File name: | python-3.12.10-amd64.exe |
Full analysis: | https://app.any.run/tasks/4fbbe9cb-419a-47b3-9a4d-9e9635b8e3d1 |
Verdict: | Malicious activity |
Analysis date: | July 06, 2025, 03:09:49 |
OS: | Windows 10 Professional (build: 19044, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.microsoft.portable-executable |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections |
MD5: | 5EDDB0B6F12C852725DE071AE681DDE4 |
SHA1: | 34DACAE62B262746F850C011A14888F4FFED20F2 |
SHA256: | 67B5635E80EA51072B87941312D00EC8927C4DB9BA18938F7AD2D27B328B95FB |
SSDEEP: | 196608:r0j1J+hO+VjKAAtkm5bJAzLfLcZ+ozyWZgRwqEHUMn:wjH+Qg+AAeaiYZ+6yndU |
.exe | | | Win32 Executable (generic) (52.9) |
---|---|---|
.exe | | | Generic Win/DOS Executable (23.5) |
.exe | | | DOS Executable Generic (23.5) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2024:03:22 22:14:43+00:00 |
ImageFileCharacteristics: | Executable, 32-bit, Removable run from swap, Net run from swap |
PEType: | PE32 |
LinkerVersion: | 14.16 |
CodeSize: | 314368 |
InitializedDataSize: | 241152 |
UninitializedDataSize: | - |
EntryPoint: | 0x302e5 |
OSVersion: | 6 |
ImageVersion: | - |
SubsystemVersion: | 6 |
Subsystem: | Windows GUI |
FileVersionNumber: | 3.12.10150.0 |
ProductVersionNumber: | 3.12.10150.0 |
FileFlagsMask: | 0x003f |
FileFlags: | (none) |
FileOS: | Win32 |
ObjectFileType: | Executable application |
FileSubtype: | - |
LanguageCode: | English (U.S.) |
CharacterSet: | Windows, Latin1 |
CompanyName: | Python Software Foundation |
FileDescription: | Python 3.12.10 (64-bit) |
FileVersion: | 3.12.10150.0 |
InternalName: | setup |
LegalCopyright: | Copyright (c) Python Software Foundation. All rights reserved. |
OriginalFileName: | python-3.12.10-amd64.exe |
ProductName: | Python 3.12.10 (64-bit) |
ProductVersion: | 3.12.10150.0 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
760 | "C:\Users\admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" /burn.log.append "C:\Users\admin\AppData\Local\Temp\Python 3.12.10 (64-bit)_20250706031003.log" | C:\Users\admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe | — | python-3.12.10-amd64.exe | |||||||||||
User: admin Company: Python Software Foundation Integrity Level: MEDIUM Description: Python 3.12.10 (64-bit) Exit code: 1618 Version: 3.12.10150.0 Modules
| |||||||||||||||
1128 | "C:\Users\admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" -burn.clean.room="C:\Users\admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" -burn.filehandle.attached=552 -burn.filehandle.self=568 /burn.log.append "C:\Users\admin\AppData\Local\Temp\Python 3.12.10 (64-bit)_20250706031003.log" | C:\Users\admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe | python-3.12.10-amd64.exe | ||||||||||||
User: admin Company: Python Software Foundation Integrity Level: MEDIUM Description: Python 3.12.10 (64-bit) Exit code: 1618 Version: 3.12.10150.0 Modules
| |||||||||||||||
1192 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
2792 | C:\WINDOWS\system32\msiexec.exe /V | C:\Windows\System32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
4232 | "C:\Users\admin\AppData\Local\Temp\{0DB06B89-62B3-4D0D-8CCB-F38536D56E91}\.cr\python-3.12.10-amd64.exe" -burn.clean.room="C:\Users\admin\Desktop\python-3.12.10-amd64.exe" -burn.filehandle.attached=596 -burn.filehandle.self=560 | C:\Users\admin\AppData\Local\Temp\{0DB06B89-62B3-4D0D-8CCB-F38536D56E91}\.cr\python-3.12.10-amd64.exe | python-3.12.10-amd64.exe | ||||||||||||
User: admin Company: Python Software Foundation Integrity Level: MEDIUM Description: Python 3.12.10 (64-bit) Version: 3.12.10150.0 Modules
| |||||||||||||||
5952 | "C:\Users\admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe" /burn.runonce | C:\Users\admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe | — | explorer.exe | |||||||||||
User: admin Company: Python Software Foundation Integrity Level: MEDIUM Description: Python 3.12.10 (64-bit) Exit code: 0 Version: 3.12.10150.0 Modules
| |||||||||||||||
5960 | "C:\Users\admin\Desktop\python-3.12.10-amd64.exe" | C:\Users\admin\Desktop\python-3.12.10-amd64.exe | explorer.exe | ||||||||||||
User: admin Company: Python Software Foundation Integrity Level: MEDIUM Description: Python 3.12.10 (64-bit) Version: 3.12.10150.0 Modules
|
(PID) Process: | (4232) python-3.12.10-amd64.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf} |
Operation: | write | Name: | BundleCachePath |
Value: C:\Users\admin\AppData\Local\Package Cache\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf}\python-3.12.10-amd64.exe | |||
(PID) Process: | (4232) python-3.12.10-amd64.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf} |
Operation: | write | Name: | BundleUpgradeCode |
Value: {114AEC44-152B-5746-952F-F20CE3CAB54A} | |||
