8714bd82cda11977bb566097d70451c471f73cb0682ef12fdf12ec1f3387f3f9

Analysis

max time kernel
907s
max time network
529s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pycharm-2026.2.0.1.exe
Size 903.5MB
Sample260811-pgz7lsec44
SHA256 8714bd82cda11977bb566097d70451c471f73cb0682ef12fdf12ec1f3387f3f9
MD5 a01f1ac1194908a19f9bc0bb1a3f478f
SHA1 37946953b07cf78249d0a1d486dc9136281c9d48
SHA512 3da0f6680aa58eeaa5f42f62494101e75ad263714588e92fb5a3928fc05b9280a99b0ac23c61064a6c35ee4a89bf7253cea4941fb02773ebc9c7e2ff6c973a89
SSDEEP 25165824:FOul5KXs0X4a2jDzHF/WUQnoBaK8Q/n5sOJfCbQQo/S:F3l55w2bGvERJwQQ+S
TLSH
T1C6A9334897ED8A6FC0F50037EA430E38E6F82B399AA43511187952EB7CB7F49571AE50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\nszD64E.tmp\Desktop.ini	pycharm-2026.2.0.1.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\nszD64E.tmp\Desktop.ini	pycharm-2026.2.0.1.exe

Loads dropped DLL 6 IoCs

pid	Process
4176	pycharm-2026.2.0.1.exe
4176	pycharm-2026.2.0.1.exe
4176	pycharm-2026.2.0.1.exe
4176	pycharm-2026.2.0.1.exe
4176	pycharm-2026.2.0.1.exe
4176	pycharm-2026.2.0.1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pycharm-2026.2.0.1.exe

C:\Users\Admin\AppData\Local\Temp\pycharm-2026.2.0.1.exe
"C:\Users\Admin\AppData\Local\Temp\pycharm-2026.2.0.1.exe"
1⤵
- Drops desktop.ini file(s)
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4836

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Desktop.ini

Path C:\Users\Admin\AppData\Local\Temp\nszD64E.tmp\Desktop.ini
Size 3KB
SHA256 de8643b07d54050e4bd566f5024e36b289fcdac762bb9cf61770ffdc96b3bcaf
MD5 3fdd6f1fcaf6fb55811300bb52a1cb09
SHA1 2c972eee32df59f490ecfd9ba60995a1f1a7327e
SHA512 ed9fb271517d472abdc84638684344421f0a29ccd9acb2ad9650ff2c1432c5b8bcce1f76b034e58779e24e2ca92c3d2c851e5b2256f3802812731bd87e907352
TLSH
T1F57172072EFA4625E4ABF699DBF04535E738B102541DC90ED0D60B4F18FAB81486BB9F
MD5 SHA1 SHA512 TLSH

Submit Download

Desktop.ini

Path C:\Users\Admin\AppData\Local\Temp\nszD64E.tmp\Desktop.ini
Size 3KB
SHA256 e87745205e978ce59e8e1bece86f62c4482c2e09997f7ac186c11b3038125b45
MD5 91993743b0cf7b3afcbbb44709e6bbeb
SHA1 9aff84af916ba84da59a470a3aea3e177afa40e0
SHA512 694b8e76af0e1ef697a6d4645aa60eb0ca5caafea9381f8e68da2caac7af1aaa2ae7ba4ef7ffb4865298c7cbe0f2d1da2474b67a4662c5d9d31c3a580c0ec8a0
TLSH
T127715C072EF95664E49FF648EBF08531E738B501581ECA0EC0D60B4E58EAB81547BB9F
MD5 SHA1 SHA512 TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nszD64E.tmp\InstallOptions.dll
Size 15KB
SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
MD5 cfc7c53e282b0a7c527e4ed091f17fcd
SHA1 3f3fb2dfaa9a0576803c5fd693f5c4c288ae4f1e
SHA512 367fc4024397381cfc5fa83b303d5eb78e97904821260589ce81a51c3cbe5d7f5dd0bf7fa07142bcb13a91bce2b523de21cbb1d940cb7fdfeca35c54c67694f6
SSDEEP 192:EhGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTmT11929WtshLAzgSrX8:EhNt+4t7uJalUnGesY7Lt8nCy/Yosa
TLSH
T162624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E0638565806D78311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nszD64E.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nszD64E.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
TLSH
T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UninstallOldVersions.ini

Path C:\Users\Admin\AppData\Local\Temp\nszD64E.tmp\UninstallOldVersions.ini
Size 1KB
SHA256 69c586466a111c24e771f29f0e5d6e6dbe424af369ac0f2b3a1406dc96c824b2
MD5 4bb6420e4ca605bbecfd4caa205eec11
SHA1 3a9f97a2895d6ebc14edffd6ee6a3da9deac46f7
SHA512 7ea5699e101aa6f62f3c4c8f43cd63702e31488ed8c7afdc2509afa43f37f44015e37f27fbd9a265e9db3d4e96cc3bc09286c677a77f520d73a5766045199409
TLSH
T1EE41F80D2EF80024E09BE60DDBF58A11AB39B5062912CD0DE4E4069F5CFAF49252FB1F
MD5 SHA1 SHA512 TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nszD64E.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads