Analysis

  • user interaction
    yes
  • max time kernel
    51s
  • max time network
    58s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/08/2026, 15:55

General

  • Target
    HexiumLauncher.exe
  • Size 66.1MB
  • Sample260816-tcsdesec84
  • SHA256 6357330e8b1b9f5dccf79eb1a818e74d008a48c52c83d0a24383131c72fd6be7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Modifies registry class 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HexiumLauncher.exe
    "C:\Users\Admin\AppData\Local\Temp\HexiumLauncher.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1052

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppSettings.xml

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\AppSettings.xml
        • Size 151B
        • SHA256 677dd1b9cb469b48ebc8ad7361655f86e7feafbb1a396d02458fa789371353b0
        • MD5 SHA1 SHA512 TLSH

        .robloxrc

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\AppTempCommon\LuaApp\Components\.robloxrc
        • Size 93B
        • SHA256 2a302dfa7c7366044a28fed4ed42b4092b04c323b08ac168208b5e830a08a30d
        • MD5 SHA1 SHA512 TLSH

        UIBlox.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\LuaChatDeps\UIBlox.lua
        • Size 242B
        • SHA256 ab359dd77408c471bdc9274ab4547bc4ef9c00c404f29079c1340cdc1e1d32bd
        • MD5 SHA1 SHA512 TLSH

        RoactFitComponents.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\LuaSocialLibrariesDeps\RoactFitComponents.lua
        • Size 277B
        • SHA256 7796a00b8760b7193ad3726adbc106160b94ad06be0a59472e806ea709f3f27e
        • MD5 SHA1 SHA512 TLSH

        Symbol.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\Core\Utility\Symbol.lua
        • Size 941B
        • SHA256 e6612e0e7157bf3c3d17fbc99430cbec36626021d3dda1b0f2f2ec17ef72b521
        • MD5 SHA1 SHA512 TLSH

        Cryo.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\roact-navigation\Cryo.lua
        • Size 245B
        • SHA256 69563265d73a4dc6fcd8dc7037f990e50aaf7cf011e32e096ca9e4f5d97a3eca
        • MD5 SHA1 SHA512 TLSH

        Roact.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\roact-navigation\Roact.lua
        • Size 247B
        • SHA256 968e261b51780a92ed1fe2b671b9e18b436c191be1df5a81734468e1c20578d1
        • MD5 SHA1 SHA512 TLSH

        init.spec.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\roblox_cryo\cryo\init.spec.lua
        • Size 86B
        • SHA256 de12d26fa3ecb2ccd974d61e81e38de0ad81fc74414d4f0ca4a836fff1aa05cb
        • MD5 SHA1 SHA512 TLSH

        t.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\roblox_genericpagination\t.lua
        • Size 239B
        • SHA256 40e55b76ba3d9d9d20a16c89b7d3118b67355858a43778217a8abf2a532b4408
        • MD5 SHA1 SHA512 TLSH

        Otter.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\roblox_infinite-scroller-98304e77-0.3.4\Otter.lua
        • Size 247B
        • SHA256 208c19d2a7b9078f39c6e05e7c6dfe4a9b5e7505e37a045670ccf5789c5f079c
        • MD5 SHA1 SHA512 TLSH

        Rodux.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\roblox_purchase-prompt\Rodux.lua
        • Size 247B
        • SHA256 b9928dd057d386ec5f8f77f8d0f38e5f08dcbf61e604d610f9d8b8377e2531cc
        • MD5 SHA1 SHA512 TLSH

        RequestPremiumPurchase.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\roblox_purchase-prompt\purchase-prompt\Actions\RequestPremiumPurchase.lua
        • Size 107B
        • SHA256 249e2c590813a8f4ef4acbb0dd049fda5ccffe98ae373f43e38c3c0b1fa4f78d
        • MD5 SHA1 SHA512 TLSH

        RequestSubscriptionPurchase.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\roblox_purchase-prompt\purchase-prompt\Actions\RequestSubscriptionPurchase.lua
        • Size 113B
        • SHA256 d0fb8c19897a0fb0535126931f181b6219ff799421d1452c560ca57485fcb0fc
        • MD5 SHA1 SHA512 TLSH

        bs-ba.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\roblox_purchase-prompt\purchase-prompt\Localization\Locales\bs-ba.lua
        • Size 706B
        • SHA256 54439b9542f022d546a2ada7758748406fe9b89641f96411cbe253d9fb168de7
        • MD5 SHA1 SHA512 TLSH

