Manalyze report for 09c998cc8badece7f47ebf6b52ed84a7c5337320f53f7fc36a0ec2933218a866

Summary

Architecture	`IMAGE_FILE_MACHINE_I386`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
Compilation Date	2025-Dec-15 03:23:26
Detected languages	English - United States
TLS Callbacks	4 callback(s) detected.
Debug artifacts	app_shell_launcher.exe.pdb
FileDescription	TikTok LIVE Studio Launcher
ProductName	TikTok LIVE Studio
CompanyName	TikTok Pte. Ltd.
LegalCopyright	Copyright Â© 2026 TikTok Pte. Ltd.
FileVersion	`1.35.2`
ProductVersion	`1.35.2.0`

Plugin Output

Info	Matching compiler(s):	`Microsoft Visual C++ 6.0 - 8.0`
Suspicious	Strings found in the binary may indicate undesirable behavior:	`Accesses the WMI: ROOT\CIMV2` `Contains domain names: api.toutiaoapi.com blink.net byteoversea.com https://api.toutiaoapi.com https://maliva-mcs.byteoversea.com https://mcs.zijieapi.com https://www.tiktok.com https://www.tiktok.com/studio/download maliva-mcs.byteoversea.com mcs.byteoversea.com mcs.zijieapi.com openssl.org tiktok.com toutiaoapi.com www.tiktok.com zijieapi.com`
Info	Cryptographic algorithms detected in the binary:	`Uses constants related to CRC32` `Uses constants related to MD5` `Uses constants related to SHA1` `Uses constants related to SHA256` `Uses constants related to SHA512`
Malicious	The PE contains functions mostly used by malware.	`[!] The program may be hiding some of its imports: GetProcAddress LoadLibraryExA LoadLibraryExW` `Functions which can be used for anti-debugging purposes: FindWindowW CreateToolhelp32Snapshot` `Code injection capabilities (PowerLoader): FindWindowW GetWindowLongW` `Can access the registry: RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW` `Possibly launches other programs: CreateProcessAsUserW ShellExecuteA CreateProcessW` `Can create temporary files: CreateFileA CreateFileW GetTempPathW` `Has Internet access capabilities: WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption` `Functions related to the privilege level: DuplicateTokenEx OpenProcessToken` `Enumerates local disk drives: GetDriveTypeW` `Manipulates other processes: OpenProcess Process32FirstW Process32NextW WriteProcessMemory` `Changes object ACLs: SetNamedSecurityInfoW SetSecurityInfo` `Can take screenshots: CreateCompatibleDC FindWindowW GetDC`
Info	The PE is digitally signed.	`Signer: TikTok Pte. Ltd.` `Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1`
Safe	VirusTotal score: 0/71 (Scanned on 2026-09-02 09:18:32)	`All the AVs think this file is safe.`

Hashes

MD5	`d7745172c444fe3df9764cc73fb47044` 🔍
SHA1	`b2b2896a3eb60dbbb53d6352dcddfc28bae49631` 🔍
SHA256	`09c998cc8badece7f47ebf6b52ed84a7c5337320f53f7fc36a0ec2933218a866` 🔍
SHA3	`021f9afee91200276d7e67bf4031931c73288b30f6a16565fb547f3643134d6f` 🔍
SSDeep	`24576:WVrSqn5jUAvQ7GRa9kG6eYj70x2HVroV+IS+IXDVfPbLxRyZnzcXSdTycY:krSqFUAvQaRAUjpJRydcXSdWcY` 🔍
Imports Hash	`3f1ca64f0b59ddb40416521761910631` 🔍

DOS Header

e_magic	`MZ`
e_cblp	`0x78`
e_cp	`0x1`
e_crlc	`0`
e_cparhdr	`0x4`
e_minalloc	`0`
e_maxalloc	`0`
e_ss	`0`
e_sp	`0`
e_csum	`0`
e_ip	`0`
e_cs	`0`
e_ovno	`0`
e_oemid	`0`
e_oeminfo	`0`
e_lfanew	`0x78`

