Report - 0ee5c618e696…df860ea2e2

Malicious CriticalFILE

Quota 38

First seen: 2026-08-16T17:16:22Z
Last seen: 2026-10-29T05:47:14Z

THREAT SIGNALHigh Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYlazytrojan

RELATED INDICATORS20Connections in this report

ANALYSISMaliciousRecent

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: 0ee5c618e696e87a0b48b3bea554ffe7faeb497924d08673e41457df860ea2e2
SHA1: 7ad29a96c42a78b48575a3ccb35e2b55acbf0c97
MD5: 860c604c127817285f3d9e4d7162e2ec
Filename: HeroXCheat.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 1630208
Compile time: 2026-07-13T16:18:03Z
PE platform: x64 64-bit
PE sections: 8

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 20. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 62%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections62%

VirusSign confidence100%

Relationship context20 visible

Threat classificationlazy

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

20 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

e51ead3b81a2333b3de8aff0b8afc08d5eddb0d6da781f2036975672b3f42a69

0% vba 1227 bytes drops

Filename hx_debug.log File type vba MIME text/plain Size 1227 SHA1 6fa85c1a1d7ba91a7800542aacbf0da7e8be154f

6bb4a8ac22caf5491c637a58435578f9a26c240c2f3d601b8db285114d511f18

0% pedll 2232 bytes drops

Filename 5fvo1w0.exe File type pedll MIME application/vnd.microsoft.portable-executable Size 2232 Compile time 2025-11-25T20:32:30Z

1440f1cd393f56a2cd3b25d0480b1c9cd158103bca0b33afe88220a423f82042

0% pedll 2016 bytes drops

Filename x4xrfx5.exe File type pedll MIME application/vnd.microsoft.portable-executable Size 2016 Compile time 2025-11-25T20:32:30Z

148c56cc0b79875a87c3ce91b693ab4a1966a1cc31597366856f3a7ff3e69483

0% peexe 2016 bytes drops

Filename nwc3fd0.exe File type peexe MIME application/vnd.microsoft.portable-executable Size 2016 Compile time 2025-12-26T02:12:01Z

63045e2017065b69aeb3c10728d4cec6b353c15d568ca65aa32947682f00989c

0% peexe 2880 bytes drops

Filename p2cl2.exe File type peexe MIME application/vnd.microsoft.portable-executable Size 2880 Compile time 2025-12-26T02:12:01Z

Related IPs

Network IPs associated with this indicator.

5shown

5.175.206.21

11% high DE communicates

CIDR 5.175.206.0/24 Network 5.175.206.0-5.175.206.255 First seen 2026-03-19T18:32:19Z Last seen 2026-11-12T11:38:45Z

23.15.3.154

0% US communicates

CIDR 23.15.0.0/21 Network 23.0.0.0-23.15.255.255 First seen 2026-02-14T04:23:53Z Last seen 2026-11-12T09:30:54Z

172.67.168.125

0% US communicates

CIDR 172.67.128.0/17 Network 172.64.0.0-172.71.255.255 First seen 2023-10-01T03:00:19Z Last seen 2026-11-12T17:52:42Z

104.21.38.212

0% US communicates

CIDR 104.21.0.0/17 Network 104.16.0.0-104.31.255.255 First seen 2023-09-29T00:49:59Z Last seen 2026-11-12T17:52:42Z

23.53.35.166

0% US communicates

CIDR 23.53.32.0/21 Network 23.32.0.0-23.67.255.255 First seen 2024-02-17T05:44:09Z Last seen 2026-11-11T15:17:22Z

Related domains

Domains associated with this indicator.

5shown

yr.c.lencr.org

0% .org communicates

Root lencr.org TLD org Subdomain yr.c First seen 2025-11-04T11:49:44Z Last seen 2026-11-12T17:49:28Z

ye.c.lencr.org

0% .org communicates

Root lencr.org TLD org Subdomain ye.c First seen 2025-11-02T02:06:16Z Last seen 2026-11-12T16:32:21Z

yr1.c.lencr.org

0% .org communicates

Root lencr.org TLD org Subdomain yr1.c First seen 2026-01-07T04:56:35Z Last seen 2026-11-12T17:49:28Z

ye2.c.lencr.org

0% .org communicates

Root lencr.org TLD org Subdomain ye2.c First seen 2026-01-08T01:32:39Z Last seen 2026-11-12T12:59:13Z

pee-files.nl

30% high .nl communicates

Root pee-files.nl TLD nl First seen 2025-11-16T15:30:07Z Last seen 2026-11-12T16:19:02Z

Related URLs

URLs associated with this indicator.

5shown

https://discord.com/api/webhooks/1525012434631393351/JXFkkctoFMVthRHh…

0% communicates

TLD com HTTP status 200 Content length 400 Content SHA256 3f0ab4c313f11c1c287dba51dfe32e99adeff945b2aa4a6419748b2c9adbb186 First seen 2026-08-17T10:01:58Z

https://exo-api.tf/Stb/PokerFace/init.php?…

38% high communicates

TLD tf HTTP status 200 Content length 216636 Content SHA256 0acd78c5fa6a66ecf82e3e179917bee536e0f5d1546945af13332d6eaad6dc63 First seen 2026-08-17T10:01:58Z

https://exo-api.tf/Stb/PokerFace/init.php?…

38% high communicates

TLD tf HTTP status 200 Content length 216636 Content SHA256 3b3c6b268ed5dffa8d618ef41e5d0d39df3a038df5f6af6bcb7a4329c6f1585d First seen 2026-08-17T10:01:58Z

https://exo-api.tf/index.php?…

41% high communicates

TLD tf HTTP status 200 Content length 12489164 Content SHA256 d89f7e8fc5cdd7e6f07dce366fe10505191f6decef6786068d0980a444d41a07 First seen 2026-08-17T10:01:58Z

http://c.pki.goog/we1/f3ewCkQVMyI.crl

0% communicates

TLD goog HTTP status 200 Content length 467 Content SHA256 59326ca4f26f4a81470023c0faa2b124743407dc3506a1b370bb94cc2fdffea8 First seen 2024-07-17T19:11:51Z

Analysis details

Severity: criticaltrojan64bitexepolymorphicdebug-checkexec-delayspywarestealerexecutionwmi-activityadapter-discoverymacro-ps

Freshness: Recent · Last seen 14 days ago.

Detection rate: 62%
Threat type: trojan
Family: lazy
Confidence: 100%
detection: 62 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 0ee5c618e696e87a0b48b3bea554ffe7faeb497924d08673e41457df860ea2e2
SHA1: 7ad29a96c42a78b48575a3ccb35e2b55acbf0c97
MD5: 860c604c127817285f3d9e4d7162e2ec
Filename: HeroXCheat.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 1630208
Compile time: 2026-07-13T16:18:03Z
PE platform: x64 64-bit
PE sections: 8
Import libraries: 7
TLSH: T18F758E47B7B800F8C0A7C178C9165A07EBB2780517749BDF56908A6A6F23FE11E7E325
SSDEEP: 24576:vUHW+/GSAab1M1jngkSGYlvosqarz1guWvEJtX9vh3EwXz69uDww4NB3Cy2D:p+/GglHo8JtXD8uDwwc8y2
Imphash: 0869e3569b70c9c67d0f02a695ecccbb
Richhash: c78e08415697c0105e9b95762d61030a
First seen: 2026-08-16T17:16:22Z
Last seen: 2026-10-29T05:47:14Z
Filename variants: 2 reported

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 20. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 62%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type trojan and family lazy.

Relationship context

20 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

21 timestamped observations are arranged from 2023-09-29 to 2026-08-17. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 62%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 20 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification lazy

Classification context: type trojan, family lazy.

Intelligence freshness Recent

Last seen 14 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: HeroXCheat.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 1630208
Compile time: 2026-07-13T16:18:03Z
PE platform: x64 64-bit
Entry point: 1507328
Sections: 8

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

wmi-activityadapter-discoverydebug-checkexec-delaymacro-psobfuscated

View details · 5 shown

A HTTP/S link was seen in a script or command line
A document or script file initiated network communications indicative of a potential exploit or payload download
A document or script wrote an executable file to disk
A process created a hidden window
A scripting utility was executed

5 shown

View MITRE ATT&CK details · 5 shown

T1059 · T1071 — A HTTP/S link was seen in a script or command line
Tactics: TA0002 · TA0011
T1059 — A document or script wrote an executable file to disk
Tactics: TA0002
T1564.003 — A process created a hidden window
Tactics: TA0005
T1059 · T1064 — A scripting utility was executed
Tactics: TA0002 · TA0005
T1055 — Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching
Tactics: TA0004 · TA0005

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
Anti-Static Analysis
Objectives: OB0002
B0009.005 — Check Registry Keys
Objectives: OB0001
E1059 — Command and Scripting Interpreter
Objectives: OB0009
Communication
Objectives: OC0006