(PID) Process: | (4232) python-3.12.10-amd64.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf} |
Operation: | write | Name: | BundleAddonCode |
Value: | |||
(PID) Process: | (4232) python-3.12.10-amd64.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf} |
Operation: | write | Name: | BundleDetectCode |
Value: | |||
(PID) Process: | (4232) python-3.12.10-amd64.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf} |
Operation: | write | Name: | BundlePatchCode |
Value: | |||
(PID) Process: | (4232) python-3.12.10-amd64.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf} |
Operation: | write | Name: | BundleVersion |
Value: 3.12.10150.0 | |||
(PID) Process: | (4232) python-3.12.10-amd64.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf} |
Operation: | write | Name: | VersionMajor |
Value: 3 | |||
(PID) Process: | (4232) python-3.12.10-amd64.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf} |
Operation: | write | Name: | VersionMinor |
Value: 12 | |||
(PID) Process: | (4232) python-3.12.10-amd64.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf} |
Operation: | write | Name: | BundleProviderKey |
Value: CPython-3.12 | |||
(PID) Process: | (4232) python-3.12.10-amd64.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{b6ce88eb-2ce3-4d91-8efc-425ae1f48caf} |
Operation: | write | Name: | BundleTag |
Value: |
PID | Process | Filename | Type | |
---|---|---|---|---|
4232 | python-3.12.10-amd64.exe | C:\Users\admin\AppData\Local\Temp\{E89A95E0-8898-4D34-BBFE-76E080951BDC}\lib_JustForMe | — | |
MD5:— | SHA256:— | |||
4232 | python-3.12.10-amd64.exe | C:\Users\admin\AppData\Local\Temp\{E89A95E0-8898-4D34-BBFE-76E080951BDC}\test_JustForMe | — | |
MD5:— | SHA256:— | |||
4232 | python-3.12.10-amd64.exe | C:\Users\admin\AppData\Local\Temp\{E89A95E0-8898-4D34-BBFE-76E080951BDC}\doc_JustForMe | — | |
MD5:— | SHA256:— | |||
4232 | python-3.12.10-amd64.exe | C:\Users\admin\AppData\Local\Temp\{E89A95E0-8898-4D34-BBFE-76E080951BDC}\.ba\Default.wxl | xml | |
MD5:411D2DC96FFF95E6BE82A9BBE882AF7B | SHA256:1529FAD8A804911B2854233DADBA6E36CEBA35EDCE6AA1838818142CB3936384 | |||
4232 | python-3.12.10-amd64.exe | C:\Users\admin\AppData\Local\Temp\{E89A95E0-8898-4D34-BBFE-76E080951BDC}\.ba\PythonBA.dll | executable | |
MD5:9043E6427D1C14C1948B254D87B402B7 | SHA256:B68D689899CEEFC6D240D347B6505517A640E9FBD9AD96AB75F57D970F522980 | |||
4232 | python-3.12.10-amd64.exe | C:\Users\admin\AppData\Local\Package Cache\.unverified\lib_JustForMe | — | |
MD5:— | SHA256:— | |||
4232 | python-3.12.10-amd64.exe | C:\Users\admin\AppData\Local\Package Cache\{DE12B597-D4BF-4B1B-BF5F-C5CE41AFBDFC}v3.12.10150.0\lib.msi | — | |
MD5:— | SHA256:— | |||
4232 | python-3.12.10-amd64.exe | C:\Users\admin\AppData\Local\Package Cache\.unverified\test_JustForMe | — | |
MD5:— | SHA256:— | |||
4232 | python-3.12.10-amd64.exe | C:\Users\admin\AppData\Local\Package Cache\{01F171AF-1F21-435E-BEE4-FCC4360C896C}v3.12.10150.0\test.msi | — | |
MD5:— | SHA256:— | |||
4232 | python-3.12.10-amd64.exe | C:\Users\admin\AppData\Local\Package Cache\.unverified\doc_JustForMe | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1268 | svchost.exe | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6980 | RUXIMICS.exe | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6980 | RUXIMICS.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | POST | 200 | 40.126.31.73:443 | https://login.live.com/RST2.srf | unknown | xml | 1.24 Kb | whitelisted |
— | — | POST | 400 | 20.190.159.73:443 | https://login.live.com/ppsecure/deviceaddcredential.srf | unknown | text | 203 b | whitelisted |
2792 | msiexec.exe | GET | 200 | 204.79.197.203:80 | http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBTDHsfuqfubd3pihvq4mgQVWgHWNwQUyH7SaoUqG8oZmAQHJ89QEE9oqKICEzMAAAAHh6M0o3uljhwAAAAAAAc%3D | unknown | — | — | whitelisted |
— | — | POST | 400 | 40.126.31.129:443 | https://login.live.com/ppsecure/deviceaddcredential.srf | unknown | text | 203 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1268 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5944 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6980 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1268 | svchost.exe | 23.216.77.6:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5944 | MoUsoCoreWorker.exe | 23.216.77.6:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
6980 | RUXIMICS.exe | 23.216.77.6:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
1268 | svchost.exe | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
6980 | RUXIMICS.exe | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
Domain | IP | Reputation |
---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
oneocsp.microsoft.com |
| whitelisted |
nexusrules.officeapps.live.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |