Overview

overview

8

Static

static

3

NidQrForm-SETUP.exe

windows10-2004-x64

7

NidQrForm-SETUP.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

8

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows11-ltsc_2024-x64

8

LICENSES.c...m.html

windows10-2004-x64

3

LICENSES.c...m.html

windows11-ltsc_2024-x64

4

NidQrForm.exe

windows10-2004-x64

3

NidQrForm.exe

windows11-ltsc_2024-x64

8

content_shell.js

windows10-2004-x64

3

content_shell.js

windows11-ltsc_2024-x64

3

d3dcompiler_47.dll

windows10-2004-x64

3

d3dcompiler_47.dll

windows11-ltsc_2024-x64

6

ffmpeg.dll

windows10-2004-x64

3

ffmpeg.dll

windows11-ltsc_2024-x64

8

libEGL.dll

windows10-2004-x64

3

libEGL.dll

windows11-ltsc_2024-x64

3

libGLESv2.dll

windows10-2004-x64

3

libGLESv2.dll

windows11-ltsc_2024-x64

8

natives_blob.js

windows10-2004-x64

3

natives_blob.js

windows11-ltsc_2024-x64

3

node.dll

windows10-2004-x64

3

node.dll

windows11-ltsc_2024-x64

3

pdf_viewer...ces.js

windows10-2004-x64

3

pdf_viewer...ces.js

windows11-ltsc_2024-x64

3

resources/electron.js

windows10-2004-x64

3

resources/electron.js

windows11-ltsc_2024-x64

3

resources/elevate.exe

windows10-2004-x64

3

resources/elevate.exe

windows11-ltsc_2024-x64

8

Resubmissions

28/08/2026, 16:18

260828-trzfaabr9s

08/07/2026, 04:09

260708-eqr79abs6k8

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 04:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    NidQrForm-SETUP.exe
  • Size 27.6MB
  • Sample260708-eqr79abs6k
  • SHA256 85fd01ab2e73dd7baebcb9a342bce7fed0b9f8b4207ed3de6255debbd0fdcd37
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 15 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NidQrForm-SETUP.exe
    "C:\Users\Admin\AppData\Local\Temp\NidQrForm-SETUP.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5744
    • C:\Users\Admin\AppData\Local\Programs\NidQrForm\NidQrForm.exe
      "C:\Users\Admin\AppData\Local\Programs\NidQrForm\NidQrForm.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2292
      • C:\Users\Admin\AppData\Local\Programs\NidQrForm\NidQrForm.exe
        "C:\Users\Admin\AppData\Local\Programs\NidQrForm\NidQrForm.exe" --type=renderer --no-sandbox --primordial-pipe-token=BB2AFB35CB84FB486D6A475E1942F303 --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Programs\NidQrForm\resources\app.asar" --node-integration=true --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --service-request-channel-token=BB2AFB35CB84FB486D6A475E1942F303 --renderer-client-id=5 --mojo-platform-channel-handle=2076 /prefetch:1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4756
      • C:\Users\Admin\AppData\Local\Programs\NidQrForm\NidQrForm.exe
        "C:\Users\Admin\AppData\Local\Programs\NidQrForm\NidQrForm.exe" --type=renderer --no-sandbox --primordial-pipe-token=4C021B9ECBE14663C177DA8F72A1EDD2 --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Programs\NidQrForm\resources\app.asar" --node-integration=true --hidden-page --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --service-request-channel-token=4C021B9ECBE14663C177DA8F72A1EDD2 --renderer-client-id=6 --mojo-platform-channel-handle=2076 /prefetch:1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1244

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        blink_image_resources_200_percent.pak
        • Path C:\Users\Admin\AppData\Local\Programs\NidQrForm\blink_image_resources_200_percent.pak
        • Size 24KB
        • SHA256 1c4f11111f9c40f0a85a4854fa3fa7e112deb27b6aaad1388eb9e1427d550692
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        content_resources_200_percent.pak
        • Path C:\Users\Admin\AppData\Local\Programs\NidQrForm\content_resources_200_percent.pak
        • Size 15B
        • SHA256 261e6aad3ad0a5f608b5694919ee39026c4c3eb4256540068f7c1aa46be9315a
        • MD5 SHA1 SHA512
        Submit Download

