Analysis

  • user interaction
    yes
  • max time kernel
    103s
  • max time network
    34s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 15:55

General

  • Target
    HexiumLauncher.exe
  • Size 66.1MB
  • Sample260816-tcsdesec84
  • SHA256 6357330e8b1b9f5dccf79eb1a818e74d008a48c52c83d0a24383131c72fd6be7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Modifies registry class 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HexiumLauncher.exe
    "C:\Users\Admin\AppData\Local\Temp\HexiumLauncher.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1176

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppSettings.xml

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\AppSettings.xml
        • Size 151B
        • SHA256 677dd1b9cb469b48ebc8ad7361655f86e7feafbb1a396d02458fa789371353b0
        • MD5 SHA1 SHA512 TLSH

        .robloxrc

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\AppTempCommon\LuaApp\Components\.robloxrc
        • Size 93B
        • SHA256 2a302dfa7c7366044a28fed4ed42b4092b04c323b08ac168208b5e830a08a30d
        • MD5 SHA1 SHA512 TLSH

        UIBlox.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\LuaChatDeps\UIBlox.lua
        • Size 242B
        • SHA256 ab359dd77408c471bdc9274ab4547bc4ef9c00c404f29079c1340cdc1e1d32bd
        • MD5 SHA1 SHA512 TLSH

        RoactFitComponents.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\LuaSocialLibrariesDeps\RoactFitComponents.lua
        • Size 277B
        • SHA256 7796a00b8760b7193ad3726adbc106160b94ad06be0a59472e806ea709f3f27e
        • MD5 SHA1 SHA512 TLSH

        Symbol.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\UIBlox\UIBlox\Core\Utility\Symbol.lua
        • Size 941B
        • SHA256 e6612e0e7157bf3c3d17fbc99430cbec36626021d3dda1b0f2f2ec17ef72b521
        • MD5 SHA1 SHA512 TLSH

        Cryo.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\roact-navigation\Cryo.lua
        • Size 245B
        • SHA256 69563265d73a4dc6fcd8dc7037f990e50aaf7cf011e32e096ca9e4f5d97a3eca
        • MD5 SHA1 SHA512 TLSH

        Roact.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\roact-navigation\Roact.lua
        • Size 247B
        • SHA256 968e261b51780a92ed1fe2b671b9e18b436c191be1df5a81734468e1c20578d1
        • MD5 SHA1 SHA512 TLSH

        init.spec.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\roblox_cryo\cryo\init.spec.lua
        • Size 86B
        • SHA256 de12d26fa3ecb2ccd974d61e81e38de0ad81fc74414d4f0ca4a836fff1aa05cb
        • MD5 SHA1 SHA512 TLSH

        t.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\roblox_genericpagination\t.lua
        • Size 239B
        • SHA256 40e55b76ba3d9d9d20a16c89b7d3118b67355858a43778217a8abf2a532b4408
        • MD5 SHA1 SHA512 TLSH

        Otter.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\roblox_infinite-scroller-98304e77-0.3.4\Otter.lua
        • Size 247B
        • SHA256 208c19d2a7b9078f39c6e05e7c6dfe4a9b5e7505e37a045670ccf5789c5f079c
        • MD5 SHA1 SHA512 TLSH

        Rodux.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\roblox_purchase-prompt\Rodux.lua
        • Size 247B
        • SHA256 b9928dd057d386ec5f8f77f8d0f38e5f08dcbf61e604d610f9d8b8377e2531cc
        • MD5 SHA1 SHA512 TLSH

        RequestPremiumPurchase.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\roblox_purchase-prompt\purchase-prompt\Actions\RequestPremiumPurchase.lua
        • Size 107B
        • SHA256 249e2c590813a8f4ef4acbb0dd049fda5ccffe98ae373f43e38c3c0b1fa4f78d
        • MD5 SHA1 SHA512 TLSH

