashes
How regini.exe is abused
ADS T1564.004 Hide Artifacts: NTFS File Attributes
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for regini.exe.
1 documented command
ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges
Write registry keys from data inside the Alternate data stream.
regini.exe {PATH}:hidden.iniTrips 1 Sigma rule: highSuspicious Registry Modification From ADS Via Regini.EXE by Eli Salem, Sander Wiebing, oscd.community
The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for regini.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for regini.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real regini.exe?
C:\Windows\system32\C:\Windows\SysWOW64\12 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\regini.exe · signed by Microsoft Windows
7604e1a172d4fe0006b68c66e5f780b5a2137d3475cad7a8c3d1040acae3085310.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\regini.exe · signed by Microsoft Windows
e7801a52687e767dca7667bd983b13ff5a8d302013ee359dcd0e4f423b1cc9a510.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\regini.exe · signed by Microsoft Windows
04d137f3f2873a75fab8d71d54e79b5792d047854b7b7501cc9d4e2b231d1cb110.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\regini.exe · signed by Microsoft Windows
c2ee2ffe2fae173188c3568c47c8090347e6cb09085c249936df2d52c0521dbb10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\regini.exe · signed by Microsoft Windows
cb161024f2c006402f88da9f1dc9f2cd782c3e959d02c2d48600288fc1bad69610.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\regini.exe · signed by Microsoft Windows
d7e1669e51e9c921bc70aeda2e9dd7005e3298137638a7dabee39730e3550fad10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\regini.exe · signed by Microsoft Windows
40ed5ee39901b8537bcbc487b939ed7f50ec3a86eaf248db1783641daa0e47c910.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\regini.exe · signed by Microsoft Windows
ce02c12cff31e588ee786462599f38528f899eab8690eda74744d04215107dff10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\regini.exe · signed by Microsoft Windows
b376e9da3ec084b011120483f63b155b02d054bbdfa28a842f274f8f121fa6e310.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\regini.exe · signed by Microsoft Windows
f8c2840361890958e4863fc81d52c59c213292577abe6a285ec2ddbd344545076.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\regini.exe · not signed
a5d8218a742a01f72799f89d12a7cdd55feca4c01853ca4ef0b55d5c2dbb569f6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\regini.exe · not signed
ced97ac768997b34fc37e4661e66ebf3d253cb068931bb4f2faf1ddded3016dcFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
Options
Show every option of regini.exe
-mSpecifies the remote computer name with a registry that is to be modified.-hSpecifies the local registry hive to modify.-iSpecifies the level of indentation to use to indicate the tree structure of registry keys in the command output.-oSpecifies the width of the command output, in characters.-bSpecifies that regini.exe output is backward compatible with previous versions of regini.exe.