Registry Hive Dump via Reg.exe to Temp Directory

Kaung Khant Ko@kaungkhantko

•updated May 27, 2026•1•0•109

Detects the use of reg.exe to save the SAM, SECURITY, or SYSTEM hives to the Temp directory for offline credential cracking, as observed in Seedworm espionage campaigns.