THE HUNTER’S LEDGER
IOC Feed
OpenStrike Expanded Toolkit — 106 New Files (2026-04-08)
64 indicators extracted from this investigation's feed. Filter by type, then copy or download exactly what is on screen.
Raw JSON feedFull reportDetection rules
64 shown
TypeIndicator
ipv4 172.105.0.126
url http://172.105.0.126/au2U
url http://172.105.0.126/en_US/all.js
url http://172.105.0.126/ga.js
url http://172.105.0.126/msI4
url http://172.105.0.126/submit.php
url http://172.105.0.126:809/ga.js
sha256 008cadd72dbf3cc108000f1752e32cb6e0ebd1e5f043c4e34301598a5f64f032
sha256 03492f128fcc3910bda15f393c30ad3e04f5a50de36464d1e24038f49d889324
sha256 042761408e83155d24884a72291d9f10803becd790fbcfa6ff65e9e72eb44446
sha256 04720e01f0599ff97d85f74d1483245c59353bb5ea391f2c4c9cb6ce4ef46d35
sha256 0d050b35abaa2a47340ec925727b0d508605733676552dbc94080c2da9f863d2
sha256 3b2d746d0974bb5ffec7d21b47d793fb1eef2af930d639b2f494cbe900fe0c3e
sha256 46a74c19bc3fecb149c452c286b912999a43e7808194a55ede4d9a19e56f4081
sha256 5c65b88fe12e6116d917e0a04ca57c4d3784d283a350d9e3dcec2691fe7eff2c
sha256 5dad2214471215e262910e9dcb348cf42c62fc8d8b26a85c8e959d5f1ce78c80
sha256 6797ba96336c64648d6bcccdbead8d9ab6f18d77f0108239e31a063b32665770
sha256 6e8efd85110de376426cde809f25d50ffcbb1d0e39d11c82913757cb277e15dd
sha256 701b4f60411a26abfb137f476c9328900843ee5a49780f2fcd23a5cb15498f16
sha256 7c643568b3212363cd97511f2607ad2481b9f3b6f6a829999df469af7c0184b7
sha256 820cf45c92b9cce9536ad108fc4b8c1c501bb6f4e30119b1bef0486670de02e4
sha256 86b581e40a9ff912683b6f3579d155a8d765669acbba10d400abce451a898be5
sha256 89ec81f862be889f6e8bfbad7c3c39410a9039467f1fdfe8752f64a59e113d10
sha256 8ab7e87b34d65393618fabd5b48017d803e795064d4a290128c3eea1e54742f0
sha256 9bdb680d4368713273509e8c104c1903b9790ee725cc2319997e1da705af5ca0
sha256 ad1fc7f801bd2166edeeeb5f97fa087bb1769cde57e500a7c0eb2a844e3ad95f
sha256 af688b120db0a3b324e2cd468cfead71b7895a3c815f4026d51ac7fca0cb8ab4
sha256 b0f0fe97b653e4564db8cf24cbd4cc2cad46f9c6629b67c2f147e647729f5b46
sha256 f0fc7d3b3f7b2fa10b796102889a44d57a7ad403d2038bada3c0fbd983d13c81
sha256 f618c8073bbc18f36ebf522aa15e680bf63e867b115c27ab1546c2326507917b
sha1 12fdfc45cdc448581ba3e64479f079caedba81a3
sha1 5be73b16cfc8ea42fe0695b58da4e994a0dbcc96
sha1 811589e4982f25f92725e2bc6646d4e5d1e8b7be
sha1 c2ddca25cff8b1187dc59c67c2a7a6386b4ceba9
md5 08ca0ff3c1e3c38c6e973654689d8346
md5 1cf68b213a6ba7a2b864822cc72ed4fa
md5 3d60ae2e584a1be1c264cfdaa12a5e4d
md5 8bb4df00c120881a1945a43e2bb2379e
md5 b5d391099c1376d81ebdc91b3fc55eae
md5 b6e01011e2d38855dd6a4b10a79acffe
md5 e7765cb6d6c71277d49ef4ca7429638c
path %TEMP%\npf.sys
path C:\Windows\Temp\beacon.dll
filename artifact32svc.exe
filename artifact64svc.exe
filename beacon80.dll
filename beacon_dl.exe
filename beacon_full.exe
filename beacon_full.x64.dll
filename beacon_loader.exe
filename beacon_patched.exe
filename beacon_port80.x64.dll
filename beacon_rdi.exe
filename beacon_srdi2.exe
filename beacon_windows_x64.exe
filename beacon_x64_sniff.exe
filename covertvpn.dll
filename dll_exec.exe
filename dll_loader.exe
filename hello.exe
filename mini_beacon.exe
filename mini_beacon2.exe
filename stager_http_x64.exe
filename stager_http_x64.ps1

35 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.

Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.