cb1a3a4ac5d797d5455c4bb9bf635c70b8f346a6b3cf5d9d35dfbc881d712099

Analysis

max time kernel
62s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rewindow-Setup.exe
Size 38.6MB
Sample261003-ph8v5syblb
SHA256 cb1a3a4ac5d797d5455c4bb9bf635c70b8f346a6b3cf5d9d35dfbc881d712099
MD5 3cc058fa51d4a6cae0d4c5c506378789
SHA1 0b10e74c0061905e526ab9b2ed6c230632ea243f
SHA512 0540e71028f7ba5fc327fd769cdf4316dc3e5137ea51aac9af6e68aaa937e60ebd89cc047b9a10a946d91730eccd56e512d65fba8e98ce515d70cc9bd4abd6b5
SSDEEP 786432:V4/8e1/GPIj+oKZRCWU1r4PLasPU/g/l2UQ18/90E5ksYQHfM25ZzQ:V40cz+oKPI1r4N8aQmh55hK
TLSH
T11D97332FA1BB7129D0293AFF6532911C59FB6E511C13CCF25FE6A408DB15CF01A2EA46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer persistence

Malware Config

Signatures

Executes dropped EXE 18 IoCs

pid	Process
4768	Rewindow-Setup.tmp
5076	Rewindow.exe
3012	Rewindow.exe
4428	Rewindow.exe
5712	Rewindow.exe
3440	Rewindow.exe
4068	Rewindow.exe
2092	Rewindow.exe
2780	Rewindow.exe
5532	Rewindow.exe
4736	Rewindow.exe
4236	Rewindow.exe
472	Rewindow.exe
2772	Rewindow.exe
5900	Rewindow.exe
5020	Rewindow.exe
3280	Rewindow.exe
5088	Rewindow.exe

Loads dropped DLL 64 IoCs

pid	Process
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe
3012	Rewindow.exe
3012	Rewindow.exe
3012	Rewindow.exe
3012	Rewindow.exe
3012	Rewindow.exe
3012	Rewindow.exe
3012	Rewindow.exe
3012	Rewindow.exe
3012	Rewindow.exe
3012	Rewindow.exe
3012	Rewindow.exe
3012	Rewindow.exe
3012	Rewindow.exe
3012	Rewindow.exe
3012	Rewindow.exe
3012	Rewindow.exe
3012	Rewindow.exe
3012	Rewindow.exe
3012	Rewindow.exe
3012	Rewindow.exe
3012	Rewindow.exe
3012	Rewindow.exe
3012	Rewindow.exe
3012	Rewindow.exe
4428	Rewindow.exe
4428	Rewindow.exe
4428	Rewindow.exe
4428	Rewindow.exe
4428	Rewindow.exe
4428	Rewindow.exe
4428	Rewindow.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rewindow = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\ReWindow\\Rewindow.exe\" --startup"	Rewindow-Setup.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rewindow-Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rewindow-Setup.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5108-0-0x0000000000600000-0x00000000006F7000-memory.dmp	innosetup
behavioral2/memory/5108-8-0x0000000000600000-0x00000000006F7000-memory.dmp	innosetup
behavioral2/memory/5108-921-0x0000000000600000-0x00000000006F7000-memory.dmp	innosetup

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1284	taskkill.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	1284	taskkill.exe
Token: SeDebugPrivilege	5076	Rewindow.exe
Token: SeDebugPrivilege	3012	Rewindow.exe
Token: SeDebugPrivilege	4428	Rewindow.exe
Token: SeDebugPrivilege	5712	Rewindow.exe
Token: SeDebugPrivilege	3440	Rewindow.exe
Token: SeDebugPrivilege	4068	Rewindow.exe
Token: SeDebugPrivilege	2092	Rewindow.exe
Token: SeDebugPrivilege	2780	Rewindow.exe
Token: SeDebugPrivilege	5532	Rewindow.exe
Token: SeDebugPrivilege	4736	Rewindow.exe
Token: SeDebugPrivilege	4236	Rewindow.exe
Token: SeDebugPrivilege	472	Rewindow.exe
Token: SeDebugPrivilege	2772	Rewindow.exe
Token: SeDebugPrivilege	5900	Rewindow.exe
Token: SeDebugPrivilege	5020	Rewindow.exe
Token: SeDebugPrivilege	3280	Rewindow.exe
Token: SeDebugPrivilege	5088	Rewindow.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4768	Rewindow-Setup.tmp
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5076	Rewindow.exe
5076	Rewindow.exe
5076	Rewindow.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
1448	explorer.exe
3180	explorer.exe
3188	explorer.exe
5104	explorer.exe
5672	explorer.exe
2708	explorer.exe
4864	explorer.exe
1112	explorer.exe
4152	explorer.exe
1496	explorer.exe
1904	explorer.exe
3344	explorer.exe
2360	explorer.exe
2108	explorer.exe
4992	explorer.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 4768	5108	Rewindow-Setup.exe	89
PID 4768 wrote to memory of 1284	4768	Rewindow-Setup.tmp	91
PID 4768 wrote to memory of 3012	4768	Rewindow-Setup.tmp	96
PID 3012 wrote to memory of 4520	3012	Rewindow.exe	97
PID 1448 wrote to memory of 4428	1448	explorer.exe	99
PID 4428 wrote to memory of 4392	4428	Rewindow.exe	100
PID 3180 wrote to memory of 5712	3180	explorer.exe	102
PID 5712 wrote to memory of 4616	5712	Rewindow.exe	103
PID 3188 wrote to memory of 3440	3188	explorer.exe	105
PID 3440 wrote to memory of 256	3440	Rewindow.exe	106
PID 5104 wrote to memory of 4068	5104	explorer.exe	108
PID 4068 wrote to memory of 5696	4068	Rewindow.exe	109
PID 5672 wrote to memory of 2092	5672	explorer.exe	111
PID 2092 wrote to memory of 4504	2092	Rewindow.exe	112
PID 2708 wrote to memory of 2780	2708	explorer.exe	114
PID 2780 wrote to memory of 1132	2780	Rewindow.exe	115
PID 4864 wrote to memory of 5532	4864	explorer.exe	117
PID 5532 wrote to memory of 4536	5532	Rewindow.exe	118
PID 1112 wrote to memory of 4736	1112	explorer.exe	120
PID 4736 wrote to memory of 4060	4736	Rewindow.exe	121
PID 4152 wrote to memory of 4236	4152	explorer.exe	123
PID 4236 wrote to memory of 1072	4236	Rewindow.exe	124
PID 1496 wrote to memory of 472	1496	explorer.exe	126
PID 472 wrote to memory of 5256	472	Rewindow.exe	127
PID 1904 wrote to memory of 2772	1904	explorer.exe	129
PID 2772 wrote to memory of 5724	2772	Rewindow.exe	130
PID 3344 wrote to memory of 5900	3344	explorer.exe	132
PID 5900 wrote to memory of 2100	5900	Rewindow.exe	133
PID 2360 wrote to memory of 5020	2360	explorer.exe	135
PID 5020 wrote to memory of 1416	5020	Rewindow.exe	167
PID 2108 wrote to memory of 3280	2108	explorer.exe	138
PID 3280 wrote to memory of 1780	3280	Rewindow.exe	211
PID 4992 wrote to memory of 5088	4992	explorer.exe	141
PID 5088 wrote to memory of 1284	5088	Rewindow.exe	172

C:\Users\Admin\AppData\Local\Temp\Rewindow-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Rewindow-Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Users\Admin\AppData\Local\Temp\is-K3LY68JY3F.tmp\Rewindow-Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-K3LY68JY3F.tmp\Rewindow-Setup.tmp" /SL5="$400A8,39210733,953856,C:\Users\Admin\AppData\Local\Temp\Rewindow-Setup.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM Rewindow.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1284
- - C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
    "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Windows\explorer.exe
      "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
      4⤵
      PID:4520

C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
"C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe" --startup
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5076

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:4392

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5712
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:4616

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:256

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:5696

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5672
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:4504

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:1132

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5532
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:4536

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:4060

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:1072

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:472
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:5256

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:5724

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5900
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:2100

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:1416

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:1780

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:1284

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4244
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:5084
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:1556

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1912
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:3944
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:4632

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4140
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:2468
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:4660

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4996
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:4320
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:1288

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4800
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:1004
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:3372

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2296
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:5252
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:3512

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5956
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:2148
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:2216

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3888
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:5116
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:3456

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1416
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:5588
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:3300

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6052
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:4700
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:1284

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5444
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:4528
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6088

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4128
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:1768
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:5124

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1128
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:4576
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:2024

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3372
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:2580
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:4596

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5624
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:4044
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:4524

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2724
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:5980
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:3460

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2796
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:5892
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:3720

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4760
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:4448
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:5964

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5068
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:3512
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:2216

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4656
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:5612
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:3300

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3340
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:3864
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:2328

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4336
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:4164
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:3408

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1260
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:1648
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:1780

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3568
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:1624
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:712

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3456
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:4644
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:3404

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3768
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:5964
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:3844

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3300
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:1244
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:5996

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5060
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6152
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6192

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6232
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6280
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6320

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6360
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6408
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6448

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6488
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6536
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6576

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6616
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6664
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6704

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6744
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6792
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6832

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6872
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6920
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6960

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7000
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:7048
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:7088

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7128
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:5816
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6216

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6276
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6296
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6324

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6420
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6588
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:4184

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6700
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6788
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6824

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6800
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6984
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:7044

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7080
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:7160
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6168

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6192
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6300
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6460

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6352
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6564
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6612

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6816
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:2776
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6928

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6964
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6188
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:7124

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5996
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6440
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6520

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6548
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:3312
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6852

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6940
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:7096
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:4276

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6672
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6576
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6844

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7092
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:1932
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6580

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5288
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:1972
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:4268

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6184
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:2448
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:7124

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4368
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6844
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:7196

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7236
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:7284
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:7324

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7364
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:7412
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:7452

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7500
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:7552
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:7592

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7632
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:7680
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:7720

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7760
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:7812
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:7852

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7892
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:7940
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:7980

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8020
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:8068
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:8108

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8148
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:1120
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:7172

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7232
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:7304
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:7344

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7428
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:7544
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:7588

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7560
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:7728
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:7756

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7860
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:2352
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:7972

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7992
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:8000
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:8080

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8128
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:2936
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6948

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7360
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:2860
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:7584

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7488
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:7588
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:7684

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7740
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:7880
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:4352

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8004
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:4400
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:3428

