Skip to content
THE HUNTER’S LEDGER
IOC Feed
HijackLoader / Penguish / Rugmi to AsyncRAT Multi-Vector Phishing Campaign
144 indicators extracted from this investigation's feed. Filter by type, then copy or download exactly what is on screen.
Raw JSON feedFull reportDetection rules
144 shown
TypeIndicatorConfidenceFP risk
ipv4 109.120.137.6HIGH
ipv4 185.241.208.129DEFINITE
ipv4 62.60.237.100DEFINITE
ipv4 80.253.249.186HIGH
domain microsoft.com-app.ccHIGH
domain nda2026.zipHIGH
domain onedrive.toDEFINITE
domain price.zipHIGH
domain price2026.zipHIGH
domain www-microsoft.liveHIGH
url http://109.120.137.6/PUTTY.exeHIGH
url http://62.60.237.100:80/Documents/DEFINITE
url http://62.60.237.100:80/Documents/Carriers.exeHIGH
url http://62.60.237.100:80/download/Documents/DEFINITE
url http://80.253.249.186:5504/BugSplat.dllHIGH
url http://80.253.249.186:5504/COMSupport.dllHIGH
url http://80.253.249.186:5504/DBGHelp.dllHIGH
url http://80.253.249.186:5504/DVDSetting.dllHIGH
url http://80.253.249.186:5504/NLEResource.dllHIGH
url http://80.253.249.186:5504/NLETransitionMgr.dllHIGH
url http://80.253.249.186:5504/WSUtilities.dllHIGH
url http://80.253.249.186:5504/WS_ImageProc.dllHIGH
url http://80.253.249.186:5504/WS_Log.dllHIGH
url http://80.253.249.186:5504/WsBurn.dllHIGH
url https://s3.g.s4.mega.io/aileqac3yep7oqdhygjpberqqnk2zrnhck2lx/busket/Bravo/vida/NGZTDICF.exeHIGH
url https://s3.g.s4.mega.io/aileqac3yep7oqdhygjpberqqnk2zrnhck2lx/busket/putty.exeHIGH
url https://s3.g.s4.mega.io/aileqac3yep7oqdhygjpberqqnk2zrnhck2lx/busket/putty2.exeHIGH
sha256 00103e807a4d31570f9c11cea37310d7464b8f275e62f4517b071daeb3c47a29HIGH
sha256 005161d5e2be81c4af5facea96fe901c51cff16cedbd31be7211d07bf92c8963HIGH
sha256 1861e9cd45136ed09f60391450171658c995a5ea6b0b9361658cc69db7fea10cHIGH
sha256 1afbe5d960af45832539b11e92a09b808f0c3868ab437a7ef1b5d1bd5e16d0c3HIGH
sha256 2303fa9d3836f99eb40ab338f4ddc40521299501d117be65b19ff9f61e2beb88HIGH
sha256 253fdb10a694c8749fc83554ac458dd0592ef40cd87755ab558d4719b6e202efHIGH
sha256 2d8728f0f371107ff124a39b3c9f624cae115f8b6cc6ec87fbeb96fc8c2b51e6HIGH
sha256 30200bcf6fab87862f9348cac03f97a3d8d735040314163dda173635291087dcHIGH
sha256 3480d0478d35d8a12331b97769401e16e4956bdc24b9a7175ae08e2c9e9acf8fMODERATE
sha256 3666f859cc9f49957a150b6fed225dc8226160ef173161edccd15dd68fffef88HIGH
sha256 4b2595eee4a24d2caa885e9fe6bf06d5fed9aa3a40d94b75f766b4433bcddbc2HIGH
sha256 4c765ffe43c1fa4be6a33d6c5bc76bdca989be2f780f416a4815e0b6bf956603HIGH
sha256 5268a97aea245c15220126d4ddb7e10d56a47d2d1492efd859da8e4223f9ecb0HIGH
sha256 5273fc9f5c5c754bf37c58a391fe9ea7d98de470f042d2478d3beb0b71838b77HIGH
sha256 585f41db259ff0150f717e0862dcc4c6df91b1b5624439037420736d1d35c80bDEFINITE
sha256 6091a6e5ce9a8e0d7f896ebd3dfd798ac41a7c355a48e5643dfcf798437cf736HIGH
sha256 68bee500e0080f21c003126e73b6d07804d23ac98b2376a8b76c26297d467abeDEFINITE