        RequestSubscriptionPurchase.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\roblox_purchase-prompt\purchase-prompt\Actions\RequestSubscriptionPurchase.lua
        • Size 113B
        • SHA256 d0fb8c19897a0fb0535126931f181b6219ff799421d1452c560ca57485fcb0fc
        • MD5 SHA1 SHA512 TLSH

        bs-ba.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\roblox_purchase-prompt\purchase-prompt\Localization\Locales\bs-ba.lua
        • Size 706B
        • SHA256 54439b9542f022d546a2ada7758748406fe9b89641f96411cbe253d9fb168de7
        • MD5 SHA1 SHA512 TLSH

        Symbol.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\roblox_roact-gamepad\roact-gamepad\Symbol.lua
        • Size 632B
        • SHA256 da001abe84d9ce0f767b8350d0493b5372d13c07285f3ea26fa79f56e9f9f056
        • MD5 SHA1 SHA512 TLSH

        StackViewTransitionConfigs.spec.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\roblox_roact-navigation\roact-navigation\views\StackView\_tests_\StackViewTransitionConfigs.spec.lua
        • Size 90B
        • SHA256 d5b1858e06e5fb99a94caf8151f9f4f93315b9ca43b3c9f75860d3b6df96d688
        • MD5 SHA1 SHA512 TLSH

        Promise.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\rodux-networking\Promise.lua
        • Size 252B
        • SHA256 0db7b4650356aad441ae0b1b5953f52b090644a44eba67f87814b619aa7312ee
        • MD5 SHA1 SHA512 TLSH

        tutils.lua

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\Packages\_Index\rodux-networking\tutils.lua
        • Size 242B
        • SHA256 9ad175f853d1ac7fdd48697aae9499ff562878fd98df6305d240a1b28b5f655d
        • MD5 SHA1 SHA512 TLSH

        .robloxrc

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\LuaPackages\RoactUtilities\.robloxrc
        • Size 207B
        • SHA256 0e9c0118853f1e532c8d685ba49f866db0d985d4eb75bf0f08e5fb906f0a3821
        • MD5 SHA1 SHA512 TLSH

        shimmer_lightTheme.png

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\textures\ui\LuaApp\graphic\shimmer_lightTheme.png
        • Size 20KB
        • SHA256 fc57f32c26087eef61b37850d60934eda1100ca8773f08e487191a74766053d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\textures\ui\LuaApp\graphic\[email protected]
        • Size 71KB
        • SHA256 1a03e6f6a0de045aa588544c392d671c040b82a5598b4246af04f5a74910dc89
        • MD5 SHA1 SHA512 SSDEEP TLSH

        buttonFill.png

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\ExtraContent\textures\ui\LuaDiscussions\buttonFill.png
        • Size 247B
        • SHA256 0a6a5cafb4dee0d8c1d182ddec9f68ca0471d7fc820cf8dc2d68f27a35cd3386
        • MD5 SHA1 SHA512 TLSH

        normaldetail.dds

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\PlatformContent\pc\textures\cobblestone\normaldetail.dds
        • Size 176B
        • SHA256 ff11c95774ee0405666fa313f1e53ebb46b1352bfff3456ac2b2caccdab07b4d
        • MD5 SHA1 SHA512 TLSH

        zh-hans.json

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\content\configs\DateTimeLocaleConfigs\zh-hans.json
        • Size 2KB
        • SHA256 5d588b6cb27cfcf985e460635ec1b331d090345455592c4ab7a1d4e82dba4c03
        • MD5 SHA1 SHA512 TLSH

        zh-tw.json

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\content\configs\DateTimeLocaleConfigs\zh-tw.json
        • Size 2KB
        • SHA256 39c368d993bba3f5ed4a5912705ded57293b4a908c1379d2883f9bd65cd4deea
        • MD5 SHA1 SHA512 TLSH

        mainButtonIcon.png

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\content\textures\MorpherEditor\mainButtonIcon.png
        • Size 546B
        • SHA256 993e3655350f2292ce54b472f355aaf42d0d71fde4ffea717d0b9875f6dd204e
        • MD5 SHA1 SHA512 TLSH

