f88b6d6d957e06d01ccb9a0add93434f4d93d1c61ed9b0b28fdca0c7eabd103b

Analysis

user interaction
yes
max time kernel
299s
max time network
267s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 20:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DX Light.exe
Size 150.4MB
Sample260810-y56tqsswhy
SHA256 f88b6d6d957e06d01ccb9a0add93434f4d93d1c61ed9b0b28fdca0c7eabd103b
MD5 74ca84482cc6cb655041dd23bcc035e7
SHA1 26ce94f851b5a0a16d0b5fd616ce960ebc99f420
SHA512 895f4bc114dcfc42cd59660fd5bc51d726feacc38d63f47acfd968a5b104c34ad3a85b09e92e96178b75dad978f355cbebc3a836f6aaa8d5243f9eb142743664
SSDEEP 1572864:flAhthKM29V6LLWANUB9IinJn1cpGN4vM+JlhrZnQ9I4FdUrczKrk4ZeUOC2+:UtSD64Jnqrtbv2
TLSH
T182788C03E2A610D9E05DD1B5874B8637EE72BC460728B6DF265427562F77FE02B39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	DX Light.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	DX Light.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4380	cscript.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
332	cmd.exe
4340	cmd.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2472	DX Light.exe
2472	DX Light.exe
2472	DX Light.exe
2472	DX Light.exe
1900	DX Light.exe
1900	DX Light.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe
Token: SeShutdownPrivilege	2472	DX Light.exe
Token: SeCreatePagefilePrivilege	2472	DX Light.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2472	DX Light.exe
2472	DX Light.exe
2472	DX Light.exe
2472	DX Light.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2472	DX Light.exe
2472	DX Light.exe
2472	DX Light.exe
2472	DX Light.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 3608	2472	DX Light.exe	86
PID 2472 wrote to memory of 4340	2472	DX Light.exe	87
PID 4340 wrote to memory of 1048	4340	cmd.exe	89
PID 2472 wrote to memory of 4584	2472	DX Light.exe	90
PID 2472 wrote to memory of 4584	2472	DX Light.exe	90
PID 2472 wrote to memory of 2780	2472	DX Light.exe	91
PID 2472 wrote to memory of 1348	2472	DX Light.exe	92
PID 2472 wrote to memory of 332	2472	DX Light.exe	93
PID 332 wrote to memory of 4380	332	cmd.exe	95
PID 2472 wrote to memory of 1900	2472	DX Light.exe	106

C:\Users\Admin\AppData\Local\Temp\DX Light.exe
"C:\Users\Admin\AppData\Local\Temp\DX Light.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Users\Admin\AppData\Local\Temp\DX Light.exe
  "C:\Users\Admin\AppData\Local\Temp\DX Light.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\quiklight-desktop /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\quiklight-desktop\Crashpad --url=https://o1422999.ingest.us.sentry.io/api/4508686841675776/minidump/?sentry_key=a1b27d7ea049688e7bce8463e5d7acdc --annotation=_companyName=Robobloq --annotation=_productName=SyncLight --annotation=_version=3.7.21 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=22.3.27 --initial-client-data=0x4c0,0x4c4,0x4c8,0x4bc,0x4cc,0x7ff66d031898,0x7ff66d0318a8,0x7ff66d0318b8
  2⤵
  PID:3608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
    3⤵
    PID:1048
- C:\Users\Admin\AppData\Local\Temp\DX Light.exe
  "C:\Users\Admin\AppData\Local\Temp\DX Light.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\quiklight-desktop" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1836,i,15032151977443840942,7734394344492950062,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:4584
- C:\Users\Admin\AppData\Local\Temp\DX Light.exe
  "C:\Users\Admin\AppData\Local\Temp\DX Light.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\quiklight-desktop" --mojo-platform-channel-handle=2036 --field-trial-handle=1836,i,15032151977443840942,7734394344492950062,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:2780
- C:\Users\Admin\AppData\Local\Temp\DX Light.exe
  "C:\Users\Admin\AppData\Local\Temp\DX Light.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\quiklight-desktop" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1768 --field-trial-handle=1836,i,15032151977443840942,7734394344492950062,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
  2⤵
  - Checks computer location settings
  PID:1348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cscript.exe C:\Users\Admin\AppData\Local\Temp\setTransparency.vbs"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:332
- - C:\Windows\system32\cscript.exe
    cscript.exe C:\Users\Admin\AppData\Local\Temp\setTransparency.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4380
- C:\Users\Admin\AppData\Local\Temp\DX Light.exe
  "C:\Users\Admin\AppData\Local\Temp\DX Light.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\quiklight-desktop" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1468 --field-trial-handle=1836,i,15032151977443840942,7734394344492950062,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setTransparency.vbs

Path C:\Users\Admin\AppData\Local\Temp\setTransparency.vbs
Size 251B
SHA256 ecf6a3ab6aafa16282ab2914db50e04e1ca157c9ba1d06cb81a3b8593f847fcc
MD5 13c33604a2c04f1608039924e580945e
SHA1 8a4a6306091a0ce662edf50f6d84c9993a249074
SHA512 c8581dd92e0891f2dbff438443ac46de728f4799e92ac2c0f5425a1721ba4337f569dd42482a378cdc924344befef1e73ba17a4c9b8a1198e1aba051e519f7a7
TLSH
T15AD09534B250417822DDA94141F74400F71DEE5B3021DF355A50665C01E59FC8314003
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\quiklight-desktop\Network\Network Persistent State
Size 300B
SHA256 62f52c2cdb6fda229d3b99a99df51e9324fc1d2df3f1bed4687349a393dbd78e
MD5 b113d3baec5db90e530d1e74cb3f2766
SHA1 30df6048c9a973949a0f399244879d5b64a0a251
SHA512 0f37d40afa7d359f68fab8c4e5334c296c489f7f02e6a4301521cd122187c95f24cdebef1df45e79e87d2e723c8013fd90b00944bda9f08810d357697e42be9b
TLSH
T1A3E07292C2E46CBE078243F02B262913C2BB080942282E06DAE8BB5E43A14BC580084B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe594925.TMP

Path C:\Users\Admin\AppData\Roaming\quiklight-desktop\Network\Network Persistent State~RFe594925.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1900-76-0x00000294DBB30000-0x00000294DBB31000-memory.dmp

Download

memory/1900-75-0x00000294DBB30000-0x00000294DBB31000-memory.dmp

Download

memory/1900-77-0x00000294DBB30000-0x00000294DBB31000-memory.dmp

Download

memory/1900-81-0x00000294DBB30000-0x00000294DBB31000-memory.dmp

Download

memory/1900-83-0x00000294DBB30000-0x00000294DBB31000-memory.dmp

Download

memory/1900-87-0x00000294DBB30000-0x00000294DBB31000-memory.dmp

Download

memory/1900-86-0x00000294DBB30000-0x00000294DBB31000-memory.dmp

Download

memory/1900-85-0x00000294DBB30000-0x00000294DBB31000-memory.dmp

Download

memory/1900-84-0x00000294DBB30000-0x00000294DBB31000-memory.dmp

Download

memory/1900-82-0x00000294DBB30000-0x00000294DBB31000-memory.dmp

Download

memory/4584-4-0x00007FFFF4A30000-0x00007FFFF4A31000-memory.dmp

Download