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7192
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:7456
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:5100

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7732
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:2328
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:3808

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4776
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:8084
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:8080

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8136
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6948
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:7484

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4220
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:5952
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:2292

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5652
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:8096
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:3600

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6424
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:7344
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:3136

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7484
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:7736
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:1444

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5864
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:4352
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:3600

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3336
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:3136
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:5896

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7964
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:3268
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:1440

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1196
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6388
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:5716

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1564
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:5732
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:2384

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4404
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:4704
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:3880

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4828
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:7960
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:3420

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5680
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:5464
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:4648

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1000
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:2232
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:3260

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6772
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:5792
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6456

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6996
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:4216
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6308

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4824
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:4104
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:1424

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1708
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:5148
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6456

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1640
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:4132
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:4680

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3616
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:2608
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:1180

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4296
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:5500
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:4988

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:572
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:4208
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:2424

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4172
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:1228
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:4408

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1180
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:980
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:1888

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4988
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:3400
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:3852

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:424
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:456
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:5692

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4600
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:5940
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:1592

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3696
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:1816
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:3524

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4456
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:2484
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:2808

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:416
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:5692
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:3444

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2584
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:432
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:2792

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4072
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:3052
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:4308

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1992
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:5992
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:1336

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3040
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:4204
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:4892

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5836
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6080
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:1200

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7820
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:3612
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:3836

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3460
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:4712
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:5364

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3448
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:4772
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:5924

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3852
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:3176
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:2820

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4540
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:2440
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:3172

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2000
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:1668
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:5644

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2828
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:1592
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6248

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5920
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:4688
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:7704

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4720
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:4868
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6624

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3688
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:264
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6764

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3464
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6256
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6028

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6248
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:1884
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:7140

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7704
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:7492
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:4504

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5552
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6212
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6760

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6896
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6568
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:4660

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7020
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6632
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:3380

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4508
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6748
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6884

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6764
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6912
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6368

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6172
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:7024
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:6496

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6596
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:6640
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:4504

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6840
- C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
  "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
  2⤵
  PID:3644
- - C:\Windows\explorer.exe
    "explorer.exe" "C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe"
    3⤵
    PID:7172

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Microsoft.Win32.Primitives.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\Microsoft.Win32.Primitives.dll
Size 15KB
SHA256 6c21472b0ae2f9b484a97614fad5485a22f18f9f19ee1adb9ceb3ed8ddb072d7
MD5 1133e0c426161c2b805743358b6c59c5
SHA1 6080b7c514416722d893866568db633df1025d3e
SHA512 b65766bc590e76e8f1b08df94d4b7a249a9ad0da414a74b4d71f0d4487d7bc15d5729858d57004e5647deceb7a2082e5b26b31e156fd423a4085fe8a2cb83263
SSDEEP 384:ZWv2dF/GuVDKWh0pWImZlNUoxR9zxVaOo+:EvKGuV+o79zTU+
TLSH
T194624BD2D72C8107EDE7AE70AAA5DE833C3867C74D509A5A1595F4091CA33C1EB3163E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Win32.SystemEvents.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\Microsoft.Win32.SystemEvents.dll
Size 113KB
SHA256 78eca75a0ddacdf6015f5414f9fee56a970f9f21b94b1c6a0e5dbb974ae8b48b
MD5 242c40c10fc351e3e32fedce8d6d9b0c
SHA1 89c55591a03d6a1e8921052811cfe254569b0f26
SHA512 e115df1cb7f1fd6f5d019777012bb07c5ceaea5c6e969df329a435d4234f6d0265f17a5d4d0e7b89a01cd53234051c438656ba4772e0a9919148debf8964958a
SSDEEP 1536:ISCJY+bLqTY4W7BeNLejX/tDlZsWhdcf1TbUcBIM6ey24zCJ:IXp2WledQXZQWhdc9SM6ey242J
TLSH
T168B31C1173E80614F5FB6E36A9B25911893BF892A731EBAF0085449D0F72FC1EA75363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Windows.SDK.NET.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\Microsoft.Windows.SDK.NET.dll
Size 23.7MB
SHA256 0ec371d93798852e36461c8adddbeadce0f963a04752f0b64e54fe19c1c834a7
MD5 a00b91c2e00b89e387705af95b72bd6e
SHA1 eb57d8d9b8c1e4434044c28b608113e49d53ccf9
SHA512 93b88a2ef85206765144c7c082662da7a3ad57fb08af9f8bbc0355721c12cf52f6a6920adad08778c4d2054652636d24d095b998c282f9b1e92b9234808f3165
SSDEEP 98304:POCu/R1ZTAk4bl5EUBMXyLImPbjAd+deA/tlCjvT7HiYyhILyV3K3CrLtHOpdGxD:POCu51ZTAFLzbjblIjvT7CThIPPBrYj
TLSH
T15D477E2297A44E3DC98F5773E4B603264335C60AAF4393EA581C979D2F833460B59AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rewindow.deps.json

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.deps.json
Size 32KB
SHA256 70c8b286b2ddbbe751916121586eb295f5951712b13c3a0907880f5f2ea3cbba
MD5 d4be8bbe56961d01dd34aabf262a9df2
SHA1 e8f7af70ad94bad249defe43ca2bede50398eae6
SHA512 556ff35e9ebf23647dc6e0d15a4541da22059545cea79b13be9e4052f5fe6195e23a6ce6eb849348627ace278da49bee1783fe835530d954560a9aac8b5f8f8f
SSDEEP 384:XUYFgfpazhsVvw+MfV6UfwH4f4mNo421nxPqM5N7UPT+7:XhQwMDy8
TLSH
T182E28227CA604EA6083593E678B996F0E365032F3045084EB4BC781DEF77B7A0759B79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rewindow.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.dll
Size 452KB
SHA256 ba810a9c0ef11779cfc16a6073e00f2bcdaf795549cb3abf59a945f8fc0e3755
MD5 df4ab12b6a6cf806fe53f9d96b7609dd
SHA1 9e02ac943cac92b90e967b0b0467786fb774c034
SHA512 8b9651c5e0d6dd3888e7b87d504c2e50ecfc493f3bf61865dfc4942c7f4ff0b4da437e31ff904994d2d14823675cd38377cbd7acf4a8d828fad2cb1fd821f0a6
SSDEEP 6144:cHMM5/ihfCiDJRL4IWLdr2yoP0qoH23FdYY9y414:/1zDJaIWLQyoPAaj
TLSH
T1B7A4701C32B43611D1AA7BFFA864921D5AF7BC469C6BD6F92F87B0DA1931FC09400762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rewindow.exe

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.exe
Size 272KB
SHA256 1d3fee25dae0e89c4eca02b92c6370d7de20683b2c3df8652fa04333f538edf3
MD5 ac171dfb5fa1c0c8fad9e4d5a7382f45
SHA1 906a4e558a5d2bf37d2a4ddad99b5f3d98508f86
SHA512 1a7ee9d96cfab1bb7df1e78f8912810f2f3c346c213096bc23806fec9105d19f439dcb216b582a5770620548858162c90d304c6bd9b5b8481dc09e1e22bfa813
SSDEEP 3072:QVDxk88wN1nLVu7dL1Z9Qnlf9rE38wGTbzaAT5gR4u+:8HRu7F1nQnB8KKrR4
TLSH
T13D44911EA27831AAD0A2B1FF8951854DEBF37C554F63E6FB2F9379660A31EC05924301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rewindow.runtimeconfig.json

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\Rewindow.runtimeconfig.json
Size 606B
SHA256 181522deb785cbfa02519c68df5831d2838e972bebd2311e685d35a26832ab97
MD5 72c976cb4dda5d75147716b29de7b4b2
SHA1 4fb7cb9998c8dd8481416975deee11112af30886
SHA512 8c2d02639ffef7d43939c7aea20d5e076c672faba1ea5032a5e45ff27b170f75db2ce51cfde17c1aac0413b167d30beb469fce5b414431caf511a26c9e4f2a3c
TLSH
T16DF04639C9153C7718B5327AD936C182EA30572B10042C42B5FC081C6FBB6A62212F95
MD5 SHA1 SHA512 TLSH