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCP, UDPports 443, 80, 53

5+ outbound connections observed
5+ domains, 5+ IPs, 5+ URLs
Common ports: 443, 80, 53
Protocols: HTTP, TCP, UDP

View details · 5 shown

Domain: vcc-library.uk
URL: https://vcc-library.uk/stb/retev.php?bl=yqbdrnzzvh6cctokqopre001.txt
Protocol: HTTP

Domain: pee-files.nl
URL: https://pee-files.nl/stb/retev.php?bl=yqbdrnzzvh6cctokqopre001.txt
Protocol: HTTP

Domain: exo-api.tf
URL: https://exo-api.tf/stb/pokerface/init.php?id=o9bpig5ysa0xzjj8fsst40g
Protocol: HTTP

Domain: exo-api.tf
URL: https://exo-api.tf/stb/pokerface/init.php?id=ash1ejl1tdmqmnjiin8o4l3
Protocol: HTTP

Domain: exo-api.tf
URL: https://exo-api.tf/index.php?security=1&type=v3&id=efc3k
Protocol: HTTP

5 shown

DNS request activity5+

A5+ response IPs

5+ DNS requests observed
5+ unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: vcc-library.uk
Type: A
Answers: 104.21.38.212, 172.67.168.125
Response: NOERROR

Query: pee-files.nl
Type: A
Answers: 5.175.206.21
Response: NOERROR

Query: exo-api.tf
Type: A
Answers: 172.67.195.81, 104.21.84.169
Response: NOERROR

Query: steamcommunity.com
Type: A
Answers: 184.29.30.218
Response: NOERROR

Query: steamcommunity.com
Type: A
Answers: 23.48.8.218
Response: NOERROR

5 shown

C2 candidates5+

DNS, HTTP, TCPports 53, 443

5+ C2 candidate communications
3 domains, 4 IPs
Common ports: 53, 443
Protocols: DNS, HTTP, TCP

View details · 5 shown

Domain: vcc-library.uk
Protocol: HTTP

Domain: exo-api.tf
Protocol: HTTP

IP: 5.175.206.21
Domain: pee-files.nl
Port: 53
Protocol: DNS

Domain: pee-files.nl
Protocol: HTTP

IP: 104.21.38.212
Domain: vcc-library.uk
Port: 53
Protocol: DNS

5 shown

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x64 64-bit5+ sections

Platform: x64 64-bit
Sections: 5+
Entry point: present
Compile time: 2026-07-13T16:18:03Z

View details · 1 shown

Platform: x64 64-bit
Entry point: 1507328
Sections: 8
Compile time: 2026-07-13T16:18:03Z

PE sections5+

5+ sections

5+ PE sections
Common permissions: r, rw, rwx, rx
5+ unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 1196656
Raw size: 1197056
Permissions: rx
Entropy: 6.48

Name: .rdata
Virtual address: 1204224
Virtual size: 204304
Raw size: 204800
Permissions: r
Entropy: 5.61

Name: .data
Virtual address: 1409024
Virtual size: 26712
Raw size: 20480
Permissions: rw
Entropy: 2.57

Name: .pdata
Virtual address: 1437696
Virtual size: 51660
Raw size: 51712
Permissions: r
Entropy: 6.18

Name: .fptable
Virtual address: 1490944
Virtual size: 256
Raw size: 512
Permissions: rw
Entropy: 0.0

5 shown

Imports5+

5+ DLL groups

5+ import DLL groups
5+ imported functions summarized

View details · 5 shown

Library: USER32.dll
Functions: GetDC, GetSystemMetrics, ReleaseDC

Library: KERNEL32.dll
Functions: AreFileApisANSI, CloseHandle, CompareStringEx, CompareStringW, CopyFileA, CreateFileA, CreateFileMappingW, CreateFileW …

Library: SHELL32.dll
Functions: SHGetFolderPathA

Library: GDI32.dll
Functions: BitBlt, CreateCompatibleBitmap, CreateCompatibleDC, DeleteDC, DeleteObject, GetDIBits, GetObjectW, SelectObject

Library: WININET.dll
Functions: HttpAddRequestHeadersA, HttpOpenRequestA, HttpSendRequestA, InternetCloseHandle, InternetConnectA, InternetOpenA, InternetOpenUrlA, InternetReadFile

5 shown

Resources1

1 resources

1 resources
Resource types: RT_MANIFEST

View details · 1 shown

Type: RT_MANIFEST
Language: ENGLISH US

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check