PE Header

Signature	`PE`
Machine	`IMAGE_FILE_MACHINE_I386`
NumberofSections	`7`
TimeDateStamp	2025-Dec-15 03:23:26
PointerToSymbolTable	`0`
NumberOfSymbols	`0`
SizeOfOptionalHeader	`0xe0`
Characteristics	`IMAGE_FILE_32BIT_MACHINE` `IMAGE_FILE_EXECUTABLE_IMAGE` `IMAGE_FILE_LARGE_ADDRESS_AWARE`

Image Optional Header

Magic	`PE32`
LinkerVersion	`14.0`
SizeOfCode	`0x110e00`
SizeOfInitializedData	`0x3d400`
SizeOfUninitializedData	`0`
AddressOfEntryPoint	`0x000E6270 (Section: .text)`
BaseOfCode	`0x1000`
BaseOfData	`0`
ImageBase	`0x400000`
SectionAlignment	`0x1000`
FileAlignment	`0x200`
OperatingSystemVersion	`6.1`
ImageVersion	`0.0`
SubsystemVersion	`6.1`
Win32VersionValue	`0`
SizeOfImage	`0x156000`
SizeOfHeaders	`0x400`
Checksum	`0x160cfb`
Subsystem	`IMAGE_SUBSYSTEM_WINDOWS_GUI`
DllCharacteristics	`IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE` `IMAGE_DLLCHARACTERISTICS_GUARD_CF` `IMAGE_DLLCHARACTERISTICS_NX_COMPAT` `IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE`
SizeofStackReserve	`0x100000`
SizeofStackCommit	`0x1000`
SizeofHeapReserve	`0x100000`
SizeofHeapCommit	`0x1000`
LoaderFlags	`0`
NumberOfRvaAndSizes	`16`

.text

MD5	`7fb12d61a64a2c6e9563a6f90da62af9 🔍`
SHA1	`f60084a58c7cd1ba7edc22bb683967db8d7d6da9 🔍`
SHA256	`bd09e39522a6c8cb1d460608a12c2f6cf784e87845ea26d2fe5a6089e6ad38fe 🔍`
SHA3	`7d9172311c3693ee089003efa60674ef1a86384c3035eee4a9812f0ecdd67063 🔍`
VirtualSize	`0x110d28`
VirtualAddress	`0x1000`
SizeOfRawData	`0x110e00`
PointerToRawData	`0x400`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_CODE` `IMAGE_SCN_MEM_EXECUTE` `IMAGE_SCN_MEM_READ`
Entropy	`6.71842`

.rdata

MD5	`bceb7488db4ad7cfa3f4afb7e0e7a71b 🔍`
SHA1	`25c74776533248d8e8c98819ccd750561473e3ee 🔍`
SHA256	`8c9b11a7b3f25193aebcbc0e751d51349e65b843a9a58a3f2cc9445fe8863a44 🔍`
SHA3	`cee4e769013574fc77caf1172847a98b538e9a06ff9b35cedb4f9a04576c292f 🔍`
VirtualSize	`0x255e4`
VirtualAddress	`0x112000`
SizeOfRawData	`0x25600`
PointerToRawData	`0x111200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`5.63915`

.data

MD5	`8e1dfc09bd719c6d282973ef9263074e 🔍`
SHA1	`27ff8bde94175f29f8979ce24dd77dff97008335 🔍`
SHA256	`f355eb387ff6d2683db3ccb444654a137acc701defa4c16b0873efa269c1dc8f 🔍`
SHA3	`6efffefce5668619cdc73bad8f78b4a55b0c091efca4920e597508f2761e1ece 🔍`
VirtualSize	`0x59ac`
VirtualAddress	`0x138000`
SizeOfRawData	`0x2600`
PointerToRawData	`0x136800`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`3.67753`

.fptable

MD5	`bf619eac0cdf3f68d496ea9344137e8b 🔍`
SHA1	`5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍`
SHA256	`076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍`
SHA3	`622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍`
VirtualSize	`0x80`
VirtualAddress	`0x13e000`
SizeOfRawData	`0x200`
PointerToRawData	`0x138e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0`

.tls

MD5	`59ea3975c134ea7f8d86361cac73f02c 🔍`
SHA1	`47e57e2fea08f0dd007c0206f6789a8cf511b47f 🔍`
SHA256	`5a23d81795b311d0e09cf1ca431ae6cffc5879c59f787422b801ccc984c2eb0d 🔍`
SHA3	`4ef464cd4c46888e860c0f8a613b495b08626d84ebeca1ed5df0523dd450554c 🔍`
VirtualSize	`0xb9`
VirtualAddress	`0x13f000`
SizeOfRawData	`0x200`
PointerToRawData	`0x139000`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ` `IMAGE_SCN_MEM_WRITE`
Entropy	`0.0611629`

.rsrc

MD5	`f76e198be56a3ed3e4e9a22054427b9d 🔍`
SHA1	`62eb8986ae228acf11ed4a191e7e509c97a00440 🔍`
SHA256	`46709051b954a1c197361a66cb8119b64f86627a7f8557fbe1a8724a25da0e73 🔍`
SHA3	`67533605981bf6435ac3cedcd838189340c0425f506b704fb4d9a5a7ba341b61 🔍`
VirtualSize	`0xbaa4`
VirtualAddress	`0x140000`
SizeOfRawData	`0xbc00`
PointerToRawData	`0x139200`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_READ`
Entropy	`7.4773`

.reloc

MD5	`a8d947668234f706300aa826f4994326 🔍`
SHA1	`26163cc0e2aeb28381cf92c9e889b433faeeb708 🔍`
SHA256	`75f6d02829c1c5e31ff588f662ceab0f428c8886a73cb642d65ddfbef09cc2ad 🔍`
SHA3	`883c43899d038f25720f967ecf3e7cb25d207744baf0e1558ef0ed2ca6f29c12 🔍`
VirtualSize	`0x972c`
VirtualAddress	`0x14c000`
SizeOfRawData	`0x9800`
PointerToRawData	`0x144e00`
PointerToRelocations	`0`
PointerToLineNumbers	`0`
NumberOfLineNumbers	`0`
NumberOfRelocations	`0`
Characteristics	`IMAGE_SCN_CNT_INITIALIZED_DATA` `IMAGE_SCN_MEM_DISCARDABLE` `IMAGE_SCN_MEM_READ`
Entropy	`6.68521`