        content_shell.pak
        • Path C:\Users\Admin\AppData\Local\Programs\NidQrForm\content_shell.pak
        • Size 9.6MB
        • SHA256 e20a142f2bb0f9016d5e9b948d37ae49f4d8a2c8b4059ac162ea12d2cc4a62c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ffmpeg.dll
        • Path C:\Users\Admin\AppData\Local\Programs\NidQrForm\ffmpeg.dll
        • Size 1.8MB
        • SHA256 59e7c824d049ca0de7d9bb5f5ef3788c7fbdc4f8a1683ea5c9b62f011ef647c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icudtl.dat
        • Path C:\Users\Admin\AppData\Local\Programs\NidQrForm\icudtl.dat
        • Size 9.7MB
        • SHA256 6747c6682cb478bb187c6ef856e0e79bcdc746c9c3d865aafd6182e62ca3f2ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        en-US.pak
        • Path C:\Users\Admin\AppData\Local\Programs\NidQrForm\locales\en-US.pak
        • Size 3KB
        • SHA256 8223ed3f3a0feb0a7586074cf224ffd18073a065c20cd093503d83730d61f621
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        natives_blob.bin
        • Path C:\Users\Admin\AppData\Local\Programs\NidQrForm\natives_blob.bin
        • Size 334KB
        • SHA256 ba2f2ac6ae9bc67399728f25772a0eb3e840695395cc747adf4b2f8b5d6d9a46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        node.dll
        • Path C:\Users\Admin\AppData\Local\Programs\NidQrForm\node.dll
        • Size 14.1MB
        • SHA256 bcdf2bc464bbbaf975d4f032ada1ad67836fb6dba78a4ebc945dc9ca0e87f0e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pdf_viewer_resources.pak
        • Path C:\Users\Admin\AppData\Local\Programs\NidQrForm\pdf_viewer_resources.pak
        • Size 140KB
        • SHA256 7a42228190983ac5cf572ad417cd4a49a1b555e305648f01794068ca15e0e293
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        app.asar
        • Path C:\Users\Admin\AppData\Local\Programs\NidQrForm\resources\app.asar
        • Size 14.8MB
        • SHA256 e57ef942fec1b5ecbb9320bf89e8c4d12328c23420094101e23211b644b68ffa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        electron.asar
        • Path C:\Users\Admin\AppData\Local\Programs\NidQrForm\resources\electron.asar
        • Size 235KB
        • SHA256 67d9f54267f1d3a3cc2869828ed058187e243d7237c485514cb42bbafffae0ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snapshot_blob.bin
        • Path C:\Users\Admin\AppData\Local\Programs\NidQrForm\snapshot_blob.bin
        • Size 794KB
        • SHA256 e2f81a0e3e62c9e71c1039cf7c12df050df81cd3e4fb606c8d9ac750327f7e7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui_resources_200_percent.pak
        • Path C:\Users\Admin\AppData\Local\Programs\NidQrForm\ui_resources_200_percent.pak
        • Size 84KB
        • SHA256 fb905c955734bdbd4d03aaa82abb4700fca6e1a6fe27bdc38e9517a93f5dfc9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        views_resources_200_percent.pak
        • Path C:\Users\Admin\AppData\Local\Programs\NidQrForm\views_resources_200_percent.pak
        • Size 58KB
        • SHA256 2a3f8249ac91463757ef824c03857011caa012304efe8777231a209034ada858
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SpiderBanner.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nso72E5.tmp\SpiderBanner.dll
        • Size 9KB
        • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nso72E5.tmp\System.dll
        • Size 11KB
        • SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WinShell.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nso72E5.tmp\WinShell.dll
        • Size 3KB
        • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nsProcess.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nso72E5.tmp\nsProcess.dll
        • Size 4KB
        • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsis7z.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nso72E5.tmp\nsis7z.dll
        • Size 391KB
        • SHA256 66ac8bd1f273a73e17a3f31d6add739d3cb0330a6417faeda11a9cae00b62d8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NidQrForm.lnk
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NidQrForm.lnk
        • Size 2KB
        • SHA256 65f887d5671e79bb958731504fb579250e7a08dd5c17eb00d4663e551d35c310
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1244-316-0x000000000A900000-0x000000000A901000-memory.dmp
        Download

        memory/2292-299-0x000000003C800000-0x000000003C801000-memory.dmp
        Download

        memory/4756-315-0x000000000E200000-0x000000000E201000-memory.dmp
        Download