File name:

tiktokliveloBOTomy.exe

Full analysis: https://app.any.run/tasks/b9536363-d18f-436b-954f-033d5ccad430
Verdict: Malicious activity
Analysis date: May 30, 2025, 16:37:40
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
python
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 7 sections
MD5:

0470FD96CC7F6977DB7A105CF3223426

SHA1:

8D4B696D5F55CF046D3D0D41B28AA530BAEBD903

SHA256:

BC8B58268A2B3D66DF00EB323930070F50A3B8BA287E6DBBA94BF1C56F38EC3B

SSDEEP:

98304:Zxb22kvrUjBkzKVfqUZwlB4N+wcTAScUCYwVg8wonKl7wB6q8IZEvXNFoFqetIwO:3fqqTyYiwnGrRpDytiITf68YoQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • tiktokliveloBOTomy.exe (PID: 2652)
      • tiktokliveloBOTomy.exe (PID: 6960)
      • tiktokliveloBOTomy.exe (PID: 7708)
      • tiktokliveloBOTomy.exe (PID: 7952)
      • tiktokliveloBOTomy.exe (PID: 3100)
      • tiktokliveloBOTomy.exe (PID: 8100)

    • Process drops legitimate windows executable

      • tiktokliveloBOTomy.exe (PID: 2652)
      • tiktokliveloBOTomy.exe (PID: 6960)
      • tiktokliveloBOTomy.exe (PID: 7708)
      • tiktokliveloBOTomy.exe (PID: 7952)
      • tiktokliveloBOTomy.exe (PID: 8100)
      • tiktokliveloBOTomy.exe (PID: 3100)

    • Process drops python dynamic module

      • tiktokliveloBOTomy.exe (PID: 2652)
      • tiktokliveloBOTomy.exe (PID: 6960)
      • tiktokliveloBOTomy.exe (PID: 7952)
      • tiktokliveloBOTomy.exe (PID: 7708)
      • tiktokliveloBOTomy.exe (PID: 3100)
      • tiktokliveloBOTomy.exe (PID: 8100)

    • Application launched itself

      • tiktokliveloBOTomy.exe (PID: 2652)
      • tiktokliveloBOTomy.exe (PID: 6960)
      • tiktokliveloBOTomy.exe (PID: 7952)
      • tiktokliveloBOTomy.exe (PID: 8100)
      • tiktokliveloBOTomy.exe (PID: 7708)
      • tiktokliveloBOTomy.exe (PID: 3100)

    • The process drops C-runtime libraries

      • tiktokliveloBOTomy.exe (PID: 2652)
      • tiktokliveloBOTomy.exe (PID: 6960)
      • tiktokliveloBOTomy.exe (PID: 7708)
      • tiktokliveloBOTomy.exe (PID: 7952)
      • tiktokliveloBOTomy.exe (PID: 3100)
      • tiktokliveloBOTomy.exe (PID: 8100)

    • Loads Python modules

      • tiktokliveloBOTomy.exe (PID: 1052)
      • tiktokliveloBOTomy.exe (PID: 7852)
      • tiktokliveloBOTomy.exe (PID: 7220)

    • Starts another process probably with elevated privileges via RUNAS.EXE

      • runas.exe (PID: 5576)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6740)

  • INFO

    • Checks supported languages

      • tiktokliveloBOTomy.exe (PID: 2652)
      • tiktokliveloBOTomy.exe (PID: 1052)
      • tiktokliveloBOTomy.exe (PID: 7852)
      • tiktokliveloBOTomy.exe (PID: 7952)
      • tiktokliveloBOTomy.exe (PID: 6960)
      • tiktokliveloBOTomy.exe (PID: 7220)

    • Reads the computer name

      • tiktokliveloBOTomy.exe (PID: 2652)
      • tiktokliveloBOTomy.exe (PID: 1052)
      • tiktokliveloBOTomy.exe (PID: 7852)
      • tiktokliveloBOTomy.exe (PID: 7952)
      • tiktokliveloBOTomy.exe (PID: 6960)
      • tiktokliveloBOTomy.exe (PID: 7220)

    • The sample compiled with english language support

      • tiktokliveloBOTomy.exe (PID: 2652)
      • tiktokliveloBOTomy.exe (PID: 6960)
      • tiktokliveloBOTomy.exe (PID: 7708)
      • tiktokliveloBOTomy.exe (PID: 7952)
      • tiktokliveloBOTomy.exe (PID: 3100)
      • tiktokliveloBOTomy.exe (PID: 8100)

    • Create files in a temporary directory

      • tiktokliveloBOTomy.exe (PID: 2652)
      • tiktokliveloBOTomy.exe (PID: 6960)
      • tiktokliveloBOTomy.exe (PID: 7952)

    • Manual execution by a user

      • cmd.exe (PID: 7292)
      • tiktokliveloBOTomy.exe (PID: 6960)
      • cmd.exe (PID: 2616)
      • cmd.exe (PID: 6740)
      • tiktokliveloBOTomy.exe (PID: 8100)

    • Reads the software policy settings

      • slui.exe (PID: 6980)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:05:30 16:34:49+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.42
CodeSize: 178688
InitializedDataSize: 153600
UninitializedDataSize: -
EntryPoint: 0xc380
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
157
Monitored processes
27
Malicious processes
0
Suspicious processes
7