Imports

ADVAPI32.dll	`BuildTrusteeWithSidW` `ConvertStringSidToSidW` `CreateProcessAsUserW` `DuplicateTokenEx` `GetLengthSid` `GetNamedSecurityInfoW` `GetSecurityDescriptorControl` `GetSecurityDescriptorDacl` `GetSecurityDescriptorGroup` `GetSecurityDescriptorOwner` `GetSecurityDescriptorSacl` `GetTokenInformation` `IsValidAcl` `IsValidSecurityDescriptor` `IsValidSid` `OpenProcessToken` `RegCloseKey` `RegCreateKeyExW` `RegOpenKeyExW` `RegQueryValueExW` `RegSetValueExW` `SetEntriesInAclW` `SetNamedSecurityInfoW` `SetSecurityInfo`
GDI32.dll	`CreateCompatibleBitmap` `CreateCompatibleDC` `DeleteDC` `DeleteObject` `SelectObject`
OLEAUT32.dll	`SysAllocString` `SysFreeString` `VariantClear` `VariantInit`
SHELL32.dll	`CommandLineToArgvW` `#680` `SHGetFolderPathW` `SHGetKnownFolderPath` `SetCurrentProcessExplicitAppUserModelID` `ShellExecuteA` `ShellExecuteExW`
USER32.dll	`AllowSetForegroundWindow` `CallNextHookEx` `CreateWindowExW` `DefWindowProcW` `DestroyWindow` `DispatchMessageW` `FindWindowExW` `FindWindowW` `GetActiveWindow` `GetDC` `GetDesktopWindow` `GetDlgItem` `GetMessageW` `GetSystemMetrics` `GetWindow` `GetWindowLongW` `GetWindowRect` `GetWindowTextLengthW` `GetWindowTextW` `KillTimer` `LoadCursorW` `LoadIconW` `LoadStringW` `MessageBoxW` `PostMessageW` `PostQuitMessage` `RegisterClassExW` `ReleaseDC` `ScreenToClient` `SetDlgItemTextW` `SetProcessDPIAware` `SetTimer` `SetWindowLongW` `SetWindowPos` `SetWindowsHookExW` `ShowWindow` `TranslateMessage` `UnhookWindowsHookEx` `UnregisterClassW` `UpdateLayeredWindow`
KERNEL32.dll	`AcquireSRWLockExclusive` `AddVectoredExceptionHandler` `AssignProcessToJobObject` `CloseHandle` `CompareStringW` `CopyFileW` `CreateDirectoryW` `CreateEventW` `CreateFileA` `CreateFileMappingW` `CreateFileW` `CreateMutexW` `CreateProcessW` `CreateThread` `CreateToolhelp32Snapshot` `DecodePointer` `DeleteCriticalSection` `DeleteFileW` `DeleteProcThreadAttributeList` `DeviceIoControl` `DosDateTimeToFileTime` `DuplicateHandle` `EncodePointer` `EnterCriticalSection` `EnumSystemLocalesW` `ExitProcess` `ExitThread` `ExpandEnvironmentStringsW` `FindClose` `FindFirstFileExW` `FindNextFileW` `FindResourceExW` `FindResourceW` `FlsAlloc` `FlsFree` `FlsGetValue` `FlsSetValue` `FlushFileBuffers` `FormatMessageW` `FreeEnvironmentStringsW` `FreeLibrary` `FreeLibraryAndExitThread` `FreeResource` `GetACP` `GetCPInfo` `GetCommandLineA` `GetCommandLineW` `GetConsoleMode` `GetConsoleOutputCP` `GetCurrentDirectoryW` `GetCurrentProcess` `GetCurrentProcessId` `GetCurrentThread` `GetCurrentThreadId` `GetDateFormatW` `GetDriveTypeW` `GetEnvironmentStringsW` `GetEnvironmentVariableW` `GetExitCodeProcess` `GetFileAttributesExW` `GetFileAttributesW` `GetFileInformationByHandle` `GetFileSizeEx` `GetFileType` `GetFullPathNameW` `GetLastError` `GetLocalTime` `GetLocaleInfoW` `GetLongPathNameW` `GetModuleFileNameW` `GetModuleHandleA` `GetModuleHandleExW` `GetModuleHandleW` `