File scan report
Verdict Safe
Is Hexium
Only APEX flagged this unsigned launcher, while major antivirus engines found nothing and evidence from the test run did not corroborate malware activity.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Keep security protection enabled and use the file only if it came from the expected source. Rescan the launcher and downloaded archive after more reputation data becomes available.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 70 flagged
- Flagged 1
- No detection 69
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 10d ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Only 1 of the 70 antivirus engines that checked it flagged the file, and that detection came from less reliable APEX with no named family. One sandbox mapped possible process injection, but recorded no target process, malicious verdict, malicious contacted host, or confirmed malicious child.
The scan pattern is dominated by a single generic APEX detection, while none of the major antivirus engines flagged the sample. The test run mapped T1055, but did not identify an injected process or return a malicious sandbox verdict. The observed sample host was not present in the available malicious or suspicious URL-cache records, and the other recorded IP was identified as sandbox background traffic. No malware-specific YARA rules, MalwareBazaar record, confirmed malicious child, packing, or high-entropy code corroborated the detection. Confidence is moderated because this is an unsigned executable first observed on Oct 16, 2026 and ten dropped files remain individually unclassified.
What We Detected
APEX was the only engine to flag the file among 75 engines, using a generic malicious label. No major antivirus engines reported a detection, and no engine family consensus was present.
Threat Behavior
One sandbox mapped activity to MITRE T1055, which can indicate process injection. However, it recorded no injected target process and produced no malicious sandbox verdict. The contacted-host cross-check covered the distinct observed sample domain and non-background IP without finding a cached malicious or suspicious host; 8.8.8.8 was identified as analysis-environment background traffic. The launcher also downloaded files and wrote installation-related data, but no file it created had a confirmed malicious verdict.
What To Do Now
Keep security software enabled and obtain the launcher only from a source you trust. Because the executable is unsigned, and its dropped files lack saved verdicts, consider rescanning it and the downloaded player archive after security vendors have had more time to analyze them.
Where this verdict could be wrong3 caveats
- The executable is unsigned and was first observed on Oct 16, 2026, so it lacks established publisher and age-based trust.
- One sandbox mapped activity to process injection technique T1055, although no injected target process or malicious sandbox verdict was recorded.
- Ten dropped files have no saved verdict, leaving their individual safety unresolved.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 1 of the 70 antivirus engines that checked it flagged the file, and the sole detection came from less reliable APEX.
- None of the 17 major antivirus engines reported a detection.
- The sandbox produced no malicious verdict and recorded no injected target process.
- The complete observed-host cross-check found no cached malicious or suspicious host.
- No malware-specific YARA match, MalwareBazaar record, confirmed malicious child, or packing indicator was found.
- The executable is unsigned and has no established publisher history.
- It was first observed on Oct 16, 2026.
- A sandbox mapped possible process injection, although no target process was identified.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 18sandbox rule tags
- 2spawned processes
- 2network contacts
- 22filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
18MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1036
- T1047
- T1055· Process injection
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1090
- T1129· Loads modules
- T1497· Sandbox evasion
- T1553
- T1553.002
- T1562· Disables security
- T1568
- T1573
- T1574· Execution hijack
Observed activity
Processes started
2Programs the file ran, with their command lines.
HexiumLauncher.exe"C:\Users\<USER>\Desktop\HexiumLauncher.exe"HexiumLauncher.exe"C:\Users\user\Desktop\HexiumLauncher.exe"
Network contacts
22 hosts, listed as 1 domain, 1 address, 3 links. Links show the host and path only.
