Registry Export of SAM Hive to Temp

Ibrahim Saud@tektrix

•updated Jun 17, 2026•1•0•4

Detects reg.exe saving the SAM hive directly to \Windows\Temp\, indicative of offline credential cracking.