Overview
overview
9Static
static
7WEAO-LIVE-...le.dll
windows10-2004-x64
1WEAO-LIVE-...le.dll
windows11-ltsc_2024-x64
1WEAO-LIVE-...er.exe
windows10-2004-x64
1WEAO-LIVE-...er.exe
windows11-ltsc_2024-x64
1WEAO-LIVE-...ta.dll
windows10-2004-x64
9WEAO-LIVE-...ta.dll
windows11-ltsc_2024-x64
9WEAO-LIVE-...ta.exe
windows10-2004-x64
9WEAO-LIVE-...ta.exe
windows11-ltsc_2024-x64
9WEAO-LIVE-...er.dll
windows10-2004-x64
1WEAO-LIVE-...up.exe
windows10-2004-x64
6WEAO-LIVE-...up.exe
windows11-ltsc_2024-x64
6WEAO-LIVE-...ds.vbs
windows10-2004-x64
5WEAO-LIVE-...ds.vbs
windows11-ltsc_2024-x64
5WEAO-LIVE-...ler.js
windows10-2004-x64
3WEAO-LIVE-...ler.js
windows11-ltsc_2024-x64
3WEAO-LIVE-...ols.js
windows10-2004-x64
3WEAO-LIVE-...ols.js
windows11-ltsc_2024-x64
3WEAO-LIVE-...ct.exe
windows10-2004-x64
1WEAO-LIVE-...ct.exe
windows11-ltsc_2024-x64
8Analysis
- max time kernel
899s - max time network
460s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 10:44
Behavioral task
behavioral1
Sample
WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/Module.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/Module.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/RobloxCrashHandler.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/RobloxCrashHandler.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/RobloxPlayerBeta.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/RobloxPlayerBeta.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/RobloxPlayerBeta.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/RobloxPlayerBeta.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/WebView2Loader.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/WebView2RuntimeInstaller/MicrosoftEdgeWebview2Setup.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral11
Sample
WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/WebView2RuntimeInstaller/MicrosoftEdgeWebview2Setup.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral12
Sample
WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/content/avatar/scripts/humanoidAnimateR15Moods.vbs
Resource
win10v2004-20260513-en
Behavioral task
behavioral13
Sample
WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/content/avatar/scripts/humanoidAnimateR15Moods.vbs
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral14
Sample
WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/content/configs/PerformanceConfigs/rofiler.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral15
Sample
WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/content/configs/PerformanceConfigs/rofiler.js
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral16
Sample
WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/content/configs/PerformanceConfigs/rofiler.tools.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral17
Sample
WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/content/configs/PerformanceConfigs/rofiler.tools.js
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral18
Sample
WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/inject.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral19
Sample
WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/inject.exe
Resource
win11ltsc2024-20260710-en
General
- Target WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/content/avatar/scripts/humanoidAnimateR15Moods.vbs
- Size 10KB
- Sample260807-mtardack7x
- SHA256 ac5225c386dc84bc8883de79115d6c71e28cbf1d5c67a16f0aa19fd586d04c1d
- MD5 a47c9043c0102f7754cd8815dd8708e1
- SHA1 9687f66c964ef4cedb7f1934c9b506b9e51f4f23
- SHA512 81290acc586dda4d5b82c0ec9c2b5efbaceaab4d884eb55d5626aa5b20dd03f20eabedb506b2bd3368b8aeb32a26646b3bff1124bd3f9a8c4cfd3fe27ab0f3e1
- SSDEEP 192:Csc6zX31jmb9gO6P0d71yLXhFEBoucf4BE7r+/XHcigs5d7at1z4sFymIym6bv:xcoXl69gO6PmyLXXEBouu7r+/Xjgs5d0
- TLSH T1EF228EB7EC34C676C63C7272B56A06A573705D264302C75DE4C96A32EC482753BB239C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 4124 WScript.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\WEAO-LIVE-WindowsPlayer-version-145f189a6a974303\content\avatar\scripts\humanoidAnimateR15Moods.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
PID:4124
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2868
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:4408