EchoTrail

Python 3.15.2

by Python Software Foundationinstaller signed by Python Software FoundationValid

Sources: observed in the EchoTrail lab on Windows 11 on November 11, 2026.

The install

Installer
python-3.15.2-amd64.exe
Installer type
burn
Installed through
a type-detected silent switch
Install directory
C:\Users\lab\AppData\Local\Programs
Launched
python.exe
Windows
Windows 11
Date
November 11, 2026
Executables dropped
32

installer sha256 06e225a228191b0f4d1dcf6905fbb21bf9f6970d13a2ec63137ab9bee76f15aa

The lab used Python for 1 minute, then rebooted and watched what came back.

On screen

Frames from the lab session, cropped to Python's own windows.

Python 3.15.2: First window
First window. A Python 3.15.2 interactive console window is open showing the >>> prompt.
Python 3.15.2: Main window
Main window. A Python 3.15.2 interactive console is open and shows a SyntaxError from the earlier typed input, with a fresh >>> prompt waiting.
Python 3.15.2: First window
First window. A Python 3.15.2 interactive console window is open at the >>> prompt, with no GUI settings or menus.

What it dropped

Executables

  • python315.dllsigned by CN=Python Software Foundation, O=Python Software Foundation, L=Beaverton, S=Oregon, C=USValid
    C:\Users\lab\AppData\Local\Programs\Python\Python315\python315.dll
    sha256 9862572fd449f32a62c1eaec2c6750a9c9fa512f4c9c2ea0e66776cf9212b7c2
  • libcrypto-3.dllsigned by CN=Python Software Foundation, O=Python Software Foundation, L=Beaverton, S=Oregon, C=USValid
    C:\Users\lab\AppData\Local\Programs\Python\Python315\DLLs\libcrypto-3.dll
    sha256 75495fe0e079ab00d49be740d3c710a0b94e3f74f9648cb7cc9f768fc7f52319
  • tcl90.dllNotSigned
    C:\Users\lab\AppData\Local\Programs\Python\Python315\DLLs\tcl90.dll
    sha256 a1fb45f963b05cb083a97df1449c2023b484eb921d40a463da7501b0f60e0f70
  • tcl9tk90.dllNotSigned
    C:\Users\lab\AppData\Local\Programs\Python\Python315\DLLs\tcl9tk90.dll
    sha256 31f625c52e65d29d126e710ed8bab2ec964cb770e4fc59bc329dfff02cb6ddcf
  • sqlite3.dll
    C:\Users\lab\AppData\Local\Programs\Python\Python315\DLLs\sqlite3.dll
    sha256 73530e8f4555605d716352ee98fe0ce205a09e5eec57e7e6360d4c915efcacd8
  • libssl-3.dllsigned by CN=Python Software Foundation, O=Python Software Foundation, L=Beaverton, S=Oregon, C=USValid
    C:\Users\lab\AppData\Local\Programs\Python\Python315\DLLs\libssl-3.dll
    sha256 8957182a9c385bfd9f3f790921de2ddc614cf91f99edbed4e9e5446a46504e32
  • py.exe
    C:\Users\lab\AppData\Local\Programs\Python\Launcher\py.exe
    sha256 01b1afb3ee583f6c4fef785c516c4d64975ffce413facec6faf5e46ea9971678
  • pyw.exe
    C:\Users\lab\AppData\Local\Programs\Python\Launcher\pyw.exe
    sha256 840beb708abf0f51544a5da84a8efbf2454439241abb9e2307a7f20dc4c88d87
  • venvlauncher.exe
    C:\Users\lab\AppData\Local\Programs\Python\Python315\Lib\venv\scripts\nt\venvlauncher.exe
    sha256 15602729911d32e3ec40ba144bca6b720a12176436c867fface126a4d5dccb20
  • venvwlauncher.exe
    C:\Users\lab\AppData\Local\Programs\Python\Python315\Lib\venv\scripts\nt\venvwlauncher.exe
    sha256 7f7792928e8164c0dbe44b7234196cfccf037adc56396bce9c088e3488e0f82a
  • t64-arm.exe
    C:\Users\lab\AppData\Local\Programs\Python\Python315\Lib\site-packages\pip\_vendor\distlib\t64-arm.exe
    sha256 ebc4c06b7d95e74e315419ee7e88e1d0f71e9e9477538c00a93a9ff8c66a6cfc
  • vcruntime140.dllsigned by CN=Microsoft Windows Software Compatibility Publisher, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Users\lab\AppData\Local\Programs\Python\Python315\vcruntime140.dll
    sha256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
  • w64-arm.exe
    C:\Users\lab\AppData\Local\Programs\Python\Python315\Lib\site-packages\pip\_vendor\distlib\w64-arm.exe
    sha256 c5dc9884a8f458371550e09bd396e5418bf375820a31b9899f6499bf391c7b2e
  • pip.exe
    C:\Users\lab\AppData\Local\Programs\Python\Python315\Scripts\pip.exe
    sha256 40a3dc944b4d0aa6662c17b7c0b75d5dc5f53d68f6316677ad4862bf13455840
