File name:

python-3.12.10-amd64.exe

Full analysis: https://app.any.run/tasks/4fbbe9cb-419a-47b3-9a4d-9e9635b8e3d1
Verdict: Malicious activity
Analysis date: July 06, 2025, 03:09:49
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
blind-copy
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

5EDDB0B6F12C852725DE071AE681DDE4

SHA1:

34DACAE62B262746F850C011A14888F4FFED20F2

SHA256:

67B5635E80EA51072B87941312D00EC8927C4DB9BA18938F7AD2D27B328B95FB

SSDEEP:

196608:r0j1J+hO+VjKAAtkm5bJAzLfLcZ+ozyWZgRwqEHUMn:wjH+Qg+AAeaiYZ+6yndU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • python-3.12.10-amd64.exe (PID: 4232)
      • python-3.12.10-amd64.exe (PID: 1128)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • python-3.12.10-amd64.exe (PID: 5960)
      • python-3.12.10-amd64.exe (PID: 4232)
      • python-3.12.10-amd64.exe (PID: 1128)

    • Creates a software uninstall entry

      • python-3.12.10-amd64.exe (PID: 4232)
      • python-3.12.10-amd64.exe (PID: 1128)

    • Searches for installed software

      • python-3.12.10-amd64.exe (PID: 4232)
      • python-3.12.10-amd64.exe (PID: 5952)
      • python-3.12.10-amd64.exe (PID: 1128)

    • Process drops legitimate windows executable

      • python-3.12.10-amd64.exe (PID: 4232)
      • msiexec.exe (PID: 2792)

    • The process drops C-runtime libraries

      • python-3.12.10-amd64.exe (PID: 4232)
      • msiexec.exe (PID: 2792)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 2792)

    • Application launched itself

      • python-3.12.10-amd64.exe (PID: 5952)
      • python-3.12.10-amd64.exe (PID: 760)

    • There is functionality for taking screenshot (YARA)

      • python-3.12.10-amd64.exe (PID: 4232)
      • python-3.12.10-amd64.exe (PID: 1128)

    • Process drops python dynamic module

      • msiexec.exe (PID: 2792)

  • INFO

    • The sample compiled with english language support

      • python-3.12.10-amd64.exe (PID: 5960)
      • python-3.12.10-amd64.exe (PID: 4232)
      • msiexec.exe (PID: 2792)
      • python-3.12.10-amd64.exe (PID: 1128)

    • Create files in a temporary directory

      • python-3.12.10-amd64.exe (PID: 5960)
      • python-3.12.10-amd64.exe (PID: 4232)
      • python-3.12.10-amd64.exe (PID: 1128)

    • Checks supported languages

      • python-3.12.10-amd64.exe (PID: 5960)
      • python-3.12.10-amd64.exe (PID: 4232)
      • python-3.12.10-amd64.exe (PID: 5952)
      • python-3.12.10-amd64.exe (PID: 1128)
      • python-3.12.10-amd64.exe (PID: 760)
      • msiexec.exe (PID: 2792)

    • Creates files or folders in the user directory

      • python-3.12.10-amd64.exe (PID: 4232)
      • msiexec.exe (PID: 2792)

    • Reads the computer name

      • python-3.12.10-amd64.exe (PID: 4232)
      • msiexec.exe (PID: 2792)
      • python-3.12.10-amd64.exe (PID: 1128)

    • Launching a file from a Registry key

      • python-3.12.10-amd64.exe (PID: 4232)
      • python-3.12.10-amd64.exe (PID: 1128)

    • Reads the machine GUID from the registry

      • python-3.12.10-amd64.exe (PID: 4232)
      • msiexec.exe (PID: 2792)
      • python-3.12.10-amd64.exe (PID: 1128)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2792)

    • Reads the software policy settings

      • msiexec.exe (PID: 2792)
      • slui.exe (PID: 1192)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2792)

    • Manual execution by a user

      • python-3.12.10-amd64.exe (PID: 5952)