GetNativeSystemInfo` `GetOEMCP` `GetProcAddress` `GetProcessHeap` `GetProcessId` `GetProcessTimes` `GetProductInfo` `GetStartupInfoW` `GetStdHandle` `GetStringTypeW` `GetSystemDirectoryW` `GetSystemInfo` `GetSystemTimeAsFileTime` `GetTempPathW` `GetThreadPriority` `GetTickCount64` `GetTickCount` `GetTimeFormatW` `GetTimeZoneInformation` `GetUserDefaultLCID` `GetUserDefaultLocaleName` `GetVersionExW` `GetWindowsDirectoryW` `GlobalMemoryStatusEx` `HeapAlloc` `HeapDestroy` `HeapFree` `HeapReAlloc` `HeapSize` `InitOnceExecuteOnce` `InitializeConditionVariable` `InitializeCriticalSectionAndSpinCount` `InitializeCriticalSectionEx` `InitializeProcThreadAttributeList` `InitializeSListHead` `IsDebuggerPresent` `IsProcessorFeaturePresent` `IsValidCodePage` `IsValidLocale` `IsWow64Process` `K32GetModuleFileNameExW` `LCMapStringW` `LeaveCriticalSection` `LoadLibraryExA` `LoadLibraryExW` `LoadResource` `LocalFree` `LockResource` `MapViewOfFile` `MoveFileW` `MultiByteToWideChar` `OpenProcess` `OutputDebugStringA` `OutputDebugStringW` `Process32FirstW` `Process32NextW` `QueryPerformanceCounter` `QueryPerformanceFrequency` `QueryThreadCycleTime` `RaiseException` `ReadConsoleW` `ReadFile` `ReleaseSRWLockExclusive` `RemoveDirectoryW` `ReplaceFileW` `RtlCaptureContext` `RtlCaptureStackBackTrace` `RtlUnwind` `SetConsoleCtrlHandler` `SetEndOfFile` `SetEnvironmentVariableW` `SetEvent` `SetFileAttributesW` `SetFilePointer` `SetFilePointerEx` `SetFileTime` `SetHandleInformation` `SetLastError` `SetPriorityClass` `SetStdHandle` `SetThreadPriority` `SetUnhandledExceptionFilter` `SizeofResource` `Sleep` `SleepConditionVariableCS` `SleepConditionVariableSRW` `SystemTimeToFileTime` `TerminateProcess` `TlsAlloc` `TlsFree` `TlsGetValue` `TlsSetValue` `TryAcquireSRWLockExclusive` `UnhandledExceptionFilter` `UnmapViewOfFile` `UpdateProcThreadAttribute` `VirtualProtect` `VirtualQuery` `WaitForSingleObject` `WaitForSingleObjectEx` `WakeAllConditionVariable` `WakeConditionVariable` `WideCharToMultiByte` `WriteConsoleW` `WriteFile` `WriteProcessMemory`
ole32.dll	`CLSIDFromString` `CoCreateInstance` `CoInitialize` `CoInitializeEx` `CoRegisterInitializeSpy` `CoRevokeInitializeSpy` `CoSetProxyBlanket` `CoTaskMemFree` `CoUninitialize` `IIDFromString`
gdiplus.dll	`GdipAlloc` `GdipCloneImage` `GdipCreateBitmapFromScan0` `GdipCreateFromHDC` `GdipDeleteGraphics` `GdipDisposeImage` `GdipDrawImageRectI` `GdipFree` `GdipGetImageGraphicsContext` `GdipGetImagePixelFormat` `GdiplusShutdown` `GdiplusStartup`
WINHTTP.dll	`WinHttpAddRequestHeaders` `WinHttpCloseHandle` `WinHttpConnect` `WinHttpOpen` `WinHttpOpenRequest` `WinHttpQueryDataAvailable` `WinHttpReadData` `WinHttpReceiveResponse` `WinHttpSendRequest` `WinHttpSetOption`
NETAPI32.dll	`Netbios`
IPHLPAPI.DLL	`GetAdaptersAddresses`
WINMM.dll	`timeGetTime`
USERENV.dll	`CreateEnvironmentBlock` `DestroyEnvironmentBlock`
SHLWAPI.dll	`PathFileExistsW` `PathMatchSpecW`