  • pip3.15.exe
    C:\Users\lab\AppData\Local\Programs\Python\Python315\Scripts\pip3.15.exe
    sha256 40a3dc944b4d0aa6662c17b7c0b75d5dc5f53d68f6316677ad4862bf13455840
  • pip3.exe
    C:\Users\lab\AppData\Local\Programs\Python\Python315\Scripts\pip3.exe
    sha256 40a3dc944b4d0aa6662c17b7c0b75d5dc5f53d68f6316677ad4862bf13455840
  • t64.exe
    C:\Users\lab\AppData\Local\Programs\Python\Python315\Lib\site-packages\pip\_vendor\distlib\t64.exe
    sha256 81a618f21cb87db9076134e70388b6e9cb7c2106739011b6a51772d22cae06b7
  • python.exesigned by CN=Python Software Foundation, O=Python Software Foundation, L=Beaverton, S=Oregon, C=USValidran during the lab session
    C:\Users\lab\AppData\Local\Programs\Python\Python315\python.exe
    sha256 d4e19e9a33268fb0ce575a24ab2d4b85972524f1933df008a6befc14dce19fbd
  • pythonw.exesigned by CN=Python Software Foundation, O=Python Software Foundation, L=Beaverton, S=Oregon, C=USValidran during the lab session
    C:\Users\lab\AppData\Local\Programs\Python\Python315\pythonw.exe
    sha256 eec71feb5d41f43b707a1736e8c3a510bd667bc5e1062de924cc24a7713eace0
  • zlib1.dllNotSigned
    C:\Users\lab\AppData\Local\Programs\Python\Python315\DLLs\zlib1.dll
    sha256 f07195206534ebb1fe75093d4ec6c54a7a9227281b0c09d2113465b71da9e900
  • w64.exe
    C:\Users\lab\AppData\Local\Programs\Python\Python315\Lib\site-packages\pip\_vendor\distlib\w64.exe
    sha256 7a319ffaba23a017d7b1e18ba726ba6c54c53d6446db55f92af53c279894f8ad
  • t32.exe
    C:\Users\lab\AppData\Local\Programs\Python\Python315\Lib\site-packages\pip\_vendor\distlib\t32.exe
    sha256 6b4195e640a85ac32eb6f9628822a622057df1e459df7c17a12f97aeabc9415b
  • w32.exe
    C:\Users\lab\AppData\Local\Programs\Python\Python315\Lib\site-packages\pip\_vendor\distlib\w32.exe
    sha256 47872cc77f8e18cf642f868f23340a468e537e64521d9a3a416c8b84384d064b
  • libtommath.dllNotSigned
    C:\Users\lab\AppData\Local\Programs\Python\Python315\DLLs\libtommath.dll
    sha256 2d760fefb452665b6af8c8d9d29f3a8378f10fc0847cdd9938ea0cb5edf1d573
  • python3.dllsigned by CN=Python Software Foundation, O=Python Software Foundation, L=Beaverton, S=Oregon, C=USValid
    C:\Users\lab\AppData\Local\Programs\Python\Python315\python3.dll
    sha256 e394c32bb9e2f0d813f4ed5b858ba717e54e3e6547cd36a8d8aaee66b9ca347f
  • python3t.dllsigned by CN=Python Software Foundation, O=Python Software Foundation, L=Beaverton, S=Oregon, C=USValid
    C:\Users\lab\AppData\Local\Programs\Python\Python315\abi3t-compat\python3t.dll
    sha256 c4c1db006228553e4b728b7856b74a007384e608c7b07e6ae8e0d8251d077e5b
  • pyshellext.amd64.dll
    C:\Users\lab\AppData\Local\Programs\Python\Launcher\pyshellext.amd64.dll
    sha256 4ba0a77bd5828719588932ae8561aec74a34776b8671e2c90e28cf0cc4668cfe
  • vcruntime140_1.dllsigned by CN=Microsoft Windows Software Compatibility Publisher, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValid
    C:\Users\lab\AppData\Local\Programs\Python\Python315\vcruntime140_1.dll
    sha256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
  • libffi-8.dllsigned by CN=Python Software Foundation, O=Python Software Foundation, L=Beaverton, S=Oregon, C=USValid
    C:\Users\lab\AppData\Local\Programs\Python\Python315\DLLs\libffi-8.dll
    sha256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
  • tcl9dde14.dll
    C:\Users\lab\AppData\Local\Programs\Python\Python315\tcl\dde1.4\tcl9dde14.dll
    sha256 026cbe1fdca1d3f1b70f1107f0234369112fe450a82bea4441f006922bac6308
  • x86_64-w64-mingw32-nmakehlp.exe
    C:\Users\lab\AppData\Local\Programs\Python\Python315\tcl\nmake\x86_64-w64-mingw32-nmakehlp.exe
    sha256 9864a474f6b37a6567554e3c6211befaf4dcfc84bc1ce1dd92115651711f62dc
  • tcl9registry13.dll
    C:\Users\lab\AppData\Local\Programs\Python\Python315\tcl\registry1.3\tcl9registry13.dll
    sha256 3f01c45eb1be612f0240e3a26de0c24219169b4d037158771d0f3d7e1da65be3

What it talked to

Destinations

  • 127.0.0.1:50147asked by pythonw.exe4 connections