sha256 68fb61225b457172368d43af7ec2afe48f59404089d095584944edbfd0171febDEFINITE
sha256 692ed97141059a1481fa2aacd5d48f037792f5bfddfa44f72078fc7256c764adHIGH
sha256 7d366451fcd530c4493a75bc577283a96f28fc8a72e64310e8742f561068725cHIGH
sha256 7e2000ceb89574fe95e819f5f47da346119b666b7f64e8b5b01e5152e37d76cfDEFINITE
sha256 8477b9fb3f6aaa7d2d50a661a238ff1ac34ab58df6638e535cc004587d209e0cHIGH
sha256 8667ef6e2d71585f963dc7076c3409390f5d63da6b66e02a0194b6d4ea448a0fMODERATE
sha256 8ad22e349a1cb327857228f179cefc0ff25f9d36e5267312dfee96b5646f9915HIGH
sha256 8e302ffb38ff4ef382baadb06f5e644e1a007b241573f54f96b9bebcd7ddb211HIGH
sha256 90193252040e222733522603e17be8c21e52cd04cd99897392aea189a78bb217HIGH
sha256 990a90036c974aaecef681776fb28972f5a3a72d044308339c974eb37990e9bcHIGH
sha256 a1cc69dfb1350f4c9fe1a9ef24c27fd2d72eea9407457c472fbb98c49aa6b6b9HIGH
sha256 a35073d242f8325801766660b9effd52993b99f1f370a947d4ec5688b0b0341aHIGH
sha256 a3d0a9c71be732cdaafc7c1a9ef00c2a5a01e93b4a29c8944f8ea14a79f52ce0HIGH
sha256 a98ce0c5bb2933100f84ff1adb8c4ece702a42cbb70f1154c9855c35a3889a90HIGH
sha256 b4098f2bb99ce112fb27560237b84a52d9303fade048b8f83ac40f0d082ee2f7HIGH
sha256 b51c6db1160f9c55c404a7202bad5378a1f1bbb6bd0b5f45af4fcb770ea989ebHIGH
sha256 b8da80a5ecdeb2536911cb38c878014d6873aad998f4f510301929146717941fHIGH
sha256 c085a724a067eec46d9a2c1eeae3cc04db33b9840f5c33eb87cc3027e12a6bcdHIGHHash is legitimate Qihoo 360 product, only flag when dropped to non-standard paths (C:\ProgramData\WVault.exe)
sha256 c2b7b67e9daafef4847d99b4014b7ba77369fb776bba333a585f16d736c192e4MODERATE
sha256 c2e62475768c9546efe1da92a55f3bb2a55350eed83241139917aabd1ad25f8aHIGH
sha256 d8b5f0befed26af5c5d1d2d8307bc54145c7472189145668600be6c6a2aaca31HIGH
sha256 dd4874b7646798264bf6e204ca74ab3b4e4f7b7b4124bd16ce6cbd9d2d5e28c9HIGH
sha256 dd4ec224c574a9d1f301568a1b82ed57ed1d0a5efe8b725138dfd23361b3f624HIGH
sha256 df54bff16203d07df01eda47fe57aefa5cf4847a0f1d48e2b43e115a6173cd9bHIGH
sha256 e3a777326a9a1a91d3224b90683642db22d2b7143dd21985200b9ac3ad2afc05HIGH
sha256 f1ba9ec2ec964bb29c8999d88b0ca8496ab23e9f44fecf5cc819ed62e447dee5HIGH
sha256 f9bd3434f8be8b13890c5a8f4c200cf1447d2a4199b29ff37f645fee90ae1e1dHIGH
sha256 fd89aea524a9c6b77efcf0d9d350f2fd625525887a1ef078017d8ceee0eaafeeHIGH
md5 051ba42fa7a26bf65df9922daa07c458HIGH
md5 07af4aa9e4d215a5ee63f9a0a277fbe3DEFINITE
md5 1730e17c2277c47cd6c40037d2f12133HIGH
md5 1a8abfce832bdbfe1c3ba9a134948e63HIGH
md5 33bc1ffdcc8fc3aa7646fc2cb1a0a5e5HIGH
md5 34ea62976f42c141fa01de955bc809f4HIGH
md5 5f9f88c9a16b62dc38504549e93d3667HIGH
md5 8a331882e1fcfed10f2664231c7ce1afHIGH
md5 921f3ea587ffbd647ff4d520165ecd50HIGH
md5 9fe84f7e1a8efc69d6169f47f9b67257HIGH
md5 a4b240cce6e3da6e959f33bd82394034HIGH
md5 ab9e4224c1ccf1355ae462a22ff3253eHIGH
md5 adcd9682585d11d95f17bb6ffa76f15eHIGH
md5 e8ac1646024d52d1534a88da2e8037cdHIGH
path C:\ProgramData\WVault.exeHIGH
path C:\ProgramData\adv_ctrlHIGH
path C:\ProgramData\adv_ctrl\HIGH
path C:\ProgramData\adv_ctrl\CrystSupervisor32.exeHIGH
path C:\Users\*\AppData\Local\Temp\????????.tmpMODERATEGeneric %TEMP% .tmp pattern is broad. Pair with env var names of length 8-16
path C:\Users\*\AppData\Local\Temp\is-*.tmp\CrystSupervisor32.exeHIGH
path C:\Users\*\AppData\Local\Temp\is-*.tmp\ExceptionHandler.dllHIGH
path C:\Users\*\AppData\Local\Temp\is-*.tmp\networkspec17.logHIGH
path C:\Users\*\AppData\Local\Temp\is-*.tmp\shadermgr93.rcHIGH
path C:\Users\*\AppData\Roaming\adv_ctrl\Crisp.exeHIGH
path C:\Windows\System32\Tasks\watchermgmtHIGH
path C:\Windows\Tasks\watchermgmt.jobHIGH
path D:\project\MediaAuthorLib\NLEPlatform\SymbolTable\Release\NLEService.pdb
path I:\CompanySource\Plowshare\Src\Symbol\Release\ExceptionHandler.pdb
path \\.\pipe\WondershareCrashServicesHIGH
path \\microsoft.com-app.cc\download\6f14\putty.exeHIGH
path \\onedrive.to\DavWWWRoot\Carriers\HIGH
path \\onedrive.to\DavWWWRoot\Carriers\putty.exeHIGH
path \\onedrive.to\download\Documents\NDA_Agreements.PDF_2025-12-22-06-50-39-658.exeHIGH
registry HKCU\Software\Microsoft\Office\1[6,9].0\Excel\SecurityHIGH
registry HKCU\Software\Microsoft\Office\1[6,9].0\Word\SecurityHIGH
registry HKEY_USERS\\Software\Microsoft\SystemCertificates\Root\Certificates\0174E68C97DDF1E0EEEA415EA336A163D2B61AFDHIGH
registry HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\PathsHIGH
registry HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{1F2952E4-FC07-4482-B9E6-E795507DA7D2}_is1HIGH
filename 1.mscHIGH
filename 13223.lnkHIGH
filename 807d7b6.tmpHIGH
filename 865fdfd.tmpHIGH
filename carriers.exeHIGH
filename carriers.tmpHIGH
filename carriers_agreements_009rcarheffd..scrHIGH
filename crisp.exeHIGH
filename crystsupervisor32.exeHIGH
filename cytotoxin.exeHIGH
filename excel_2016_windows.batHIGH
filename exceptionhandler.dllHIGH
filename macros64_2_.xllHIGH
filename mozhno-li-vyvesti-dengi-s-krakena.html
filename mscfile.mscHIGH
filename mwxtckdb.exeHIGH
filename nda.docHIGH
filename nda_agreementsfdp.msiHIGH
filename nda_verification222.urlHIGH
filename networkspec17.logDEFINITE
filename nleservice.dllMODERATE
filename ppmanlyp.exeMODERATE
filename price2.pdf.mscHIGH
filename price3.xllHIGH
filename price4.xlsHIGH
filename price5.docmHIGH
filename price6.docHIGH
filename shadermgr93.rcDEFINITE
filename sss.lnkHIGH
filename stage2_shellcode.binHIGH
filename vfszqptv.exeHIGH
filename vsezbsrabotat.urlHIGH
filename watchermgmt.jobHIGH
filename xxx.lnkHIGH

83 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.

Do not block

These values came out of this investigation, but blocking them would break something legitimate, whether a shared service, a bystander's infrastructure, or the victim's own equipment. They are listed here because they still matter for hunting, and they are deliberately excluded from the copy and download buttons above.