    • Checks proxy server information

      • slui.exe (PID: 1192)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:03:22 22:14:43+00:00
ImageFileCharacteristics: Executable, 32-bit, Removable run from swap, Net run from swap
PEType: PE32
LinkerVersion: 14.16
CodeSize: 314368
InitializedDataSize: 241152
UninitializedDataSize: -
EntryPoint: 0x302e5
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 3.12.10150.0
ProductVersionNumber: 3.12.10150.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Python Software Foundation
FileDescription: Python 3.12.10 (64-bit)
FileVersion: 3.12.10150.0
InternalName: setup
LegalCopyright: Copyright (c) Python Software Foundation. All rights reserved.
OriginalFileName: python-3.12.10-amd64.exe
ProductName: Python 3.12.10 (64-bit)
ProductVersion: 3.12.10150.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
7
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start python-3.12.10-amd64.exe python-3.12.10-amd64.exe msiexec.exe python-3.12.10-amd64.exe no specs python-3.12.10-amd64.exe no specs python-3.12.10-amd64.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
760"C:\Users\admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" /burn.log.append "C:\Users\admin\AppData\Local\Temp\Python 3.12.10 (64-bit)_20250706031003.log"C:\Users\admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe—python-3.12.10-amd64.exe
User:
admin
Company:
Python Software Foundation
Integrity Level:
MEDIUM
Description:
Python 3.12.10 (64-bit)
Exit code:
1618
Version:
3.12.10150.0
Modules
Images
c:\users\admin\appdata\local\package cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1128"C:\Users\admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" -burn.clean.room="C:\Users\admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" -burn.filehandle.attached=552 -burn.filehandle.self=568 /burn.log.append "C:\Users\admin\AppData\Local\Temp\Python 3.12.10 (64-bit)_20250706031003.log"C:\Users\admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe
python-3.12.10-amd64.exe
User:
admin
Company:
Python Software Foundation
Integrity Level:
MEDIUM
Description:
Python 3.12.10 (64-bit)
Exit code:
1618
Version:
3.12.10150.0
Modules
Images
c:\users\admin\appdata\local\package cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1192C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2792C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4232"C:\Users\admin\AppData\Local\Temp\{0DB06B89-62B3-4D0D-8CCB-F38536D56E91}\.cr\python-3.12.10-amd64.exe" -burn.clean.room="C:\Users\admin\Desktop\python-3.12.10-amd64.exe" -burn.filehandle.attached=596 -burn.filehandle.self=560 C:\Users\admin\AppData\Local\Temp\{0DB06B89-62B3-4D0D-8CCB-F38536D56E91}\.cr\python-3.12.10-amd64.exe
python-3.12.10-amd64.exe
User:
admin
Company:
Python Software Foundation
Integrity Level:
MEDIUM
Description:
Python 3.12.10 (64-bit)
Version:
3.12.10150.0
Modules
Images
c:\users\admin\appdata\local\temp\{0db06b89-62b3-4d0d-8ccb-f38536d56e91}\.cr\python-3.12.10-amd64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5952"C:\Users\admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" /burn.runonceC:\Users\admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe—explorer.exe
User:
admin
Company:
Python Software Foundation
Integrity Level:
MEDIUM
Description:
Python 3.12.10 (64-bit)
Exit code:
0
Version:
3.12.10150.0
Modules
Images
c:\users\admin\appdata\local\package cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
5960"C:\Users\admin\Desktop\python-3.12.10-amd64.exe" C:\Users\admin\Desktop\python-3.12.10-amd64.exe
explorer.exe
User:
admin
Company:
Python Software Foundation
Integrity Level:
MEDIUM
Description:
Python 3.12.10 (64-bit)
Version:
3.12.10150.0
Modules
Images
c:\users\admin\desktop\python-3.12.10-amd64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
30 156
Read events
26 233
Write events
3 846
Delete events
77

