r77 | 608e31d0c42ccfc81e3c255cc56d7aa5168b18bd51453879a2be21ed07f9b4c8

Analysis

max time kernel
34s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
11-06-2024 16:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Glass1511.exe
Size

2.1MB
MD5

c1d39a0e69bbb26bfd6800a3495a4ed3
SHA1

ab986bfc719991fb586e0f7bc40e00d468623357
SHA256

608e31d0c42ccfc81e3c255cc56d7aa5168b18bd51453879a2be21ed07f9b4c8
SHA512

01a725cfd97d2536c0ac4a9c3d8d7cfa0928413e9de82acb21ac580422ef4b30b8f41b0a36c3006526699a09b5a5722f53d29f86999d2be8abdb71a353254243
SSDEEP

49152:8a6WKE1Qen2cnCuPTtUdoPiZ9zLbJo0Y7aKnMpe/K7U:X6XEtCiko6Z9zJ27aKMpeAU

Score

10^/10

r77 discovery persistence rootkit

Malware Config

Signatures

r77
r77 is an open-source, userland rootkit.
rootkit r77

r77 rootkit payload 1 IoCs

Detects the payload of the r77 rootkit.

Processes:

resource	yara_rule
C:\AeroGlass\DWMGlass.dll	r77_payload

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112
Executes dropped EXE 2 IoCs

Processes:

Glass1511.tmpaerohost.exe

pid process

848 Glass1511.tmp
3076 aerohost.exe

Loads dropped DLL 19 IoCs

Processes:

Glass1511.tmpdwm.exedwm.exedwm.exeaerohost.exedwm.exedwm.exedwm.exeAUDIODG.EXELogonUI.exe

pid	process
848	Glass1511.tmp
2300	dwm.exe
2036
3568	dwm.exe
3288	dwm.exe
3076	aerohost.exe
3076	aerohost.exe
4496	dwm.exe
4496	dwm.exe
4496	dwm.exe
1980	dwm.exe
1980	dwm.exe
1980	dwm.exe
4876	dwm.exe
4876	dwm.exe
4876	dwm.exe
2192
1736	AUDIODG.EXE
1028	LogonUI.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

aerohost.exedwm.exedwm.exedwm.exe

pid process

3076 aerohost.exe
4496 dwm.exe
1980 dwm.exe
4876 dwm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2812 schtasks.exe
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

4232 taskkill.exe
2756 taskkill.exe

pid	process
3076	aerohost.exe
4496	dwm.exe
1980	dwm.exe
4876	dwm.exe

pid	process
2812	schtasks.exe

pid	process
4232	taskkill.exe
2756	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

dwm.exedwm.exedwm.exedwm.exedwm.exeLogonUI.exedwm.exedwm.exedwm.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "143"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

Glass1511.tmpaerohost.exe

pid	process
848	Glass1511.tmp
848	Glass1511.tmp
3076	aerohost.exe
3076	aerohost.exe
3076	aerohost.exe
3076	aerohost.exe
3076	aerohost.exe
3076	aerohost.exe
3076	aerohost.exe
3076	aerohost.exe
3076	aerohost.exe
3076	aerohost.exe
3076	aerohost.exe
3076	aerohost.exe
3076	aerohost.exe
3076	aerohost.exe
3076	aerohost.exe
3076	aerohost.exe
3076	aerohost.exe
3076	aerohost.exe
3076	aerohost.exe
3076	aerohost.exe
3076	aerohost.exe
3076	aerohost.exe
3076	aerohost.exe
3076	aerohost.exe
3076	aerohost.exe
3076	aerohost.exe

Suspicious behavior: LoadsDriver 64 IoCs

Processes:

smss.exe

pid	process
1396
1360
4204
1608
4652
2940
4644
4432
4848
5112
2320
4232
2880
1316
1724
1116
1244
464
1336
1516
3748
1340
4156
4924
792
4596
3968
2296
3764
480
1916
3944
4424
3920
3140
2400
3124
1200
2708
3152
2936
2148
2424
3528
4132
3940
3900
4368
4416
3848
2448
2780
3412
4572
4784
4656
2300
3280
3776
3308
2572	smss.exe
3228
1880
328

