What is regmon.exe?

The genuine regmon.exe file is a software component of Sysinternals Regmon by Sysinternals.
Regmon.exe is the main executable that runs the Regmon program. This program monitored applications that had access to the system registry keys, and displayed data on registry usage. Regmon was discontinued after the launch of Performance Monitor, a much more comprehensive tool to display various data regarding system health. RegMon was created and maintained by Mark Russinovich and Bryce Cogswell who originally worked for Nu-Mega Technologies before moving to SysInternals. In 2006, SysInternals was bought out by Microsoft and made part of the Microsoft TechNet department which develops utilities related to diagnosing and troubleshooting Windows environments.

RegMon stands for Registry Monitor Utility

The .exe extension on a filename indicates an executable file. Executable files may, in some cases, harm your computer. Therefore, please read below to decide for yourself whether the regmon.exe on your computer is a Trojan that you should remove, or whether it is a file belonging to the Windows operating system or to a trusted application.

Click to Run a Free Scan for regmon.exe related errors

Regmon.exe file information

The process known as Generic Starting Utility or Sysinternals Registry Monitor belongs to software Sysinternals Regmon or ILYA-Corp. Generic Trial Program Starter by ILYA-Corp. Soft Group or Sysinternals (

Description: Regmon.exe is not essential for Windows and will often cause problems. Regmon.exe is located in a subfolder of "C:\Program Files". Known file sizes on Windows 10/8/7/XP are 707,384 bytes (50% of all occurrences) or 507,904 bytes. 
It is not a Windows system file. Regmon.exe is able to monitor applications and record keyboard and mouse inputs. Therefore the technical security rating is 34% dangerous; however you should also read the user reviews.

Uninstalling this variant: The software vendor offers the option to uninstall the associated program (Start > Control Panel > Uninstall a Program > HijackThis).

Recommended: Identify regmon.exe related errors

If regmon.exe is located in the C:\Windows\System32\drivers folder, the security rating is 90% dangerous. The file size is 45,056 bytes. The program has no file description. The file is an unknown file in the Windows folder. The program is not visible. The process starts upon Windows startup (see Registry key: MACHINE\Run, MACHINE\RunServices, Run). It is not a Windows core file.

Important: Some malware camouflages itself as regmon.exe, particularly when located in the C:\Windows or C:\Windows\System32 folder, for example TROJ_SPNR.03CU11 (detected by TrendMicro), and VirTool:Win32/VBInject.gen!FC (detected by Microsoft). Therefore, you should check the regmon.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.


User Comments

I have been experiencing a The file is contained in the text info. Also there is a path from IE which makes it run in the background from time to time.This program is not from Microsoft.
  Robert Roosendaal  
Very helpful tool to watch registry manipulations
  Jakob Krieger  

Summary: Average user rating of regmon.exe: based on 2 votes with 2 user comments. One user thinks regmon.exe is essential for Windows or an installed application. One user suspects danger.

Do you have additional information? Help other users!
What do you know about regmon.exe:
How would you rate it:
Link for more info:
Your Name:

Best practices for resolving regmon issues

A clean and tidy computer is the key requirement for avoiding problems with regmon. This means running a scan for malware, cleaning your hard drive using cleanmgr and sfc /scannow, uninstalling programs that you no longer need, checking for Autostart programs (using msconfig) and enabling Windows' Automatic Update. Always remember to perform periodic backups, or at least to set restore points.

Should you experience an actual problem, try to recall the last thing you did, or the last thing you installed before the problem appeared for the first time. Use the resmon command to identify the processes that are causing your problem. Even for serious problems, rather than reinstalling Windows, you are better off repairing of your installation or, for Windows 8 and later versions, executing the DISM.exe /Online /Cleanup-image /Restorehealth command. This allows you to repair the operating system without losing data.

To help you analyze the regmon.exe process on your computer, the following programs have proven to be helpful: Security Task Manager displays all running Windows tasks, including embedded hidden processes, such as keyboard and browser monitoring or Autostart entries. A unique security risk rating indicates the likelihood of the process being potential spyware, malware or a Trojan. Malwarebytes Anti-Malware detects and removes sleeping spyware, adware, Trojans, keyloggers, malware and trackers from your hard drive.

Other processes

regmon.exe [all]