        Symbol.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\roblox_roact-gamepad\roact-gamepad\Symbol.lua
        • Size 632B
        • SHA256 da001abe84d9ce0f767b8350d0493b5372d13c07285f3ea26fa79f56e9f9f056
        • MD5 SHA1 SHA512 TLSH

        StackViewTransitionConfigs.spec.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\roblox_roact-navigation\roact-navigation\views\StackView\_tests_\StackViewTransitionConfigs.spec.lua
        • Size 90B
        • SHA256 d5b1858e06e5fb99a94caf8151f9f4f93315b9ca43b3c9f75860d3b6df96d688
        • MD5 SHA1 SHA512 TLSH

        Promise.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\rodux-networking\Promise.lua
        • Size 252B
        • SHA256 0db7b4650356aad441ae0b1b5953f52b090644a44eba67f87814b619aa7312ee
        • MD5 SHA1 SHA512 TLSH

        tutils.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\rodux-networking\tutils.lua
        • Size 242B
        • SHA256 9ad175f853d1ac7fdd48697aae9499ff562878fd98df6305d240a1b28b5f655d
        • MD5 SHA1 SHA512 TLSH

        .robloxrc

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\RoactUtilities\.robloxrc
        • Size 207B
        • SHA256 0e9c0118853f1e532c8d685ba49f866db0d985d4eb75bf0f08e5fb906f0a3821
        • MD5 SHA1 SHA512 TLSH

        shimmer_lightTheme.png

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\textures\ui\LuaApp\graphic\shimmer_lightTheme.png
        • Size 20KB
        • SHA256 fc57f32c26087eef61b37850d60934eda1100ca8773f08e487191a74766053d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\textures\ui\LuaApp\graphic\[email protected]
        • Size 71KB
        • SHA256 1a03e6f6a0de045aa588544c392d671c040b82a5598b4246af04f5a74910dc89
        • MD5 SHA1 SHA512 SSDEEP TLSH

        buttonFill.png

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\textures\ui\LuaDiscussions\buttonFill.png
        • Size 247B
        • SHA256 0a6a5cafb4dee0d8c1d182ddec9f68ca0471d7fc820cf8dc2d68f27a35cd3386
        • MD5 SHA1 SHA512 TLSH

        normaldetail.dds

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\PlatformContent\pc\textures\cobblestone\normaldetail.dds
        • Size 176B
        • SHA256 ff11c95774ee0405666fa313f1e53ebb46b1352bfff3456ac2b2caccdab07b4d
        • MD5 SHA1 SHA512 TLSH

        zh-hans.json

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\content\configs\DateTimeLocaleConfigs\zh-hans.json
        • Size 2KB
        • SHA256 5d588b6cb27cfcf985e460635ec1b331d090345455592c4ab7a1d4e82dba4c03
        • MD5 SHA1 SHA512 TLSH

        zh-tw.json

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\content\configs\DateTimeLocaleConfigs\zh-tw.json
        • Size 2KB
        • SHA256 39c368d993bba3f5ed4a5912705ded57293b4a908c1379d2883f9bd65cd4deea
        • MD5 SHA1 SHA512 TLSH

        mainButtonIcon.png

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\content\textures\MorpherEditor\mainButtonIcon.png
        • Size 546B
        • SHA256 993e3655350f2292ce54b472f355aaf42d0d71fde4ffea717d0b9875f6dd204e
        • MD5 SHA1 SHA512 TLSH

        valueBoxRoundedRectangle.png

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\content\textures\StudioUIEditor\valueBoxRoundedRectangle.png
        • Size 130B
        • SHA256 630303ec4701779eaf86cc9fbf744b625becda53badc7271cbb6ddc56e638d70
        • MD5 SHA1 SHA512 TLSH