Delayed Imports

GetHandleVerifier

Ordinal	`1`
Address	`0x87060`

1

Type	`RT_ICON`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x254`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.53783`
Detected Filetype	PNG graphic file
MD5	`71b796644976e52ffdc9f4df9ca46ebe 🔍`
SHA1	`65a0e70f33a53c1ecb5d82156ceea71c525fb905 🔍`
SHA256	`972a0c3e52d2c2f0ab056b0c91a50ac1c4bf74a966c55df58183d3c7a448b4e4 🔍`
SHA3	`485e9817f97972760f285d5f421b99f38836c0c573b452426563bd6b71c185b7 🔍`

2

Type	`RT_ICON`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x353`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.74714`
Detected Filetype	PNG graphic file
MD5	`bd8da3c45ad06a0087e5fc28622b0575 🔍`
SHA1	`9a25f8300d5e79f9dd4a4e6ca34806dbed1aa912 🔍`
SHA256	`1ef61761b19997a14984e49e943b7b50831cd21f5862e7e0752fa668040fc685 🔍`
SHA3	`4b4ce4f860cfac98e2301baa9d928a1c4358858ecc6a39ae642231aa9d0155f9 🔍`

3

Type	`RT_ICON`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x4b2`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.80883`
Detected Filetype	PNG graphic file
MD5	`91274837e7523bfdff9d8f400d023818 🔍`
SHA1	`5feff11378b52fc18856c78739cab3bfd2a6845f 🔍`
SHA256	`e7c3bb90ee872ab7b32cbf9067db0499d5e3a4337ac7fabf977a9bf9297b6b9c 🔍`
SHA3	`1e4cea3d4f2247356973a198dc82e7a842a3271a0399ea7c327da3ea1addbaf2 🔍`

4

Type	`RT_ICON`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x6ec`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.86355`
Detected Filetype	PNG graphic file
MD5	`e6a599945699117cd3a60f562bfe3f46 🔍`
SHA1	`c77ec0d9999abb05076682cb2b9a7ed75685339e 🔍`
SHA256	`05a77a7ab5a290413257a89a908a613a33018afef1876784d8c6aeb108b485e5 🔍`
SHA3	`8207c44ca3f9065b157cd919a812ecad89a7f3b3c3475eb293934aa5dc44ab19 🔍`

5

Type	`RT_ICON`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x8f5`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.89271`
Detected Filetype	PNG graphic file
MD5	`39bfe5bce2163656d69f98efa412a632 🔍`
SHA1	`cc56d000b0dc58e83015c9b4b4920c7e0776c850 🔍`
SHA256	`e43b2032cb9c9fa416c3bc258322022728e60e0b664029a462c4d5c1a12ca7a0 🔍`
SHA3	`381f9e3247016afb416ea0212a027cf0547d780e16d097adbb8093633bb2a68d 🔍`

6

Type	`RT_ICON`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x127c`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.93789`
Detected Filetype	PNG graphic file
MD5	`88ad40bba164fd84338fc2876bd2f6a1 🔍`
SHA1	`789437e6a8f7db3cff96c9a5cb74101710901a04 🔍`
SHA256	`751935e18065d2e6b8b693732fc73059342deb893d1a46314296e0550b70a020 🔍`
SHA3	`c763cc43d4ae60f3defa38b203ebdb95b1574e7e1d5f1e3b96f1e5d9858b844b 🔍`

7

Type	`RT_ICON`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x2654`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`7.94864`
Detected Filetype	PNG graphic file
MD5	`374c411de27772bb6db07d6d4648a5b2 🔍`
SHA1	`2e463f7dd92cbf6e201ce8a1c467a2ec671045e2 🔍`
SHA256	`4945ea8c5de3673a8e6c6d3e942c907ae44e158407187e4f366161ea0ecff664 🔍`
SHA3	`d9a1a168c26fb2a09d64bd36581f711dedebf03ab24f681ebe55a74aad427e1a 🔍`

13

Type	`RT_STRING`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0xfe`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.20242`
MD5	`1926e455f9421e9085c9b5039e371127 🔍`
SHA1	`76fde8fbcf16a3557b5982b243326c789daa6937 🔍`
SHA256	`5a1db84420c715ac7b21c81316d1ea2152e6775d51115494650399dfb7a1fef6 🔍`
SHA3	`c253333fcc1860a8441248f2ec2f36f6039dc7a3e5c3c7e51d3474ecaa07f637 🔍`