Submit Download

System.Collections.Concurrent.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\System.Collections.Concurrent.dll
Size 225KB
SHA256 082f4bc0da1141eb65111b6da633d75624adfb7bb067d7ee90c5622c8b30885b
MD5 8dd5db3429385f9030d89215cd14d361
SHA1 f9caa43aa3b381fe76b193db568d8a5b0af5f2ce
SHA512 007599253418fb63db724798c9c734bff5cd51052519e0d596a8b78becaff9af5ddcf03a750099f27aa93dd932ee05874afd33ddfb17bdebe01d4e1ed13e97ed
SSDEEP 3072:G4Lq9jhKD6tVDNKTs4Vzof/HQLvB76qSa2ymYQraEN7Azg902iN+sPxNnUnZGAzl:1q9jY6LUTs4eQV76qOc28NnUnZGAbV
TLSH
T1DC344A16638C0B93F9AE463D95A3C5039733A55B1312D3EF13E8A5841EA7BC17EBB112
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.Specialized.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\System.Collections.Specialized.dll
Size 101KB
SHA256 e31af1f866e880844e027be59f545b9a6b34108e0b0680ebe3fbc19a53070819
MD5 be26cbfb9706c8356a565ebc1c883b18
SHA1 56ae2c4ae35006a3b78757d642738f252ed87333
SHA512 c5560a1acc6c5c0cb33294bfeaaad3df60ad8c248f3524471d788895db1daac1fb92710780069d24a8eff2dcfcc6b2939adb9cdce1342f387e0451b956fcecf4
SSDEEP 1536:7LY1yipoBwR72GUFFDE3A0giv9EywNwjNYlDurBXzxGz87Q:7L8poOR9U3MM4jNYlDurBXFGY7Q
TLSH
T1D4A34A2873CC8B20CB7A92FC91A38942E774F1D31752E6CF594894496E977C0867B26F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\System.Collections.dll
Size 289KB
SHA256 df6f2037eabee28100184e92f7536427ba2f086c1110629804d466b124bc4d54
MD5 e4d11024a5af2fa5f6cad5b53c6d7dc9
SHA1 63b20f606535fb168f6d16a394295d513c778638
SHA512 7aef97f0a656d424aa7ff4f87b5177952f71d982eaadfa05a3089533ad4ef5661f4a88e03303bbfffad54c4c1f53d2939efa50a641c4e2cc6605fb482eecf8e0
SSDEEP 3072:43UwvuGeTbinDHdY81uFqzK4s2QMsf0r3p9dJ2SAmnp8SFK0gwsDim1OLI6mFkeU:m0G4ODj1Fe4eL8ph2wC0acL+1U
TLSH
T172544A1873888725FDBF41BAE593C122E1B990938350A2CB47BDF6509FDFBD12AB6015
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.EventBasedAsync.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\System.ComponentModel.EventBasedAsync.dll
Size 45KB
SHA256 cc84fe814ef5e58271d83193e328f8ec220efd4696d90af9a7c4690c10451495
MD5 1b610bd3fb571350aae3bac5e468c298
SHA1 38624afba6782ee92253fe8ef836af045448cb1d
SHA512 2fcde72cb7fdb9f54f58ac954930bc6484597b9b278cf383581658f24cebd3e1290a43b5ca45348b647e71a4b17d9da6e4cdfe61c03b831cca88693841edf498
SSDEEP 384:r6WnwWIJB/eNRYdWBFEWmsZiZHlRq1bVMyQmXDX6O88+aEZ4j5wVtNFmK8Efc1Ek:n2vjF41F8IVcF8EEwArjZ9z3D
TLSH
T1B7235AB1439C4232FA671A7DD2A28E229A78FB8A974297CF1454D30D1EE37D1837216D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.Primitives.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\System.ComponentModel.Primitives.dll
Size 77KB
SHA256 1e2451184c287409ea25acde3c90f25950bf34d16458a6e52a94ca4292434f62
MD5 4af300956d79f83956749a2a5c330bf1
SHA1 7e83fdd37997723687e3303e1a6714374544556d
SHA512 a95eb050258c608d944874c69b7f302968c26696bbc004c910d8807d80f4dd9979bccbe790be574593adb7e88eeaa164ad2f54da2d85dfcad4802d80bec64271
SSDEEP 1536:EyRLdlpyxFkIkSyypSM2VLIGOYu2nC248tL1zR:EelUxFJVy+hgLVO52C24m11
TLSH
T178734A1813E80319EBAD567C96B399109570F5871323D9CF8690D91E6F8B7C2F272A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Console.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\System.Console.dll
Size 165KB
SHA256 3b85daf02a3d9ed99b84bb1c639fe8b1ced46d8d157fa56f525f6b8c5be43b3e
MD5 1efb4df998fcd49aecd4c493ecb5293a
SHA1 fbbc7d94f7585b1d2efcd877f2601459498eccb5
SHA512 2c23d666a8799a69d09ab065e8299f7d65af862fba88aafeed97067538af704e953354275d4e1dfb49bc92f1c1be112bca23199aa2a7c49129413401bed89651
SSDEEP 3072:s/J8LvmBrfHk4xul4nhu7v9QglEXRc47TU:+fBrfDxu829kA
TLSH
T1BAF36B2A97DD6527D77F86B845930701D733B8A60306E6EB418188981F93BC3FB716A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.Process.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\System.Diagnostics.Process.dll
Size 321KB
SHA256 51a57fbe918f8b68930c090792b718fc0850ea12da869d50b97a3796af29a740
MD5 3910cfd67a4ad211cf6695f5d53a5826
SHA1 fd2191bd2343e84579fb511011ffa771762b1469
SHA512 b7e617d2d3c177725a03e8dde7a9c4a8cfaa8f28a1ecbafc8e32524fe1359bfc4afff06458b242932377f1e313a14afe8319735b41541066e454ad533de5504e
SSDEEP 6144:3QjEAFSuTpqNmlS+LeRqI6GnWv9jb3bG1PjdlGODVvYD:AjEfwpqNmYqeRtnfEKvYD
TLSH
T151647E2DB7881509FF6E52B8A077D802E1BD94822781D7CB0350DEA96F5B7C3A771263
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Drawing.Common.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\System.Drawing.Common.dll
Size 901KB
SHA256 2e4785b9ce61bb16c90b9be94894e61ae8672afdc137f1b0f4e64c1de8bd1639
MD5 5346960b95b4e36be0b7e95da949191e
SHA1 71250fa59a443e67f8126fbeba3d8c33f29ced87
SHA512 54afd7fb6060d78eb7857284d4186deb2ef9b34e52cd2b4991a2849e61d60010980093f167d74e51ae2c5d92c2e176a808283e12c604fb0753b5a4e511120cff
SSDEEP 24576:uZjiE3Q8vxVDAFYNqK/AkWXQEzNQVTYwgpb:ukE3Q8vxVkzkWpzNQVTQF
TLSH
T1DD156B27A3D40E16D92ED2F9D18B4812D631E4859722D1CB0984DD793F47BE3EA3B1A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Drawing.Primitives.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\System.Drawing.Primitives.dll
Size 129KB
SHA256 17585b32ca91bac8ccff2ef1c6ddf62ee9ea5efc552928c3a9d1b868394246e9
MD5 caa3b3428771f391736240346ec9acb4
SHA1 b4b46c7d062ef3c43869c32beda9a96578c35834
SHA512 0ff1d0cc80c252a522a1182ef1ff71320329e8aafd9b6db3f62b92d59d39cfa45bb5802949042e640104fd2ab4e5548fe72d664563b337cf94d1d6afa1b75b14
SSDEEP 1536:DI20lprkER8jX5hXIT/9p5Qnl5v4fiBSwEAlXxApxVr1aC2RL8lUpVVNVBYzV:DcprkS8jX5hXIT/azoiB5BiqRLr7TAp
TLSH
T11AD3396AF35489ACEE79527C62A75477CE39F1460312D0DF8886448C9F12BD8F6B10FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Linq.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\System.Linq.dll
Size 681KB
SHA256 284d38945b6e92e847129bd28af458b19818d0f2181f79882888ab2003f4c519
MD5 1ea7d5e8a957169f7c2fec764f6f0408
SHA1 752f251ed1f97f79d2a061d78306df821cfc02a1
SHA512 022356c78b36492ea1a8c3f7e651ea98d32269c94c8b3aa8e5942a99eb817eac1ecf7e9e25a5ff75edd338728c2f82367d58ce6dc76b36559dfc8da0ebc2c492
SSDEEP 12288:K0GwvqPJLv73KQkvIRR/ZqC6p/XCy3esv:K0dOLzKQkvIRREBF3esv
TLSH
T1B2E45D29D38C4A22CAEF467A95235161D2A195D243D2C8DB844EFD442FF3BC1677EB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\System.Memory.dll
Size 157KB
SHA256 f8f9d38efd6b0de30954d6bf1f353e9617bfb36d3d245c013a3b12be9f6bd88a
MD5 e4713f24bcf42de027702cca61edb548
SHA1 61d84a84b8b2bbe1492875afa6714d4ae36ad7f7
SHA512 adf6b577173f212889cc34c0ed1e90fd833a2e9b8f723ea2705b01658be9a8b1bb29c6f96855c2c5425c5e3bb2d8a633fcf6ce9c085d2ff0b2f88a9f5fd02de0
SSDEEP 3072:mcbIWUQJ8tT49EggVul1co8s2pwaGrpXDXPjT/hd7b4y:7kMhpV6waGrdPH5d7N
TLSH
T1F2F34A1BD3980227E92FC6BA8B5AC602EF337515D30191CB44D4DA486F53BE1BFB6522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Numerics.Vectors.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\System.Numerics.Vectors.dll
Size 15KB
SHA256 a9a980ee33ed0c798a5e1960c4557521f465ac9e0987dfd2c3049d53b1f2fa5a
MD5 35b501eef9ca053a61545b5372f256ec
SHA1 b6e069c3a847c0d6ef53b4776cf390d65a4238bf
SHA512 e829948795a43c8010c3fc3d1b69ca629ddcdb75c9660a06de238ab6312e31070f00f21b43483fe9e53a4c9d29d997b24b6921319b38a0136c952c4a5d23b85c
SSDEEP 192:evvpijxzHzWdBWI2WCWKie1BzBWseawWwJqthuFwleX01k9z3Asq6c+s8J:evvwzHzWdBWI+ZlNXUwleR9zjq6c+sC
TLSH
T1C0624992DB6C8257FD976EB05AB4DE833D3CA7C64C52966A1599F1182C233C0EF31638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.CoreLib.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\System.Private.CoreLib.dll
Size 15.3MB
SHA256 1125acc8106c43fc8bad2d203c4c4485df6182d292846c2fff415c1040c54678
MD5 65ab87caa6fad6300656a7e67ef90880
SHA1 53d3543dcbdbcbe877a4bde23163b23432b07dd2
SHA512 160b7e2880aba7011463c768a67f5d44c3816f2979ec5830a1f6393bbfa8ba2bd4cdbe1f483f5232b6a06b08645f2856c9a1a757081c724cbb44257d6752d3a1
SSDEEP 196608:nSB8Fw8j0czR1GXgmFE8TROH0nhg6pf4u7Q7RoVsC6YSKFpUjq:SB8FjFzR1tmFE4OH0nhguff5PN
TLSH
T10AF6AE10D3D88F5AE13BC77C8177C626EA71F892532656C70595EA883F23BD0633B6A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Windows.Core.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\System.Private.Windows.Core.dll
