regjump.exe

  • File Path: C:\SysinternalsSuite\regjump.exe
  • Description: Jumps in Regedit

Hashes

Type Hash
MD5 F10231DF28521535FDF2191EAEC343C6
SHA1 2ED03BA6EF4BE5913BF352741EE89B220CD3FF2C
SHA256 6D123B57BD9F4A13EDD8FDC75A56ADD5B0ED4E2B5FBC021B67366B62A527DCF7
SHA384 7C849507D33CFC2802F25217101856895D3DE1F88D73A6CE6AA6D0CE09E149840C9105210A1B75111F71F746BE7E4E92
SHA512 5FAAA7C0F0C58EF9115072CEECE9BE805731D44104072DA0AB61B284CD5B06916A1FF71A20E7562C8D75879AEB965B90D805E5762EB0990D638ADA2C53FF094F
SSDEEP 1536:WBv3x9Vekx04khrFvUIn8igQQ54H6S98x4v62R43cnXnxsWjcdvS3M9SwREBse3A:E/7orZPtQZszn48uvgM9SwEVTD0
IMP E4BE657D0C5E65D8555632EE8711FA26
PESHA1 5CCA73AA7E036C746EDFC41B3B79D0118D63AC21
PE256 1E7CAEF97CAE84583B444B11241939AFD681AAFA1D70D73C5B467510C7FA827E

Runtime Data

Usage (stdout):


Regjump v1.1
Copyright (C) 2013-2015 Mark Russinovich
Sysinternals - www.sysinternals.com

Not a valid registry path: C:\TEMP\STRONTIC-XCYCLOPEDIA\NOTEPAD.EXE

Usage (stderr):

usage: regjump <<path>|-c>
  -c    Copy path from clipboard.
e.g.: regjump HKLM\Software\Microsoft\Windows

Loaded Modules:

Path
C:\SysinternalsSuite\regjump.exe
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\wow64.dll
C:\Windows\System32\wow64cpu.dll
C:\Windows\System32\wow64win.dll

Signature

  • Status: Signature verified.
  • Serial: 330000010A2C79AED7797BA6AC00010000010A
  • Thumbprint: 3BDA323E552DB1FDE5F4FBEE75D6D5B2B187EEDC
  • Issuer: CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: regjump.exe
  • Product Name: Sysinternals Regjump
  • Company Name: Sysinternals - www.sysinternals.com
  • File Version: 1.1
  • Product Version: 1.1
  • Language: English (United States)
  • Legal Copyright: Copyright 2013-2015 Mark Russinovich
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/68
  • VirusTotal Link: https://www.virustotal.com/gui/file/6d123b57bd9f4a13edd8fdc75a56add5b0ed4e2b5fbc021b67366b62a527dcf7/detection/

Possible Misuse

The following table contains possible examples of regjump.exe being misused. While regjump.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_false_sysinternalsuite.yml - '\regjump.exe' DRL 1.0

MIT License. Copyright (c) 2020-2021 Strontic.