14

Type	`RT_STRING`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0xbc`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.22156`
MD5	`93d924502fe3d6bc4faea133a5e557b6 🔍`
SHA1	`b0b2e50e0bf28032c75cffb9aa1a655dcae7ae1d 🔍`
SHA256	`840cc4962246b7e80f50f73c02cab690164dd8631154898f7f3aa50c2fe6f432 🔍`
SHA3	`012b81a12e4aeeb10a525b846ca9145b3a02a6d2daa1379b71542528f5f962bf 🔍`

19

Type	`RT_STRING`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x4e`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.29594`
MD5	`d6e6908b293eff7f2f025c4407744dcb 🔍`
SHA1	`3269e4643032b4844c5b8d7ba07aec985bedba51 🔍`
SHA256	`6d409b655b4453504f7548a3dadc307ed47add8c04fa9faef6b2cfb3944686d4 🔍`
SHA3	`edd0701c285e6dfb64d663b4528e829a68be1ed502b52b44d6ffb7bb66f7291d 🔍`

26

Type	`RT_STRING`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x24`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`0.614369`
MD5	`1c23c671b858fb5f196bfe248b236a24 🔍`
SHA1	`fb5b0116cdf58e43b17ce119e6a3b645868612c2 🔍`
SHA256	`4aa4343af2857fa02201ca9c485b162eeeed8c6bb4b1936edad6386c9d8c1662 🔍`
SHA3	`dfbdaa3fb6752a2b935b759b48d85eb4a93af010d9e632ea7fe2c6175ae3bf2a 🔍`

32

Type	`RT_STRING`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x228`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.49593`
MD5	`694a1251a2f8b8df59dd8529d1464795 🔍`
SHA1	`6ca6e86a0eb8814d94dd74a7d6a45022762dff05 🔍`
SHA256	`2b45acf98c11d7343f7248edab5109609d1ece5752e3bf897406593b04f1ef9c 🔍`
SHA3	`a1ce7366ebcba097a6768dce795fb4fba580aaa0e65249005159bd4bccca8f2d 🔍`

100

Type	`RT_RCDATA`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x5a28`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`6.93307`
Detected Filetype	Zip Compressed Archive
MD5	`ec0ef6e8aef83e263761b53626569573 🔍`
SHA1	`b9036c4b5fbf06d5f2b2772dc21f00d9d9218101 🔍`
SHA256	`56f999ab5e7fc436df980657987de24522ac2656925d1d38b5bed8c0aaefe081 🔍`
SHA3	`3b2e25aaa99a693eb1ec07c0866ee45394e99c74a8d47639e57925589fe719a3 🔍`

0

Type	`RT_GROUP_ICON`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x68`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`2.64573`
Detected Filetype	Icon file
MD5	`305bf7417f4854cd6f6b4f9e597fdd1f 🔍`
SHA1	`edab77a08bdb98502dbce05298e88faee53f9419 🔍`
SHA256	`d9aaa74b640bac9a1176d501d709d52d12ad26d018beeb988b78fc7e8aa2969e 🔍`
SHA3	`049faa0ceacedb844578d986006f8323004055279c781b13996df54e287d8876 🔍`

1 (#2)

Type	`RT_VERSION`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x2b4`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`3.29406`
MD5	`9aa3faec488f3741e2ab4d12aa332619 🔍`
SHA1	`068845f20b0fdd995c6242cbd3fc48c8dcd537d7 🔍`
SHA256	`81ab6e255e880a1e068723b3793ae177bc9d83963397325de14f71e98f115739 🔍`
SHA3	`1c89abea856cd79df8dbb1c9f1d3697deb2fb4e93791467eb5b96833e30d58fe 🔍`

1 (#3)

