Overview
overview
7Static
static
3WhitelistB...64.exe
windows10-2004-x64
7WhitelistB...64.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3LICENSES.c...m.html
windows10-2004-x64
3LICENSES.c...m.html
windows11-ltsc_2024-x64
3WhitelistB...or.exe
windows10-2004-x64
7d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows10-2004-x64
1resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-ltsc_2024-x64
3resources/...or.exe
windows10-2004-x64
1resources/...or.exe
windows11-ltsc_2024-x64
1resources/...or.exe
windows10-2004-x64
1resources/...or.exe
windows11-ltsc_2024-x64
1resources/...or.exe
windows10-2004-x64
1resources/...or.exe
windows11-ltsc_2024-x64
1resources/...or.exe
windows10-2004-x64
1resources/...or.exe
windows11-ltsc_2024-x64
1resources/...-vk.js
windows10-2004-x64
3resources/...-vk.js
windows11-ltsc_2024-x64
3resources/...ost.js
windows10-2004-x64
3resources/...ost.js
windows11-ltsc_2024-x64
3resources/...-vk.js
windows10-2004-x64
3resources/...-vk.js
windows11-ltsc_2024-x64
3resources/relay.exe
windows10-2004-x64
1resources/relay.exe
windows11-ltsc_2024-x64
1vk_swiftshader.dll
windows10-2004-x64
1Analysis
- max time kernel
149s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/08/2026, 07:37
Static task
static1
Behavioral task
behavioral1
Sample
WhitelistBypass.Creator-0.3.8-x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
WhitelistBypass.Creator-0.3.8-x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
WhitelistBypass Creator.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
d3dcompiler_47.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
ffmpeg.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
libEGL.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
libGLESv2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
resources/elevate.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
resources/elevate.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral16
Sample
resources/headless-dion-creator.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
resources/headless-dion-creator.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral18
Sample
resources/headless-telemost-creator.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
resources/headless-telemost-creator.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral20
Sample
resources/headless-vk-creator.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
resources/headless-vk-creator.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral22
Sample
resources/headless-wbstream-creator.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
resources/headless-wbstream-creator.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral24
Sample
resources/hooks/dc-creator-vk.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
resources/hooks/dc-creator-vk.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral26
Sample
resources/hooks/video-telemost.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
resources/hooks/video-telemost.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral28
Sample
resources/hooks/video-vk.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
resources/hooks/video-vk.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral30
Sample
resources/relay.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
resources/relay.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral32
Sample
vk_swiftshader.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
General
- Target WhitelistBypass Creator.exe
- Size 180.1MB
- Sample260820-jgblcsscld
- SHA256 6abab82b49d7956b90eb5e2c3521583c287788a7bd8dafad9ca39014fe724491
- MD5 fbf1fe19ea5e13050839ebe277030c95
- SHA1 28e17e3df705387eb6cd26935f84443e9708155a
- SHA512 9091a7cb17b5b1a02b4fd28f32e940040ac59340b83d460cdb382c3554cde4374dddb7f4dafe11b6bf8e8655daa3ae2bdab802410710a66c37a72b4cd88ecb5b
- SSDEEP 1572864:6H0f0gqxb0WBFh/LVO9dyKcRmAswCXj5EtV4ga5h0q2ZOADpAyK5/Y3P8kbVr+qI:Xsok+hK7
- TLSH T114988C03F39A50D9E01DD1B58B9B9633EAB1B8854324A2DF27540B512F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation WhitelistBypass Creator.exe Key value queried \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation WhitelistBypass Creator.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3492 WhitelistBypass Creator.exe 3492 WhitelistBypass Creator.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe Token: SeShutdownPrivilege 4708 WhitelistBypass Creator.exe Token: SeCreatePagefilePrivilege 4708 WhitelistBypass Creator.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4708 wrote to memory of 2280 4708 WhitelistBypass Creator.exe 85 PID 4708 wrote to memory of 2280 4708 WhitelistBypass Creator.exe 85 PID 4708 wrote to memory of 1304 4708 WhitelistBypass Creator.exe 86 PID 4708 wrote to memory of 1016 4708 WhitelistBypass Creator.exe 87 PID 4708 wrote to memory of 3492 4708 WhitelistBypass Creator.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\WhitelistBypass Creator.exe"C:\Users\Admin\AppData\Local\Temp\WhitelistBypass Creator.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\WhitelistBypass Creator.exe"C:\Users\Admin\AppData\Local\Temp\WhitelistBypass Creator.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\whitelist-bypass-creator" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1752,i,3769669122447152305,755163114398090845,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:22⤵PID:2280
-
-
C:\Users\Admin\AppData\Local\Temp\WhitelistBypass Creator.exe"C:\Users\Admin\AppData\Local\Temp\WhitelistBypass Creator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\whitelist-bypass-creator" --standard-schemes=wbstream --secure-schemes=wbstream --fetch-schemes=wbstream --field-trial-handle=2000,i,3769669122447152305,755163114398090845,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:32⤵PID:1304
-
-
C:\Users\Admin\AppData\Local\Temp\WhitelistBypass Creator.exe"C:\Users\Admin\AppData\Local\Temp\WhitelistBypass Creator.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\whitelist-bypass-creator" --standard-schemes=wbstream --secure-schemes=wbstream --fetch-schemes=wbstream --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2688,i,3769669122447152305,755163114398090845,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:12⤵
- Checks computer location settings
PID:1016
-
-
C:\Users\Admin\AppData\Local\Temp\WhitelistBypass Creator.exe"C:\Users\Admin\AppData\Local\Temp\WhitelistBypass Creator.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\whitelist-bypass-creator" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1156,i,3769669122447152305,755163114398090845,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3492
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\whitelist-bypass-creator\Code Cache\js\index-dir\temp-index
- Size 48B
- SHA256 cb20fa7d69224451816ae7ed6fab923fb7fab7453b94d2ed89ebe19473378e18
- MD5 fb24de691d72a2b9f50647f02acf6b69
- SHA1 b2b3a0c78206a4cdd8a578c8cfc1cabf11907c0e
- SHA512 bc6e0ad36caacf26ee84d38a2b1f7a993b44fd74cae774c94e2ff900065c89a2fd0c3e954eb7aa6921c57b63dc96280615bdfbbf23a19d1363e4908a24fe6115
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\whitelist-bypass-creator\DawnWebGPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\whitelist-bypass-creator\GPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\whitelist-bypass-creator\GPUCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\whitelist-bypass-creator\GPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\whitelist-bypass-creator\Partitions\creator\Local Storage\leveldb\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\whitelist-bypass-creator\Partitions\creator\Shared Dictionary\cache\index
- Size 24B
- SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
- MD5 54cb446f628b2ea4a5bce5769910512e
- SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
- SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
- MD5 SHA1 SHA512