- Domain
hexium.zip - IP address
173.214.173.190 - URL
https://hexium.zip/downloads/launcher-manifest.json - URL
https://hexium.zip/api/dev-client-mode/status - URL
https://hexium.zip/downloads/HexiumPlayer-v13.zip
Files
21Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\.net\HexiumLauncher\fec\D3DCompiler_47_cor3.dll - Written
C:\Users\<USER>\AppData\Local\Temp\.net\HexiumLauncher\fec\PenImc_cor3.dll - Written
C:\Users\<USER>\AppData\Local\Temp\.net\HexiumLauncher\fec\PresentationNative_cor3.dll - Written
C:\Users\<USER>\AppData\Local\Temp\.net\HexiumLauncher\fec\vcruntime140_cor3.dll - Written
C:\Users\<USER>\AppData\Local\Temp\.net\HexiumLauncher\fec\wpfgfx_cor3.dll - Written
C:\Users\<USER>\AppData\Local\Temp\.net\HexiumLauncher\Rip1npgZxdXu
Show all 21 entries for files
- Written
C:\Users\<USER>\AppData\Local\Temp\d31lr45m.muo - Written
C:\Users\<USER>\AppData\Local\Hexium\launcher.log - Written
C:\Users\<USER>\Desktop\launcher.log - Written
C:\Users\<USER>\AppData\Local\Hexium\HexiumPlayer.zip.4076.part - Written
C:\Users\<USER>\AppData\Local\Hexium\HexiumPlayer.zip - Written
C:\Users\<USER>\AppData\Local\Hexium\HexiumPlayer\HexiumPlayer.exe - Written
C:\Users\<USER>\AppData\Local\Hexium\HexiumPlayer\ReflectionMetadata.xml - Written
C:\Users\<USER>\AppData\Local\Hexium\HexiumPlayer\AppSettings.xml - Written
C:\Users\<USER>\AppData\Local\Hexium\HexiumPlayer\PlatformContent\pc\terrain\normal.dds - Deleted
C:\Users\<USER>\AppData\Local\Temp\.net\HexiumLauncher\fec - Deleted
C:\Users\<USER>\AppData\Local\Temp\d31lr45m.muo - Deleted
C:\Users\<USER>\AppData\Local\Hexium\HexiumPlayer.zip.4076.part - Deleted
C:\Users\<USER>\AppData\Local\Temp\em5hi5nl.odx - Deleted
C:\Users\<USER>\AppData\Local\Hexium\HexiumPlayer.zip - Deleted
C:\Users\user\AppData\Local\Temp\3znwbc5k.cyj
Registry and auto-start
15Settings the file changed, including ways to start again after a restart.
- Set
Software\Classes\hexium\ - Set
DefaultIcon\ - Set
Software\Classes\bbclient\ - Set
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Hexium\DisplayName - Set
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Hexium\DisplayIcon - Set
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Hexium\UninstallString
Show all 15 entries for registry and auto-start
- Set
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Hexium\InstallLocation - Set
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Hexium\Publisher - Set
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Hexium\DisplayVersion - Set
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Hexium\NoModify - Set
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Hexium\NoRepair - Set
HKEY_USERS\S-1-5-21-4270068108-2931534202-3907561125-1001_CLASSES\hexium\shell\open\command\(Default) - Set
HKEY_USERS\S-1-5-21-4270068108-2931534202-3907561125-1001_CLASSES\bbclient\shell\open\command\(Default) - Set
HKEY_USERS\S-1-5-21-4270068108-2931534202-3907561125-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall\Hexium\Publisher - Set
HKEY_USERS\S-1-5-21-4270068108-2931534202-3907561125-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids\exefile
Mutexes
1Named locks a program uses so only one copy runs; malware families often reuse them.
Global\OneSettingQueryMutex+compat+encapsulation
Sandbox background — not the file
8The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost - VM process
lsass.exeC:\Windows\system32\lsass.exe
Show all 8 entries for sandbox background — not the file
- VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p - VM host
8.8.8.8
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- aa89a953862e42f4f73a…a61f72Not checkedno saved verdict
- 8552dc6e0cb6d92005d5…7c3e3cNot checkedno saved verdict
- 5d40c0b754e36d633a5f…7dd2f0Not checkedno saved verdict
- fe54f40c216799270d43…c4c7aeNot checkedno saved verdict
- 54f62bbecd2d680205f2…591f1dNot checkedno saved verdict
- 189e86b3793995d2c77e…6a6a98Not checkedno saved verdict
- cf6a9349b316f78158f3…517cc5Not checkedno saved verdict
- 491ad36022e0a142a4a1…61c5f4Not checkedno saved verdict
- b5681a1908c949603f51…353333Not checkedno saved verdict
- 24a8eb2e309566c6bbf9…ea63dfNot checkedno saved verdict
Chapter 04
Technical details
1 of the 70 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- APEXMalicious
File fingerprint
- Last analyzed
- Oct 17, 2026, 5:37 PM UTC
- SHA-256
b50c701a37932e02e26f02bf8cec6d31ee088f96be69d5754f608f44fe7ee01a- SHA-1
feccc08e9ad001525b1e343d16844ee00fc9b0b7- MD5
2e63366a73bada1d6b2f1a9e8542dcd5
About this file
HexiumLauncher.dll is a Win32 EXE file of 69.2 MB.
- Type and size
- Win32 EXE · 69.2 MB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 16, 2026On VirusTotal.
- Submitted by
- 7 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 6.26 of 8
First scanned
Antivirus consensus
1 of 70 engines flagged this file
5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines0flagged
- Low-trust17 engines1flagged
View all 75 engine results
- APEXMalicious: Malicious
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is HexiumLauncher.dll safe?
What is HexiumLauncher.dll?
How many antivirus engines detected HexiumLauncher.dll?
What is the SHA-256 hash of HexiumLauncher.dll?
Is it safe to run HexiumLauncher.dll?
How up to date is this analysis of HexiumLauncher.dll?
Community
Member reviews and reports for this exact file hash.
