File name:

tiktokliveloBOTomy.exe

Full analysis: https://app.any.run/tasks/b9536363-d18f-436b-954f-033d5ccad430
Verdict: Malicious activity
Analysis date: May 30, 2025, 16:37:40
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
python
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 7 sections
MD5:

0470FD96CC7F6977DB7A105CF3223426

SHA1:

8D4B696D5F55CF046D3D0D41B28AA530BAEBD903

SHA256:

BC8B58268A2B3D66DF00EB323930070F50A3B8BA287E6DBBA94BF1C56F38EC3B

SSDEEP:

98304:Zxb22kvrUjBkzKVfqUZwlB4N+wcTAScUCYwVg8wonKl7wB6q8IZEvXNFoFqetIwO:3fqqTyYiwnGrRpDytiITf68YoQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • The process drops C-runtime libraries

      • tiktokliveloBOTomy.exe (PID: 2652)
      • tiktokliveloBOTomy.exe (PID: 6960)
      • tiktokliveloBOTomy.exe (PID: 7952)
      • tiktokliveloBOTomy.exe (PID: 7708)
      • tiktokliveloBOTomy.exe (PID: 3100)
      • tiktokliveloBOTomy.exe (PID: 8100)

    • Process drops legitimate windows executable

      • tiktokliveloBOTomy.exe (PID: 2652)
      • tiktokliveloBOTomy.exe (PID: 6960)
      • tiktokliveloBOTomy.exe (PID: 7952)
      • tiktokliveloBOTomy.exe (PID: 7708)
      • tiktokliveloBOTomy.exe (PID: 3100)
      • tiktokliveloBOTomy.exe (PID: 8100)

    • Executable content was dropped or overwritten

      • tiktokliveloBOTomy.exe (PID: 2652)
      • tiktokliveloBOTomy.exe (PID: 6960)
      • tiktokliveloBOTomy.exe (PID: 7952)
      • tiktokliveloBOTomy.exe (PID: 7708)
      • tiktokliveloBOTomy.exe (PID: 3100)
      • tiktokliveloBOTomy.exe (PID: 8100)

    • Application launched itself

      • tiktokliveloBOTomy.exe (PID: 2652)
      • tiktokliveloBOTomy.exe (PID: 6960)
      • tiktokliveloBOTomy.exe (PID: 7708)
      • tiktokliveloBOTomy.exe (PID: 7952)
      • tiktokliveloBOTomy.exe (PID: 3100)
      • tiktokliveloBOTomy.exe (PID: 8100)

    • Process drops python dynamic module

      • tiktokliveloBOTomy.exe (PID: 2652)
      • tiktokliveloBOTomy.exe (PID: 6960)
      • tiktokliveloBOTomy.exe (PID: 7952)
      • tiktokliveloBOTomy.exe (PID: 7708)
      • tiktokliveloBOTomy.exe (PID: 3100)
      • tiktokliveloBOTomy.exe (PID: 8100)

    • Loads Python modules

      • tiktokliveloBOTomy.exe (PID: 1052)
      • tiktokliveloBOTomy.exe (PID: 7852)
      • tiktokliveloBOTomy.exe (PID: 7220)

    • Starts another process probably with elevated privileges via RUNAS.EXE

      • runas.exe (PID: 5576)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6740)

  • INFO

    • Create files in a temporary directory

      • tiktokliveloBOTomy.exe (PID: 2652)
      • tiktokliveloBOTomy.exe (PID: 6960)
      • tiktokliveloBOTomy.exe (PID: 7952)

    • Checks supported languages

      • tiktokliveloBOTomy.exe (PID: 2652)
      • tiktokliveloBOTomy.exe (PID: 1052)
      • tiktokliveloBOTomy.exe (PID: 6960)
      • tiktokliveloBOTomy.exe (PID: 7852)
      • tiktokliveloBOTomy.exe (PID: 7952)
      • tiktokliveloBOTomy.exe (PID: 7220)

    • The sample compiled with english language support

      • tiktokliveloBOTomy.exe (PID: 2652)
      • tiktokliveloBOTomy.exe (PID: 6960)
      • tiktokliveloBOTomy.exe (PID: 7952)
      • tiktokliveloBOTomy.exe (PID: 3100)
      • tiktokliveloBOTomy.exe (PID: 7708)
      • tiktokliveloBOTomy.exe (PID: 8100)

    • Reads the computer name

      • tiktokliveloBOTomy.exe (PID: 2652)
      • tiktokliveloBOTomy.exe (PID: 1052)
      • tiktokliveloBOTomy.exe (PID: 6960)
      • tiktokliveloBOTomy.exe (PID: 7852)
      • tiktokliveloBOTomy.exe (PID: 7952)
      • tiktokliveloBOTomy.exe (PID: 7220)

    • Manual execution by a user

      • tiktokliveloBOTomy.exe (PID: 6960)
      • cmd.exe (PID: 7292)
      • cmd.exe (PID: 6740)
      • tiktokliveloBOTomy.exe (PID: 8100)
      • cmd.exe (PID: 2616)

    • Reads the software policy settings

      • slui.exe (PID: 6980)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:05:30 16:34:49+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.42
CodeSize: 178688
InitializedDataSize: 153600
UninitializedDataSize: -
EntryPoint: 0xc380
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
157
Monitored processes
27
Malicious processes
0
Suspicious processes
7