Modification events

(PID) Process:(4232) python-3.12.10-amd64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}
Operation:writeName:BundleCachePath
Value:
C:\Users\admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe
(PID) Process:(4232) python-3.12.10-amd64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}
Operation:writeName:BundleUpgradeCode
Value:
{114AEC44-152B-5746-952F-F20CE3CAB54A}
(PID) Process:(4232) python-3.12.10-amd64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}
Operation:writeName:BundleAddonCode
Value:
(PID) Process:(4232) python-3.12.10-amd64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}
Operation:writeName:BundleDetectCode
Value:
(PID) Process:(4232) python-3.12.10-amd64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}
Operation:writeName:BundlePatchCode
Value:
(PID) Process:(4232) python-3.12.10-amd64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}
Operation:writeName:BundleVersion
Value:
3.12.10150.0
(PID) Process:(4232) python-3.12.10-amd64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}
Operation:writeName:VersionMajor
Value:
3
(PID) Process:(4232) python-3.12.10-amd64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}
Operation:writeName:VersionMinor
Value:
12
(PID) Process:(4232) python-3.12.10-amd64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}
Operation:writeName:BundleProviderKey
Value:
CPython-3.12
(PID) Process:(4232) python-3.12.10-amd64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}
Operation:writeName:BundleTag
Value:
Executable files
79
Suspicious files
206
Text files
2 289
Unknown types
0

Dropped files

PID
Process
Filename
Type
4232python-3.12.10-amd64.exeC:\Users\admin\AppData\Local\Temp\{E89A95E0-8898-4D34-BBFE-76E080951BDC}\lib_JustForMe —
MD5:—
SHA256:—
4232python-3.12.10-amd64.exeC:\Users\admin\AppData\Local\Temp\{E89A95E0-8898-4D34-BBFE-76E080951BDC}\test_JustForMe —
MD5:—
SHA256:—
4232python-3.12.10-amd64.exeC:\Users\admin\AppData\Local\Temp\{E89A95E0-8898-4D34-BBFE-76E080951BDC}\doc_JustForMe —
MD5:—
SHA256:—
4232python-3.12.10-amd64.exeC:\Users\admin\AppData\Local\Temp\{E89A95E0-8898-4D34-BBFE-76E080951BDC}\.ba\PythonBA.dllexecutable
MD5:9043E6427D1C14C1948B254D87B402B7
SHA256:B68D689899CEEFC6D240D347B6505517A640E9FBD9AD96AB75F57D970F522980
5960python-3.12.10-amd64.exeC:\Users\admin\AppData\Local\Temp\{0DB06B89-62B3-4D0D-8CCB-F38536D56E91}\.cr\python-3.12.10-amd64.exeexecutable
MD5:AC8C41A65FF0E735E3E1D3AF3ED7F335
SHA256:8515944637BE89AAB89D2DC5D247BC21331E9C4179DC25E2FC24DF51A9EDA934
4232python-3.12.10-amd64.exeC:\Users\admin\AppData\Local\Package Cache\.unverified\lib_JustForMe —
MD5:—
SHA256:—
4232python-3.12.10-amd64.exeC:\Users\admin\AppData\Local\Package Cache\{DE12B597-D4BF-4B1B-BF5F-C5CE41AFBDFC}v3.12.10150.0\lib.msi —
MD5:—
SHA256:—
4232python-3.12.10-amd64.exeC:\Users\admin\AppData\Local\Package Cache\.unverified\test_JustForMe —
MD5:—
SHA256:—
4232python-3.12.10-amd64.exeC:\Users\admin\AppData\Local\Package Cache\{01F171AF-1F21-435E-BEE4-FCC4360C896C}v3.12.10150.0\test.msi —
MD5:—
SHA256:—
4232python-3.12.10-amd64.exeC:\Users\admin\AppData\Local\Package Cache\.unverified\doc_JustForMe —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
38
TCP/UDP connections
42
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6980
RUXIMICS.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6980
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2792
msiexec.exe
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBTDHsfuqfubd3pihvq4mgQVWgHWNwQUyH7SaoUqG8oZmAQHJ89QEE9oqKICEzMAAAAHh6M0o3uljhwAAAAAAAc%3D
unknown
—
—
whitelisted
—
—
POST
200
40.126.31.73:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
—
—
POST
400
20.190.159.73:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
GET
304
20.12.23.50:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6980
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6980
RUXIMICS.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6980
RUXIMICS.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
  • 2.20.245.137
  • 2.20.245.139
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 2.23.246.101
whitelisted
login.live.com
  • 40.126.31.73
  • 40.126.31.130
  • 40.126.31.67
  • 20.190.159.131
  • 20.190.159.71
  • 40.126.31.71
  • 40.126.31.129
  • 20.190.159.73
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
python-3.12.10-amd64.exe