Suspicious use of AdjustPrivilegeToken 36 IoCs

Processes:

taskkill.exetaskkill.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exedwm.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	4232	taskkill.exe
Token: SeDebugPrivilege	2756	taskkill.exe
Token: SeCreateGlobalPrivilege	2884	dwm.exe
Token: SeChangeNotifyPrivilege	2884	dwm.exe
Token: 33	2884	dwm.exe
Token: SeIncBasePriorityPrivilege	2884	dwm.exe
Token: SeCreateGlobalPrivilege	2704	dwm.exe
Token: SeChangeNotifyPrivilege	2704	dwm.exe
Token: 33	2704	dwm.exe
Token: SeIncBasePriorityPrivilege	2704	dwm.exe
Token: SeCreateGlobalPrivilege	2300	dwm.exe
Token: SeChangeNotifyPrivilege	2300	dwm.exe
Token: 33	2300	dwm.exe
Token: SeIncBasePriorityPrivilege	2300	dwm.exe
Token: SeCreateGlobalPrivilege	3568	dwm.exe
Token: SeChangeNotifyPrivilege	3568	dwm.exe
Token: 33	3568	dwm.exe
Token: SeIncBasePriorityPrivilege	3568	dwm.exe
Token: SeCreateGlobalPrivilege	3288	dwm.exe
Token: SeChangeNotifyPrivilege	3288	dwm.exe
Token: 33	3288	dwm.exe
Token: SeIncBasePriorityPrivilege	3288	dwm.exe
Token: SeCreateGlobalPrivilege	4496	dwm.exe
Token: SeChangeNotifyPrivilege	4496	dwm.exe
Token: 33	4496	dwm.exe
Token: SeIncBasePriorityPrivilege	4496	dwm.exe
Token: SeCreateGlobalPrivilege	1980	dwm.exe
Token: SeChangeNotifyPrivilege	1980	dwm.exe
Token: 33	1980	dwm.exe
Token: SeIncBasePriorityPrivilege	1980	dwm.exe
Token: SeCreateGlobalPrivilege	4876	dwm.exe
Token: SeChangeNotifyPrivilege	4876	dwm.exe
Token: 33	4876	dwm.exe
Token: SeIncBasePriorityPrivilege	4876	dwm.exe
Token: 33	1736	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1736	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Glass1511.tmp

pid process

848 Glass1511.tmp
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

1028 LogonUI.exe

pid	process
1028	LogonUI.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

Glass1511.exeGlass1511.tmpcmd.exeaerohost.exe

description	pid	process	target process
PID 1588 wrote to memory of 848	1588	Glass1511.exe	Glass1511.tmp
PID 1588 wrote to memory of 848	1588	Glass1511.exe	Glass1511.tmp
PID 1588 wrote to memory of 848	1588	Glass1511.exe	Glass1511.tmp
PID 848 wrote to memory of 4232	848	Glass1511.tmp	taskkill.exe
PID 848 wrote to memory of 4232	848	Glass1511.tmp	taskkill.exe
PID 848 wrote to memory of 4232	848	Glass1511.tmp	taskkill.exe
PID 848 wrote to memory of 2756	848	Glass1511.tmp	taskkill.exe
PID 848 wrote to memory of 2756	848	Glass1511.tmp	taskkill.exe
PID 848 wrote to memory of 2756	848	Glass1511.tmp	taskkill.exe
PID 848 wrote to memory of 4964	848	Glass1511.tmp	cmd.exe
PID 848 wrote to memory of 4964	848	Glass1511.tmp	cmd.exe
PID 4964 wrote to memory of 2572	4964	cmd.exe	smss.exe
PID 4964 wrote to memory of 2572	4964	cmd.exe	smss.exe
PID 4964 wrote to memory of 2812	4964	cmd.exe	smss.exe
PID 4964 wrote to memory of 2812	4964	cmd.exe	smss.exe
PID 4964 wrote to memory of 3068	4964	cmd.exe	schtasks.exe
PID 4964 wrote to memory of 3068	4964	cmd.exe	schtasks.exe
PID 3076 wrote to memory of 4496	3076	aerohost.exe	smss.exe
PID 3076 wrote to memory of 1980	3076	aerohost.exe	dwm.exe
PID 3076 wrote to memory of 4876	3076	aerohost.exe	smss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Glass1511.exe
"C:\Users\Admin\AppData\Local\Temp\Glass1511.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Users\Admin\AppData\Local\Temp\is-LGQTI.tmp\Glass1511.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-LGQTI.tmp\Glass1511.tmp" /SL5="$40222,1857535,121344,C:\Users\Admin\AppData\Local\Temp\Glass1511.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im aerohost.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4232
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im dwm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2756
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\AeroGlass\install.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Windows\system32\schtasks.exe
      schtasks /Delete /TN "Aero Glass" /F
      4⤵
      PID:2572
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /RU SYSTEM /TN "Aero Glass" /XML task.xml
      4⤵
      Creates scheduled task(s)
      PID:2812
  - - C:\Windows\system32\schtasks.exe
      schtasks /Run /TN "Aero Glass"
      4⤵
      PID:3068

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2884

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2704

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2300

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3568

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3288

C:\AeroGlass\aerohost.exe
C:\AeroGlass\aerohost.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3076

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4496

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1980

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004B8 0x00000000000004CC
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1736

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3a23055 /state1:0x41c64e6d
1⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1028

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000110 0000008c
1⤵
- Suspicious behavior: LoadsDriver
PID:2572

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000f8 0000008c
1⤵
PID:2812

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000e0 0000008c
1⤵
PID:4496

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 000000e8 0000008c
1⤵
PID:4876

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\AeroGlass\DWMGlass.dll

Filesize
908KB

MD5
bf542013755997c834e98e0e4add4f38

SHA1
c7c69e133aa881c877a2513e5e8d645dcfc29558

SHA256
ad3feee461f09e07399ae31fbeb56566ec5399e55c2ef4266b3b25acdf06dc5a

SHA512
ea291c0f8d037b13e6d21f52044588f07f42682cad157e69c6420be16df0b755bedf09843277a29a081eeb8b0d425f1ddc2ee500f6e715c1a9e15c724213b499

Download Submit
C:\AeroGlass\ModernFrame.dll

Filesize
223KB

MD5
ad90c2f15b89f91db5f7a49808878fe3

SHA1
2eaaff429b2ef56066fb88cbd8b7c82eb55ade1e

SHA256
a558c0bc68c4968dafddb79cb5b0830d7c62ff3beb19a4c1e89454642e4a4779

SHA512
719b82a9de25f1e5e2c11be1993dd8d2d593a784c4bc18457a3376fdd40d779cf826e481fa7b8d96acb61c43b5d3acaa9d49f298884fc38e3efd65b6e05e496e

Download Submit
C:\AeroGlass\aerohost.exe

Filesize
114KB

MD5
8ec9feb3c776959daa8f477366dee78d

SHA1
276ece41801126212956cb4c5bf0f73e62f3a5f9

SHA256
e15997a5ff6bbef4b951daa142485b502bb84af01a4c1d15749f72bb8f35fa29

SHA512
14c7ae5e407b2e5fdaef09ac9ce4693263221bd2bd252888c1a10428faf18d6fae16661316b6d3e6705a4c1db2ffad9f5f2434d98e8a6ec4374e3a0912475bf4

Download Submit
C:\AeroGlass\dbghelp.dll

Filesize
1.4MB

MD5
6d35358c66d8720db912e52b2ea79090

SHA1
dcb86441e5cfd7fe4257659ccf852755677f0be4

SHA256
d645f9d265d980ca77393ef1fd61df046d152620b47b629df47169777f3e1b6d

SHA512
d0eb8254d5d315d9cda7250ca2476bcbfba4bfc57986fbbe848b9d0b9c084db44b61fa53286cf8913f13102ad1eb9dcbf021902a772f5e18315b027dca931940

Download Submit
C:\AeroGlass\debug.log

Filesize
1KB

MD5
26edea94bcb73e9819eaa62a5b663e6c

SHA1
1803dfec5fc16a61f5d55f85b2e22e3b36b6e661

SHA256
320b765a4f683f54acae4acb4205aee3a988b22d01f714b10e3c5eb987b77cdd

SHA512
ace95032d4bf85ec44f158c4b1375dd05fd70cd4aa76cf9bf4b72cda34c7a338a9f19bd1c64bae11f0ba6215d7b99d68ec022a459f1703c854606db14ae95532

Download Submit
C:\AeroGlass\debug.log

Filesize
2KB

MD5
f42f8e4369e95c3a1057d81295b8b14a

SHA1
276ccfb0d7465e6bfa97609c9cdcef6dabe32d25

SHA256
20262c1568e551a4edb1c75063e8ffd73e273360b28b8878ab7dda1ff3092b53

SHA512
30067dac70497ef10d9535825aade25cc0d9502b1cc63f4579a843e8c4fa27dbbe42213725944757f20690563374ca98e997211027a95ce620ca97a1d9b0faa7

Download Submit
C:\AeroGlass\debug.log

Filesize
2KB

MD5
dbde09f8a5fd71db9265ec248b45d980

SHA1
eaa624bad1cbcba975b619b7ab5cdfe7fb412bca

SHA256
db519979a97353880bc557c79f840a0c5234e662ee18a290501de93020e56da5

SHA512
87ed375bcced2f8268810b2a51c93935737189f4c2887801153d68a50715e70437e2b34e10ce3dfd3c2f48a90dcf36ef5d7eeaf5742c1877a8ba2ad1216117ed

Download Submit
C:\AeroGlass\debug.log

Filesize
277B

MD5
d08368c51859f22e062aa3d256f24bc7

SHA1
7f55c8d445addcf53046e3bfe46db3a0d448db57

SHA256
6403e90ece09c5e96f00aed22cd66d51a6e3e705f71d6dea110fdfd7e30698c0

SHA512
caa40e81895b72905ab8c499b1d493252c0df1eebcaade48d5fa3db3e9211246c0686c5bea8db0a9693794a16860b1125015e2ee73f7736fbf04e71bb79c2033

Download Submit
C:\AeroGlass\donation.key

Filesize
96B

MD5
da683b17743006f3150e6c0723960e8e

SHA1
bf0be0b79acefe65c6825b1184a1cdf7ab5f03db

SHA256
a9f0061e4a0086e45b2b872316d3d6989b43deb72f60b855ea8158031da94849

SHA512
86aaa69e6352094613a236682b45cddb8c894e9776d3cdd90e62112181b1d588156a1fdc8926edafd965d3a68ecef7dedcdd024ac0c08c3db22b79e751851e2b

Download Submit
C:\AeroGlass\install.bat

Filesize
2KB

MD5
5bcc2ff8588dc19777cd8db6bb792eda

SHA1
1c40f016ada5d350eaf628d748ab05026da63790

SHA256
39bf1e5890f4e8aa6334fe785bcec0a50e84601e9b93574949d4c00fe6289de1

SHA512
bee72d4ac60c705a489fbc0d45e58b5ff187e323acbe96528c618de088a416bc3ed274e43e70d2efae008205b5894ca33c7b91963f50613d300207f538acd6bb

Download Submit
C:\AeroGlass\task.xml

Filesize
1KB

MD5
febd881b90375c4af4bbd975246ef13a

SHA1
8d3837b2a80c355c345a1be7601797c66eff8252

SHA256
7d466ab7ac317ef33a7e4fd17a573983a7df34292d03d1ad9be2f7bf2294b646

SHA512
135f97926f2dae594b219264c6a2720117c159e58b77f6f22a558483a37339dd50c8a5f82ff468ee72114d462726c62db9fee97df63344dbb8e7986dcc86e9bb

Download Submit
C:\AeroGlass\task.xml

Filesize
1KB

MD5
cb532affe9366308197fc443ba9510e6

SHA1
4a0b067590ff04e7c6142fe263aee6853f183085

SHA256
1f26a0bef152969c419114a42e58e6b4d81f3820d83177a3efa49cd3b4668221

SHA512
32784bd7f65812d2b78c2a5b92cc9d6c3b16a460c3969f58388fe12cb614d76ef078266a391bae987e266fcdb494e151f80e5d61d32b555be37e0fafced23e66

Download Submit
C:\AeroGlass\task.xml

Filesize
1KB

MD5
65575ae7bd68a804433779b985ee1362

SHA1
5607ae6357617a761fc8be8e9c32545acc544f30

SHA256
69f8099e326e624cc09f8190bc9e2bfabe0fe1f5c84a2fd2dce25c9e7be8ff52

SHA512
bc14bf525e56e526284d50c1c068ada6045b885990b7c177b873ee28bbdef605885202c1e017ce6a5bd2975df3185a905129b4e0002be6b13b96bee4f168b55b

Download Submit
C:\AeroGlass\task.xml

Filesize
1KB

MD5
779d600fbfc877745e410f319d079445

SHA1
cbe858a7b0df422775837f43b4906416970d940b

SHA256
302c67921cf5608785d502c87e1295cb71a05796088df8aa66c2aecd897fad9f

SHA512
3fbce9c368fdd40112b556174a21fd2f0a1b3180f364aba091a8a86f3de57d83e4b465f378346d11f7a092111e1582f593071da78d6fc72710f43491afbb6b3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ADRVK.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LGQTI.tmp\Glass1511.tmp

Filesize
1.1MB

MD5
90fc739c83cd19766acb562c66a7d0e2

SHA1
451f385a53d5fed15e7649e7891e05f231ef549a

SHA256
821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431

SHA512
4cb11ad48b7585ef1b70fac9e3c25610b2f64a16358cd51e32adcb0b17a6ab1c934aeb10adaa8e9ddf69b2e2f1d18fe2e87b49b39f89b05ea13aa3205e41296c

Download Submit
memory/848-12-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/848-6-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/848-136-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/1588-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1588-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1588-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/3076-90-0x00007FF6EA080000-0x00007FF6EA0A2000-memory.dmp

Filesize
136KB

Download