        valueBoxRoundedRectangle.png

        • Path C:\Users\Admin\AppData\Local\Hexium\HexiumPlayer\content\textures\StudioUIEditor\valueBoxRoundedRectangle.png
        • Size 130B
        • SHA256 630303ec4701779eaf86cc9fbf744b625becda53badc7271cbb6ddc56e638d70
        • MD5 SHA1 SHA512 TLSH

        memory/1176-58-0x0000022904110000-0x0000022904129000-memory.dmp

        memory/1176-73-0x0000022907650000-0x00000229077BA000-memory.dmp

        memory/1176-94-0x0000022907450000-0x0000022907471000-memory.dmp

        memory/1176-100-0x00000229072F0000-0x0000022907307000-memory.dmp

        memory/1176-97-0x00000229077C0000-0x00000229077E5000-memory.dmp

        memory/1176-103-0x0000022907810000-0x0000022907827000-memory.dmp

        memory/1176-109-0x0000022907830000-0x0000022907836000-memory.dmp

        memory/1176-106-0x00000229078C0000-0x00000229078E0000-memory.dmp

        memory/1176-112-0x0000022907A40000-0x0000022907B04000-memory.dmp

        memory/1176-115-0x0000022907900000-0x0000022907905000-memory.dmp

        memory/1176-118-0x0000022907960000-0x0000022907989000-memory.dmp

        memory/1176-121-0x0000022907910000-0x000002290791F000-memory.dmp

        memory/1176-124-0x0000022907B10000-0x0000022907B65000-memory.dmp

        memory/1176-127-0x0000022907920000-0x0000022907929000-memory.dmp

        memory/1176-132-0x0000022907930000-0x000002290793A000-memory.dmp

        memory/1176-135-0x0000022907B70000-0x0000022907BB1000-memory.dmp

        memory/1176-91-0x0000022905D90000-0x0000022905DA9000-memory.dmp

        memory/1176-80-0x00000229073A0000-0x0000022907447000-memory.dmp

        memory/1176-82-0x0000022907200000-0x000002290728A000-memory.dmp

        memory/1176-85-0x0000022907360000-0x000002290739C000-memory.dmp

        memory/1176-76-0x0000022907290000-0x00000229072EC000-memory.dmp

        memory/1176-88-0x0000022907840000-0x00000229078BC000-memory.dmp

        memory/1176-67-0x0000022907490000-0x0000022907648000-memory.dmp

        memory/1176-70-0x0000022905CE0000-0x0000022905D14000-memory.dmp

        memory/1176-64-0x0000022905D20000-0x0000022905D4A000-memory.dmp

        memory/1176-62-0x0000022905DD0000-0x0000022905E85000-memory.dmp

        memory/1176-5-0x0000000180000000-0x0000000180A25000-memory.dmp

        memory/1176-55-0x0000022901120000-0x0000022901136000-memory.dmp

        memory/1176-52-0x00000229002D0000-0x00000229002E6000-memory.dmp

        memory/1176-14-0x0000022900000000-0x0000022900012000-memory.dmp

        memory/1176-17-0x0000022900020000-0x000002290002D000-memory.dmp

        memory/1176-20-0x0000022900030000-0x0000022900050000-memory.dmp

        memory/1176-23-0x0000022900050000-0x0000022900068000-memory.dmp

        memory/1176-11-0x0000022900130000-0x00000229001F1000-memory.dmp

        memory/1176-26-0x0000022900300000-0x00000229003FE000-memory.dmp

        memory/1176-29-0x0000022900070000-0x0000022900083000-memory.dmp

        memory/1176-34-0x0000022900100000-0x0000022900121000-memory.dmp

        memory/1176-37-0x00000229000B0000-0x00000229000F0000-memory.dmp

        memory/1176-43-0x0000022900400000-0x000002290043E000-memory.dmp

        memory/1176-46-0x0000022900090000-0x0000022900097000-memory.dmp

        memory/1176-49-0x0000022900240000-0x000002290024A000-memory.dmp

        memory/1176-40-0x0000022900280000-0x00000229002C7000-memory.dmp

        memory/1176-8-0x0000022901160000-0x0000022901E11000-memory.dmp