Behavior graph

Click at the process to see the details
start tiktoklivelobotomy.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe tiktoklivelobotomy.exe no specs rundll32.exe no specs tiktoklivelobotomy.exe conhost.exe no specs tiktoklivelobotomy.exe no specs cmd.exe no specs conhost.exe no specs tiktoklivelobotomy.exe tiktoklivelobotomy.exe no specs slui.exe cmd.exe no specs conhost.exe no specs runas.exe no specs cmd.exe conhost.exe no specs tiktoklivelobotomy.exe tiktoklivelobotomy.exe tiktoklivelobotomy.exe tiktoklivelobotomy.exe powershell.exe no specs tiktoklivelobotomy.exe conhost.exe no specs tiktoklivelobotomy.exe

Process information

PID
CMD
Path
Indicators
Parent process
456C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
680\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1052"C:\Users\admin\AppData\Local\Temp\tiktokliveloBOTomy.exe" C:\Users\admin\AppData\Local\Temp\tiktokliveloBOTomy.exe—tiktokliveloBOTomy.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\tiktoklivelobotomy.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2040C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2104\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2244C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
2332\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—tiktokliveloBOTomy.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2616"C:\Windows\System32\cmd.exe" C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
3221225786
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\wldp.dll
2652"C:\Users\admin\AppData\Local\Temp\tiktokliveloBOTomy.exe" C:\Users\admin\AppData\Local\Temp\tiktokliveloBOTomy.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\tiktoklivelobotomy.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3100tiktokliveloBOTomy.exeC:\Users\admin\Desktop\tiktokliveloBOTomy.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\tiktoklivelobotomy.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
8 374
Read events
8 374
Write events
0
Delete events
0

Modification events

No data
Executable files
168
Suspicious files
7
Text files
226
Unknown types
0

Dropped files

PID
Process
Filename
Type
2652tiktokliveloBOTomy.exeC:\Users\admin\AppData\Local\Temp\_MEI26522\MarkupSafe-3.0.2.dist-info\INSTALLERtext
MD5:365C9BFEB7D89244F2CE01C1DE44CB85
SHA256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
2652tiktokliveloBOTomy.exeC:\Users\admin\AppData\Local\Temp\_MEI26522\MarkupSafe-3.0.2.dist-info\top_level.txttext
MD5:5862354C9FBB5B15204672C79808E25C
SHA256:AB2D0F9637B9209BAFB020637A32728430A310075C0CB2BFD9A81571EC7C67A5
2652tiktokliveloBOTomy.exeC:\Users\admin\AppData\Local\Temp\_MEI26522\VCRUNTIME140.dllexecutable
MD5:862F820C3251E4CA6FC0AC00E4092239
SHA256:36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
2652tiktokliveloBOTomy.exeC:\Users\admin\AppData\Local\Temp\_MEI26522\_multiprocessing.pydexecutable
MD5:705AC24F30DC9487DC709307D15108ED
SHA256:59134B754C6ACA9449E2801E9E7ED55279C4F1ED58FE7A7A9F971C84E8A32A6C
2652tiktokliveloBOTomy.exeC:\Users\admin\AppData\Local\Temp\_MEI26522\_socket.pydexecutable
MD5:FE896371430BD9551717EF12A3E7E818
SHA256:35246B04C6C7001CA448554246445A845CE116814A29B18B617EA38752E4659B
2652tiktokliveloBOTomy.exeC:\Users\admin\AppData\Local\Temp\_MEI26522\_decimal.pydexecutable
MD5:F3377F3DE29579140E2BBAEEFD334D4F
SHA256:B715D1C18E9A9C1531F21C02003B4C6726742D1A2441A1893BC3D79D7BB50E91
2652tiktokliveloBOTomy.exeC:\Users\admin\AppData\Local\Temp\_MEI26522\_lzma.pydexecutable
MD5:1BA022D42024A655CF289544AE461FB8
SHA256:D080EABD015A3569813A220FD4EA74DFF34ED2A8519A10473EB37E22B1118A06
2652tiktokliveloBOTomy.exeC:\Users\admin\AppData\Local\Temp\_MEI26522\_ctypes.pydexecutable
MD5:A55E57D7594303C89B5F7A1D1D6F2B67
SHA256:F63C6C7E71C342084D8F1A108786CA6975A52CEFEF8BE32CC2589E6E2FE060C8
2652tiktokliveloBOTomy.exeC:\Users\admin\AppData\Local\Temp\_MEI26522\_queue.pydexecutable
MD5:1C03CAA59B5E4A7FB9B998D8C1DA165A
SHA256:B9CF502DADCB124F693BF69ECD7077971E37174104DBDA563022D74961A67E1E
2652tiktokliveloBOTomy.exeC:\Users\admin\AppData\Local\Temp\_MEI26522\MarkupSafe-3.0.2.dist-info\WHEELtext
MD5:C16DB81DA71B13B0EF4D8A11883C1ABD
SHA256:FAFFF2674F1F4A49ECA13EB6A08286F70A75782055F7F6A8DAB3B805E2117936
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
36
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2392
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2392
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
7504
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
6544
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7504
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 184.30.21.171
whitelisted
google.com
  • 142.250.185.238
whitelisted
login.live.com
  • 20.190.160.22
  • 20.190.160.128
  • 20.190.160.65
  • 40.126.32.138
  • 20.190.160.3
  • 20.190.160.20
  • 20.190.160.64
  • 20.190.160.17
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
tiktokliveloBOTomy.exe