Size 1.8MB
SHA256 1af707e6489ebe4847651b2820c858b77fe2c08995831678b4c631aea23e9978
MD5 022a5d27612d082336d9d9a21857daa8
SHA1 6c6d117d7a56a9630fcdb42524bac78cf18c6a94
SHA512 b8a392ed6f4cf38d39848e149398d303406c4269ca09ee2214a24baa228dd079c5f90d8d1e651d0bdab61501f885e6ab4b7ca1a6cbdc1351a9c15de8680f1e3d
SSDEEP 24576:N0tAqckTTzTmoyi9X6KPucrhs4Dcl5KGgXV+ldGK+Th1IuqW0J774:ozTmti9X6KPucFnWGK+Th1Xqdo
TLSH
T19F955D14AE4A7798FD1B897450634640C1706A8763A3EFE740C5F8942922BD3EFFF1A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Windows.GdiPlus.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\System.Private.Windows.GdiPlus.dll
Size 417KB
SHA256 59efe4aecd13b14d210af5d5c3c372b67fe39e862485f9d5a8d213096741e5f7
MD5 f6cf43c13974e5bc4fe37b7f7f755853
SHA1 7934cb95c357bbf00f14e51583dc77f0bd820c1f
SHA512 835b926416a2665eac0bf1ab88d080fa4dc3a62dcdc453df06b49da354c8957682b0f57168da92e10f45135ace91d9f7aad1ad0384a0cc2904f073a943a670f3
SSDEEP 3072:QlArkmADjoC/q8VLuU2N3v+bX85DvITRuXo8VxIkOy86hx238aO8nT+DOtZKv+QQ:yrDjTJGusdAT13HLX5KE
TLSH
T1259485257B011529FB3BCE79868A9940C2607D1BB792E9C742C14D867B73FC7E336682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.InteropServices.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\System.Runtime.InteropServices.dll
Size 109KB
SHA256 e5eb1679f3579c9141e2bb9dbdce62624a623f38d299805cc1de07bacd21841f
MD5 eb8efe51e4b0c08806c481396176a639
SHA1 40f678ddaa3d9d0be2d76910a73beb7b7e5e8db7
SHA512 8d7bf648fd701603d1ed86a09e58291f2e43b646fbfec1e1eed23a8b33be3c1bb2a743d3bd17412f4b7d5226b23e9593a2d910914b5c0fd958b444e641b4d46e
SSDEEP 1536:6QCquAttQMxLPQtvC+zucKb2EW4udNY/w2yVvOHugu94RHPXF20g9zwn:6QCHStQMZ4vg2E5udNY42ypaugPc9sn
TLSH
T114B328207BD8863ADA5A87389C336D10CDB3FAC65322A2CF4584849D0FD77C567727A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\System.Runtime.dll
Size 43KB
SHA256 76be53624f64b23d0249dfa0bbe85390086de7c44bfd490642ea86c6faaf44af
MD5 dd6fd06a80e9d90a12b8c7a3ccf0d3a3
SHA1 c60f31d35665c6640fd6aad1fca94a7ef09e6613
SHA512 18a10132b5d1ca4dfd5b349e8ba12693bf56a0a8d15e17cb82eeae7d01b95348edbc92cf3a3b1ececc385f19453daac79e028c2b6b589e92fd3fc01eef440554
SSDEEP 768:yJShN9Yzl50v4boRiPYVbugVJ22Ez2s9zkd:yJmN9Yzl50v4boRS022ESkzkd
TLSH
T16D13D6A1EE289233CCCA93B29CB3A4801EF173C244760D75556FD73664ABB89563637C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Encoding.Extensions.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\System.Text.Encoding.Extensions.dll
Size 15KB
SHA256 8f51b9535db64fe027a40d6076200b1a6b0889bf05f62bb8e68c3eb083c7f113
MD5 36b62bc4aac6e461cd1c71e339e969ad
SHA1 03f3edd6aa9e88f24e889bf2ea3a80991ee2a5d2
SHA512 c10c444b09ea011d812ebe5a4d85e896e4141f8e7d30a9e5ef35b3029c13ca55bab824d5b925c3cce48efe6ac860d0d70f3095863c96ed6333fcd38896e6fd94
SSDEEP 192:OSyHmXhpdSMx+KW1JWIrWCWKie1BzBWseaoWH9FNGMsc+6UQ/X01k9z3Ahs0qbHI:OSyGR/x+KW1JWIPZlNNprj/R9zRJGKC
TLSH
T158623B928B7C4243EDA66EB0AAACD9837D3967C28C409A6615D9F2181C533C4DB31A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Encodings.Web.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\System.Text.Encodings.Web.dll
Size 121KB
SHA256 d20431f20d992e71a4e82e5f25c822474e2f4097d8527972d3d78ea1f26e47c3
MD5 fdb09e7eff27b24d7b2d6c7b141f513b
SHA1 5fc3bf3eadba85daa70812a86dfa62651b329cd8
SHA512 90d70521583dfed52732afcd7bb9f7cffa0666739934f3c00767537c53fb5fa72879314c6a9c25dfb10019c486c2009bb2aa64f162166459ccb5202274ebb881
SSDEEP 1536:z9BiA0FaMPHcO+NP/LNss/5XwY7qSA1ehJ98cuXknG4/vPzUS:z9IXFpr+dNsKry1ejRu0G4nPYS
TLSH
T18EC31811B388D649C3694374D6938572DAB9BFF1031296CB09A8351A1FF27EAAF3D143
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Json.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\System.Text.Json.dll
Size 1.8MB
SHA256 fa99f413be21ed5f484a09093fe5f0beba7de3062cf9cc9f847dbf8108dba55a
MD5 f6d1d8e2d65698ff2d1f658cead9cf35
SHA1 94fe04ac63ea1638adac63e54d081222888fd663
SHA512 ca3eb95082dbacea84d89b352caed15f13e676cc3668d0e78f92bd47e8df8cb289f46ab13ed118ac3ccce7635c0f358550623ab491c6426ddce2b433a6f47e80