TypeIndicatorWhy it stays off a blocklist
ipv4 23.106.161.1 Appears only embedded in the CAB filename '1468_US_23.106.161.1_28-01-26.cab', which follows the kit's per-victim customization pattern, and resolves to a Synology QuickConnect / Leaseweb VPN address on AS7203. It is more likely the victim or an unrelated third party than operator infrastructure, held at LOW confidence, and the UNC5267 cluster overlap on it is incidental. Do not block it at the perimeter without independent verification; treat it as a host to investigate, not an address to deny.
domain g.s4.mega.io Mega.io subdomain; VT 1/58 malicious
domain goproxy.github.io Open-source GoProxy MITM proxy project; appears as CN in CA cert installed by pe_06 for HTTPS interception; the project itself is legitimate but cert install in user trust store is malicious
domain s3.g.s4.mega.io Mega.io abuse, operator bucket aileqac3yep7oqdhygjpberqqnk2zrnhck2lx; subdir 'busket' (typo); hosts putty.exe, putty2.exe, Bravo/vida/NGZTDICF.exe; VT 13/60 malicious
sha256 30b9b877aa1112105069be6b4de794b7a7147a1d968e71fa63f2edc7397e126f These hashes are GENUINE legitimate vendor binaries co-located in the operator bundle as camouflage. They have valid Authenticode signatures and exist in legitimate vendor distributions worldwide. DO NOT add to generic blocklists, flag only when found in operator drop paths (C:\ProgramData\adv_ctrl\, %TEMP%\is-*.tmp\). Generic hash blocking would cause massive false positives across legitimate user populations.
sha256 3594a835ed3dbf80ac460c0e852fa91baa3b17aadff9c3b40c03eff6b34658d2 These hashes are GENUINE legitimate vendor binaries co-located in the operator bundle as camouflage. They have valid Authenticode signatures and exist in legitimate vendor distributions worldwide. DO NOT add to generic blocklists, flag only when found in operator drop paths (C:\ProgramData\adv_ctrl\, %TEMP%\is-*.tmp\). Generic hash blocking would cause massive false positives across legitimate user populations.
sha256 41050f6f6919a4516d481f7c9b5fe6074c447afc6e9cc28d180982eea50ae165 These hashes are GENUINE legitimate vendor binaries co-located in the operator bundle as camouflage. They have valid Authenticode signatures and exist in legitimate vendor distributions worldwide. DO NOT add to generic blocklists, flag only when found in operator drop paths (C:\ProgramData\adv_ctrl\, %TEMP%\is-*.tmp\). Generic hash blocking would cause massive false positives across legitimate user populations.
sha256 44f009ca786bc541cda11c61bab7b272e96ce9e3d656c10bdac2e126f3a9cc35 These hashes are GENUINE legitimate vendor binaries co-located in the operator bundle as camouflage. They have valid Authenticode signatures and exist in legitimate vendor distributions worldwide. DO NOT add to generic blocklists, flag only when found in operator drop paths (C:\ProgramData\adv_ctrl\, %TEMP%\is-*.tmp\). Generic hash blocking would cause massive false positives across legitimate user populations.
sha256 4b33ee0e8a4153c0c8ccd945adb18d8f91b5b824746a15986bf6781f081f9968 These hashes are GENUINE legitimate vendor binaries co-located in the operator bundle as camouflage. They have valid Authenticode signatures and exist in legitimate vendor distributions worldwide. DO NOT add to generic blocklists, flag only when found in operator drop paths (C:\ProgramData\adv_ctrl\, %TEMP%\is-*.tmp\). Generic hash blocking would cause massive false positives across legitimate user populations.
sha256 58ef42507d9fc1e8a7b240ef5cddc9f600c3d9a61ee6a42a4045278bb332b86a These hashes are GENUINE legitimate vendor binaries co-located in the operator bundle as camouflage. They have valid Authenticode signatures and exist in legitimate vendor distributions worldwide. DO NOT add to generic blocklists, flag only when found in operator drop paths (C:\ProgramData\adv_ctrl\, %TEMP%\is-*.tmp\). Generic hash blocking would cause massive false positives across legitimate user populations.
sha256 718cfb5195d0e43e795627c781fb3f427856f1cf29f33eedbbc6059b6f214549 These hashes are GENUINE legitimate vendor binaries co-located in the operator bundle as camouflage. They have valid Authenticode signatures and exist in legitimate vendor distributions worldwide. DO NOT add to generic blocklists, flag only when found in operator drop paths (C:\ProgramData\adv_ctrl\, %TEMP%\is-*.tmp\). Generic hash blocking would cause massive false positives across legitimate user populations.
