BlueHammer - Offline Registry DLL Load for Hive Parsing

Georg Lauenstein@gsec

•updated Apr 8, 2026•18•0•869

Detects loading of offreg.dll (Microsoft offline registry library) by non-standard processes. BlueHammer uses offreg.dll to parse the SAM, SYSTEM, and SECURITY hives extracted from a VSS snapshot, recovering the boot key and decrypting NTLM hashes without touching the locked live registry.