        memory/1052-11-0x0000023BEB730000-0x0000023BEB7F1000-memory.dmp

        memory/1052-73-0x0000023BF1D90000-0x0000023BF1EFA000-memory.dmp

        memory/1052-94-0x0000023BF05F0000-0x0000023BF05F5000-memory.dmp

        memory/1052-97-0x0000023BF0600000-0x0000023BF0606000-memory.dmp

        memory/1052-100-0x0000023BF1A40000-0x0000023BF1A61000-memory.dmp

        memory/1052-106-0x0000023BF1940000-0x0000023BF1957000-memory.dmp

        memory/1052-103-0x0000023BF1A70000-0x0000023BF1A95000-memory.dmp

        memory/1052-109-0x0000023BF1B80000-0x0000023BF1B97000-memory.dmp

        memory/1052-112-0x0000023BF1BA0000-0x0000023BF1BC0000-memory.dmp

        memory/1052-115-0x0000023BF25D0000-0x0000023BF2694000-memory.dmp

        memory/1052-118-0x0000023BF2490000-0x0000023BF24B9000-memory.dmp

        memory/1052-121-0x0000023BF1BC0000-0x0000023BF1BCF000-memory.dmp

        memory/1052-124-0x0000023BF1FB0000-0x0000023BF2005000-memory.dmp

        memory/1052-127-0x0000023BF24C0000-0x0000023BF24C9000-memory.dmp

        memory/1052-132-0x0000023BF24D0000-0x0000023BF24DA000-memory.dmp

        memory/1052-135-0x0000023BF2560000-0x0000023BF25A1000-memory.dmp

        memory/1052-88-0x0000023BF2010000-0x0000023BF208C000-memory.dmp

        memory/1052-85-0x0000023BF1A00000-0x0000023BF1A3C000-memory.dmp

        memory/1052-82-0x0000023BF1F00000-0x0000023BF1F8A000-memory.dmp

        memory/1052-79-0x0000023BF1AB0000-0x0000023BF1B57000-memory.dmp

        memory/1052-76-0x0000023BF19A0000-0x0000023BF19FC000-memory.dmp

        memory/1052-91-0x0000023BF05C0000-0x0000023BF05D9000-memory.dmp

        memory/1052-70-0x0000023BF0510000-0x0000023BF0544000-memory.dmp

        memory/1052-67-0x0000023BF1BD0000-0x0000023BF1D88000-memory.dmp

        memory/1052-61-0x0000023BF0620000-0x0000023BF06D5000-memory.dmp

        memory/1052-64-0x0000023BF0550000-0x0000023BF057A000-memory.dmp

        memory/1052-5-0x0000000180000000-0x0000000180A25000-memory.dmp

        memory/1052-14-0x0000023BEB5E0000-0x0000023BEB5F2000-memory.dmp

        memory/1052-17-0x0000023BCAEA0000-0x0000023BCAEAD000-memory.dmp

        memory/1052-23-0x0000023BEB620000-0x0000023BEB638000-memory.dmp

        memory/1052-20-0x0000023BEB600000-0x0000023BEB620000-memory.dmp

        memory/1052-29-0x0000023BEB660000-0x0000023BEB673000-memory.dmp

        memory/1052-58-0x0000023BEC780000-0x0000023BEC799000-memory.dmp

        memory/1052-55-0x0000023BEBDE0000-0x0000023BEBDF6000-memory.dmp

        memory/1052-34-0x0000023BEB6E0000-0x0000023BEB701000-memory.dmp

        memory/1052-37-0x0000023BEB690000-0x0000023BEB6D0000-memory.dmp

        memory/1052-40-0x0000023BEB880000-0x0000023BEB8C7000-memory.dmp

        memory/1052-44-0x0000023BEBA00000-0x0000023BEBA3E000-memory.dmp

        memory/1052-46-0x0000023BEB640000-0x0000023BEB647000-memory.dmp

        memory/1052-52-0x0000023BEB8D0000-0x0000023BEB8E6000-memory.dmp

        memory/1052-49-0x0000023BEB720000-0x0000023BEB72A000-memory.dmp

        memory/1052-26-0x0000023BEB900000-0x0000023BEB9FE000-memory.dmp

        memory/1052-8-0x0000023BEC7C0000-0x0000023BED471000-memory.dmp