sha256 729e5965e43ff458f6da901536c9a43be52a3820718e2dd5456150e2d73bb97f These hashes are GENUINE legitimate vendor binaries co-located in the operator bundle as camouflage. They have valid Authenticode signatures and exist in legitimate vendor distributions worldwide. DO NOT add to generic blocklists, flag only when found in operator drop paths (C:\ProgramData\adv_ctrl\, %TEMP%\is-*.tmp\). Generic hash blocking would cause massive false positives across legitimate user populations.
sha256 7cd5072111581133c5e28b56bef060b3d3b0d8acca3396ef23c6c384eb292d25 These hashes are GENUINE legitimate vendor binaries co-located in the operator bundle as camouflage. They have valid Authenticode signatures and exist in legitimate vendor distributions worldwide. DO NOT add to generic blocklists, flag only when found in operator drop paths (C:\ProgramData\adv_ctrl\, %TEMP%\is-*.tmp\). Generic hash blocking would cause massive false positives across legitimate user populations.
sha256 8fcae9719a3f831cb73ef50b587a6222ff73d6c1a6ae617636cb31c6e02d5e3a These hashes are GENUINE legitimate vendor binaries co-located in the operator bundle as camouflage. They have valid Authenticode signatures and exist in legitimate vendor distributions worldwide. DO NOT add to generic blocklists, flag only when found in operator drop paths (C:\ProgramData\adv_ctrl\, %TEMP%\is-*.tmp\). Generic hash blocking would cause massive false positives across legitimate user populations.
sha256 b1038928a6da2a1b5064a27187403563f3ab7e8d4ec034dfa8d5d3f6be231191 These hashes are GENUINE legitimate vendor binaries co-located in the operator bundle as camouflage. They have valid Authenticode signatures and exist in legitimate vendor distributions worldwide. DO NOT add to generic blocklists, flag only when found in operator drop paths (C:\ProgramData\adv_ctrl\, %TEMP%\is-*.tmp\). Generic hash blocking would cause massive false positives across legitimate user populations.
sha256 c1275ddf04a0942b416c1a0b2d32003a4eda732c6f97c74181c236e35d12420f These hashes are GENUINE legitimate vendor binaries co-located in the operator bundle as camouflage. They have valid Authenticode signatures and exist in legitimate vendor distributions worldwide. DO NOT add to generic blocklists, flag only when found in operator drop paths (C:\ProgramData\adv_ctrl\, %TEMP%\is-*.tmp\). Generic hash blocking would cause massive false positives across legitimate user populations.
sha256 c50bffbef786eb689358c63fc0585792d174c5e281499f12035afa1ce2ce19c8 These hashes are GENUINE legitimate vendor binaries co-located in the operator bundle as camouflage. They have valid Authenticode signatures and exist in legitimate vendor distributions worldwide. DO NOT add to generic blocklists, flag only when found in operator drop paths (C:\ProgramData\adv_ctrl\, %TEMP%\is-*.tmp\). Generic hash blocking would cause massive false positives across legitimate user populations.
sha256 ca9f859f01940c1d4cfe7465460485398e2de8606e3a4eea977a430555c3bcae These hashes are GENUINE legitimate vendor binaries co-located in the operator bundle as camouflage. They have valid Authenticode signatures and exist in legitimate vendor distributions worldwide. DO NOT add to generic blocklists, flag only when found in operator drop paths (C:\ProgramData\adv_ctrl\, %TEMP%\is-*.tmp\). Generic hash blocking would cause massive false positives across legitimate user populations.
sha256 e841fe9fa09ddc4292f22db95cb2d348d8f37594513f5848d545db92e3b07c66 These hashes are GENUINE legitimate vendor binaries co-located in the operator bundle as camouflage. They have valid Authenticode signatures and exist in legitimate vendor distributions worldwide. DO NOT add to generic blocklists, flag only when found in operator drop paths (C:\ProgramData\adv_ctrl\, %TEMP%\is-*.tmp\). Generic hash blocking would cause massive false positives across legitimate user populations.
sha256 fcebe8bee86d02093380c7c2eb6dd083ec4d765ed1dae9a1d9fbc1a6328a7778 These hashes are GENUINE legitimate vendor binaries co-located in the operator bundle as camouflage. They have valid Authenticode signatures and exist in legitimate vendor distributions worldwide. DO NOT add to generic blocklists, flag only when found in operator drop paths (C:\ProgramData\adv_ctrl\, %TEMP%\is-*.tmp\). Generic hash blocking would cause massive false positives across legitimate user populations.
