pc-system[.]hivDomain
Reported by 1 independent source · first reported by GreyNoise · last reported
Last reported 1 month ago
What the reports say
1 report, newest first · the exact sentence from each-
Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF“reg save HKLM\SYSTEM "C:\Windows\Temp\pc-system[.]hiv" /y & certutil -encode "C:\Windows\Temp\pc-system.hiv" "C:\Windows\Temp\pc-system.b64" & type "C:\Windows\Temp\pc-system.b64"Dumping the SYSTEM registry hive to disk, base64 encoding it, and verifying its output in preparation f…”
Indicators reported together
named in the same reports- netlas[.]ioin 1 report
- 528cd4e69ecfa5191adbcf6ef28667bfin 1 report
- ce870a91e8d27e8f663f0687abc60b04in 1 report
- a6437ac3d6798090a218520985d36a3fin 1 report
- fc92dfafa7aa741c5f2b9cbcf75d1d19in 1 report
- 974decb9ff4c8f9ccb0937c96d513347in 1 report
- pc-security[.]hivin 1 report
- hxxp://45.142.193[.]132:8000/lsa_collect.exein 1 report
- 45.142.193[.]132in 1 report
- hxxp://45.142.193[.]132:8089/agent5.exeURLin 1 report
Copy these 10 indicators · defanged
Also named with it: CVE-2026-81578, CVE-2026-82078, CVE-2021-42278, CVE-2021-42287, CVE-2023-27532
Thanks — we review every report.