Type	`RT_MANIFEST`
Language	English - United States
Codepage	Latin 1 / Western European
Size	`0x256`
TimeDateStamp	1980-Jan-01 00:00:00
Entropy	`5.08239`
MD5	`619740ddfa24b2c3165b7ca17c40dce4 🔍`
SHA1	`beef0405657a958c84bc8a8e9f15a17b2a9d31cb 🔍`
SHA256	`9fd368e01aa0f4377298573ee94af87a9bb8d0534e961d5860da5daac6faa36e 🔍`
SHA3	`91acc29c7322f85b3672ebc6c4913fe13096b876b5411f311ce9a21a14944088 🔍`

String Table contents

8311
TikTok LIVE Studio
com.tiktok.livestudio.desktop
1
https://www.tiktok.com/studio/download
1
tiktoklivestudio
[""]
autorun
1
1
0
1
tiktoklivestudio_Mutex_Install
2
TikTok LIVE Studio Launcher.exe
1.0.0
1
8311
TikTok LIVE Studio
0
0
{"oversea":true,"cls_id":"{5DA6FD3E-637B-4E89-87DB-B4BD8D72D6B1}","iid":"{639AB3C3-3B11-43A3-8C7C-222698CAF2EC}","service_name":"LiveStudioElevationService","display_name":"Tiktok Live Studio ElevationService","reg_key":"SOFTWARE\\ByteDance\\TiktokLiveStudio"}

Version Info

Signature	`0xfeef04bd`
StructVersion	`0`
FileVersion	1.35.2.0
ProductVersion	1.35.2.0
FileFlags	`(EMPTY)`
FileOs	`(EMPTY)`
FileType	`VFT_APP`
Language	English - United States
FileDescription	TikTok LIVE Studio Launcher
ProductName	TikTok LIVE Studio
CompanyName	TikTok Pte. Ltd.
LegalCopyright	Copyright Â© 2026 TikTok Pte. Ltd.
FileVersion (#2)	1.35.2
ProductVersion (#2)	1.35.2.0

Resource LangID	English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics	`0`
TimeDateStamp	2025-Dec-15 03:23:26
Version	`0.0`
SizeofData	`51`
AddressOfRawData	`0x130c78`
PointerToRawData	`0x12fe78`
Referenced File	app_shell_launcher.exe.pdb

TLS Callbacks

StartAddressOfRawData	`0x53f000`
EndAddressOfRawData	`0x53f0b8`
AddressOfIndex	`0x53a480`
AddressOfCallbacks	`0x532280`
SizeOfZeroFill	`0`
Characteristics	`IMAGE_SCN_ALIGN_8BYTES`
Callbacks	`0x0049E4D0` `0x004992D0` `0x004BB700` `0x0043BB40`

Load Configuration

Size	`0xc0`
TimeDateStamp	`1970-Jan-01 00:00:00`
Version	`0.0`
GlobalFlagsClear	`(EMPTY)`
GlobalFlagsSet	`(EMPTY)`
CriticalSectionDefaultTimeout	`0`
DeCommitFreeBlockThreshold	`0`
DeCommitTotalFreeThreshold	`0`
LockPrefixTable	`0`
MaximumAllocationSize	`0`
VirtualMemoryThreshold	`0`
ProcessAffinityMask	`0`
ProcessHeapFlags	`(EMPTY)`
CSDVersion	`0`
Reserved1	`0`
EditList	`0`
SecurityCookie	`0x538040`
SEHandlerTable	`0x530cab`
SEHandlerCount	`156`
GuardCFCheckFunctionPointer	`5448204`
GuardCFDispatchFunctionPointer	`0`
GuardCFFunctionTable	`0`
GuardCFFunctionCount	`0`
GuardFlags	`(EMPTY)`
CodeIntegrity.Flags	`0`
CodeIntegrity.Catalog	`0`
CodeIntegrity.CatalogOffset	`0`
CodeIntegrity.Reserved	`0`
GuardAddressTakenIatEntryTable	`0`
GuardAddressTakenIatEntryCount	`0`
GuardLongJumpTargetTable	`0`
GuardLongJumpTargetCount	`0`

RICH Header

Errors

Leave a comment

No comments yet.