sha1 bc99a77a68f18005cac0c784a176d3199f735ecf GENUINE Wondershare cert; signs legitimate Wondershare DVD Creator and other products; adding to revocation feeds would block legit customers worldwide
md5 059917fd7718808bc34be224e415216f GENUINE Wondershare cert; signs legitimate Wondershare DVD Creator and other products; adding to revocation feeds would block legit customers worldwide
filename bugsplat.dll These hashes are GENUINE legitimate vendor binaries co-located in the operator bundle as camouflage. They have valid Authenticode signatures and exist in legitimate vendor distributions worldwide. DO NOT add to generic blocklists, flag only when found in operator drop paths (C:\ProgramData\adv_ctrl\, %TEMP%\is-*.tmp\). Generic hash blocking would cause massive false positives across legitimate user populations.
filename comsupport.dll These hashes are GENUINE legitimate vendor binaries co-located in the operator bundle as camouflage. They have valid Authenticode signatures and exist in legitimate vendor distributions worldwide. DO NOT add to generic blocklists, flag only when found in operator drop paths (C:\ProgramData\adv_ctrl\, %TEMP%\is-*.tmp\). Generic hash blocking would cause massive false positives across legitimate user populations.
filename dbghelp.dll These hashes are GENUINE legitimate vendor binaries co-located in the operator bundle as camouflage. They have valid Authenticode signatures and exist in legitimate vendor distributions worldwide. DO NOT add to generic blocklists, flag only when found in operator drop paths (C:\ProgramData\adv_ctrl\, %TEMP%\is-*.tmp\). Generic hash blocking would cause massive false positives across legitimate user populations.
filename dvdsetting.dll These hashes are GENUINE legitimate vendor binaries co-located in the operator bundle as camouflage. They have valid Authenticode signatures and exist in legitimate vendor distributions worldwide. DO NOT add to generic blocklists, flag only when found in operator drop paths (C:\ProgramData\adv_ctrl\, %TEMP%\is-*.tmp\). Generic hash blocking would cause massive false positives across legitimate user populations.
filename nleresource.dll These hashes are GENUINE legitimate vendor binaries co-located in the operator bundle as camouflage. They have valid Authenticode signatures and exist in legitimate vendor distributions worldwide. DO NOT add to generic blocklists, flag only when found in operator drop paths (C:\ProgramData\adv_ctrl\, %TEMP%\is-*.tmp\). Generic hash blocking would cause massive false positives across legitimate user populations.
filename nletransitionmgr.dll These hashes are GENUINE legitimate vendor binaries co-located in the operator bundle as camouflage. They have valid Authenticode signatures and exist in legitimate vendor distributions worldwide. DO NOT add to generic blocklists, flag only when found in operator drop paths (C:\ProgramData\adv_ctrl\, %TEMP%\is-*.tmp\). Generic hash blocking would cause massive false positives across legitimate user populations.
filename ws_imageproc.dll These hashes are GENUINE legitimate vendor binaries co-located in the operator bundle as camouflage. They have valid Authenticode signatures and exist in legitimate vendor distributions worldwide. DO NOT add to generic blocklists, flag only when found in operator drop paths (C:\ProgramData\adv_ctrl\, %TEMP%\is-*.tmp\). Generic hash blocking would cause massive false positives across legitimate user populations.
filename ws_log.dll These hashes are GENUINE legitimate vendor binaries co-located in the operator bundle as camouflage. They have valid Authenticode signatures and exist in legitimate vendor distributions worldwide. DO NOT add to generic blocklists, flag only when found in operator drop paths (C:\ProgramData\adv_ctrl\, %TEMP%\is-*.tmp\). Generic hash blocking would cause massive false positives across legitimate user populations.
filename wsburn.dll These hashes are GENUINE legitimate vendor binaries co-located in the operator bundle as camouflage. They have valid Authenticode signatures and exist in legitimate vendor distributions worldwide. DO NOT add to generic blocklists, flag only when found in operator drop paths (C:\ProgramData\adv_ctrl\, %TEMP%\is-*.tmp\). Generic hash blocking would cause massive false positives across legitimate user populations.
filename wsutilities.dll These hashes are GENUINE legitimate vendor binaries co-located in the operator bundle as camouflage. They have valid Authenticode signatures and exist in legitimate vendor distributions worldwide. DO NOT add to generic blocklists, flag only when found in operator drop paths (C:\ProgramData\adv_ctrl\, %TEMP%\is-*.tmp\). Generic hash blocking would cause massive false positives across legitimate user populations.

Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.