Behavior graph

Click at the process to see the details
start tiktoklivelobotomy.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe tiktoklivelobotomy.exe no specs rundll32.exe no specs tiktoklivelobotomy.exe conhost.exe no specs tiktoklivelobotomy.exe no specs cmd.exe no specs conhost.exe no specs tiktoklivelobotomy.exe tiktoklivelobotomy.exe no specs slui.exe cmd.exe no specs conhost.exe no specs runas.exe no specs cmd.exe conhost.exe no specs tiktoklivelobotomy.exe tiktoklivelobotomy.exe tiktoklivelobotomy.exe tiktoklivelobotomy.exe powershell.exe no specs tiktoklivelobotomy.exe conhost.exe no specs tiktoklivelobotomy.exe

Process information

PID
CMD
Path
Indicators
Parent process
456C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
680\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1052"C:\Users\admin\AppData\Local\Temp\tiktokliveloBOTomy.exe" C:\Users\admin\AppData\Local\Temp\tiktokliveloBOTomy.exe—tiktokliveloBOTomy.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\tiktoklivelobotomy.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2040C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2104\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2244C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
2332\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—tiktokliveloBOTomy.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2616"C:\Windows\System32\cmd.exe" C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
3221225786
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\wldp.dll
2652"C:\Users\admin\AppData\Local\Temp\tiktokliveloBOTomy.exe" C:\Users\admin\AppData\Local\Temp\tiktokliveloBOTomy.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\tiktoklivelobotomy.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3100tiktokliveloBOTomy.exeC:\Users\admin\Desktop\tiktokliveloBOTomy.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\tiktoklivelobotomy.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
8 374
Read events
8 374
Write events
0
Delete events
0

Modification events

No data
Executable files
168
Suspicious files
7
Text files
226
Unknown types
0

Dropped files

PID
Process
Filename
Type
2652tiktokliveloBOTomy.exeC:\Users\admin\AppData\Local\Temp\_MEI26522\MarkupSafe-3.0.2.dist-info\INSTALLERtext
MD5:365C9BFEB7D89244F2CE01C1DE44CB85
SHA256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
2652tiktokliveloBOTomy.exeC:\Users\admin\AppData\Local\Temp\_MEI26522\_decimal.pydexecutable
MD5:F3377F3DE29579140E2BBAEEFD334D4F
SHA256:B715D1C18E9A9C1531F21C02003B4C6726742D1A2441A1893BC3D79D7BB50E91
2652tiktokliveloBOTomy.exeC:\Users\admin\AppData\Local\Temp\_MEI26522\_cffi_backend.cp313-win_amd64.pydexecutable
MD5:5CBA92E7C00D09A55F5CBADC8D16CD26
SHA256:0E3D149B91FC7DC3367AB94620A5E13AF6E419F423B31D4800C381468CB8AD85
2652tiktokliveloBOTomy.exeC:\Users\admin\AppData\Local\Temp\_MEI26522\MarkupSafe-3.0.2.dist-info\LICENSE.txttext
MD5:779964CD6648AA66466FB0D1A9629339
SHA256:4631EC0DB5FD90A547E336817264C6798214338146F8AC94B4A57F96EE8C9EC4
2652tiktokliveloBOTomy.exeC:\Users\admin\AppData\Local\Temp\_MEI26522\MarkupSafe-3.0.2.dist-info\WHEELtext
MD5:C16DB81DA71B13B0EF4D8A11883C1ABD
SHA256:FAFFF2674F1F4A49ECA13EB6A08286F70A75782055F7F6A8DAB3B805E2117936
2652tiktokliveloBOTomy.exeC:\Users\admin\AppData\Local\Temp\_MEI26522\MarkupSafe-3.0.2.dist-info\METADATAhtml
MD5:60CC921B7461A060DAB0456B6EFFFA68
SHA256:9E1A1A6E3BA9046E358FF2713C2277CA582B67A171F2830215B88B17D29A7EA7
2652tiktokliveloBOTomy.exeC:\Users\admin\AppData\Local\Temp\_MEI26522\_bz2.pydexecutable
MD5:CB8C06C8FA9E61E4AC5F22EEBF7F1D00
SHA256:FC3B481684B926350057E263622A2A5335B149A0498A8D65C4F37E39DD90B640
2652tiktokliveloBOTomy.exeC:\Users\admin\AppData\Local\Temp\_MEI26522\VCRUNTIME140_1.dllexecutable
MD5:68156F41AE9A04D89BB6625A5CD222D4
SHA256:82A2F9AE1E6146AE3CB0F4BC5A62B7227E0384209D9B1AEF86BBCC105912F7CD
2652tiktokliveloBOTomy.exeC:\Users\admin\AppData\Local\Temp\_MEI26522\MarkupSafe-3.0.2.dist-info\RECORDcsv
MD5:1224727A3843BB10F2987DEEFB169610
SHA256:72E7F02F9C8BFC5E0EABB366E72934823B74E1AD956E1757A5F34246B52A7775
2652tiktokliveloBOTomy.exeC:\Users\admin\AppData\Local\Temp\_MEI26522\_asyncio.pydexecutable
MD5:80083B99812171FEA682B1CF38026816
SHA256:DBEAE7CB6F256998F9D8DE79D08C74D716D819EB4473B2725DBE2D53BA88000A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
36
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2392
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2392
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
7504
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
6544
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7504
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 184.30.21.171
whitelisted
google.com
  • 142.250.185.238
whitelisted
login.live.com
  • 20.190.160.22
  • 20.190.160.128
  • 20.190.160.65
  • 40.126.32.138
  • 20.190.160.3
  • 20.190.160.20
  • 20.190.160.64
  • 20.190.160.17
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
tiktokliveloBOTomy.exe