# reg.exe
Handy for manipulating the registry!

## Exporting registry hives with captured TGTs from Rubeus
```
reg export HKLM\SOFTWARE\MONITOR backup1.reg 
```

This example is from a TGT-dumping attack that [Rubeus](/pentesting/Internal/rubeus) can pull off.