SSDEEP 49152:14aVOE7kEkWCwr8QsUJwwLBpbp95ZSfbfA:LVfZsUJTzZSfk
TLSH
T12B957C11E3EC5227C96ED2BA80138122D671A1025312D6CBAC58FD8A7F43BD1D776DBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Thread.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\System.Threading.Thread.dll
Size 15KB
SHA256 ce71949bb1ea67b686e799128582015ebf8758f1107e59e43f342ece3f662930
MD5 191e118586803775c61d1a03c41d63c4
SHA1 477a76ebcb165b1ef9df647cfdbe35d98e26d3dc
SHA512 6dd35d403b1ce38d5645e7d6b08706094050b04b01afb97f7c6d871ee88eb19e9b9486a40d981cc258e42c93ec4e4242ed130505d1841566a67b7123a39111b4
SSDEEP 192:LS6z4dEpjxUYKoUWd7WIcWF+GBTBWseaAWHMMAAUYX01k9z3AahhhAiw:G6z2EbUYKoUWd7WIRlNtMMgYR9z5hhA
TLSH
T10E625CA6C7AC8143EDA62E7056B8CAC33D3DB7C299608A5615D2F1092C573C4DF3163E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\System.Threading.dll
Size 81KB
SHA256 6c32ed1bf8067e4169e8feddd15e6489b89d19d1c7aae1520a551b57745d0a60
MD5 e092010e1fb5dd0b1201c968abf080e6
SHA1 e78446bb91c2f89f4ab672ca2a2c6d0a4fdf1631
SHA512 8931f25c8f3798a56ae5d2f120dbf0cc39b2e17186ab2516dd1d9c4164b3693eacc75b7685f4d34aa79b55bb34dcd84800b079f2e93623d0b24961b6d196b9b8
SSDEEP 1536:IaylBo2tUTogxqwXAXXG9Rtd5bFF9o6sion/zW:InlBo4UkgIwXeW9RtHJF9o6Lon/q
TLSH
T1A4836B1173E8091AFBBB47B9DAB36905C171FED21B11D2CF005A920D1FA7BC496B21A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Windows.Forms.Primitives.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\System.Windows.Forms.Primitives.dll
Size 3.5MB
SHA256 3eca2d3db1960ee9b2a86fb40489a185f51be55e722584f667a631e6a7ef82e1
MD5 b98bef8f77e0a782928b518b262cf1de
SHA1 6ef956b4e91e3641c95e73382f13bb9aa70e38d0
SHA512 50bf5d0b452621e5cef92cda3e65788413b1747bdc62f006611a7e95e0ec12c1dede117b41bf823419abf5ea7ad3d73dff889d69f588ba0426b99e39840c5bbb
SSDEEP 24576:lhQqsc9uClFTfx2zxHPxAz44j9YnTqIna+LUyb0UKoOsPqYo4CgdQO0PrHaN:lUCvJ2vlaZ+PqYo4aHaN
TLSH
T10EF5061513845F1BFE2ECA3A86954540A2A0B85BB702F6C355C15DA63E73FE3F27E092
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Windows.Forms.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\System.Windows.Forms.dll
Size 13.1MB
SHA256 28cbefb565c6b19998bff06ef568389c53bd2c00b2d437d1b1995f73d4aad7e4
MD5 99a83b21f10c234e360d3c8908f7238d
SHA1 098bf4d7e44aef09faa340d094d02903e602b5cc
SHA512 a77b05201cd0bbab06824a2ea3eb4503aedc5bc393adaa94fa64afcf149d8dd3579bf60446d0c6b718f937baa85adc5ad335f35824fa1ba19587cd80417fa9c2
SSDEEP 98304:6trOult6UE84dU0Ln3DPIO3VaUUKUvdrvgHtBBLNxoEt:INl0TzPIO3VaUUKUvdrvgPBYo
TLSH
T12CD63A5262DCBD95C2398278F37343E1E7ACDC168361D2CF0A90BD152A7AA8379363D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinRT.Runtime.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\WinRT.Runtime.dll
Size 516KB
SHA256 bcf3a14e8712a90837fc5c0d8c8a24696af2bd7f74e9767597ec81ededfb23db
MD5 edb1f8d15fe41838cd449141187ae032
SHA1 c7344afcdaced6911ab5288b0ade76f66dd41203
SHA512 5756ccbafa1440d114f8d9b163ea0c2678300ba24c9979b837ba232cc6813f74a29fc0a23b9bc1d7f53c6ce5f15cdacd6804a755ac816116536c56cd9ca43c0e
SSDEEP 12288:A4Yh4z+uZSlne+7/SQ2YaxhaNHav96iTtqen:HRSucPTx2YaxhaW
TLSH
T12CB44A80A7FD9A1AE7BE1334B03416144B71FC17AA13E39F674895B81D637998E40BF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clrjit.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\clrjit.dll
Size 2.0MB
SHA256 0749d8fc8e944d0576e1bb47120f87add8f875e5cd8968995633063fc79256f6
MD5 91c601bfa2cd2025addde57d6fcdd82f
SHA1 dd5c24d0729f53386ac968e7176dbe207a89f55d
SHA512 92ceb44522a7c1117ca85da5699c3a68e6c438082155ef4d2aac58145a16b4df9759f210004b918a16300955de58889995299a0a2e9a9ab4ef33acf0786d1458
SSDEEP 49152:OChDIhDQldlc4hbGQxxc8do1cZzoDMKpP+KKOYkzBMQyxX+2WXi8oWDdFo1oNI:OEYClc4haQxxc/uZzoDZ+KKO/zVGu2ia
TLSH
T174A5AE47A2B900FCD06F9634C6174A17EBB2B8051771DBDF03F04A966F23BA2296E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

coreclr.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\coreclr.dll
Size 4.4MB
SHA256 128aee8c62a673d64739e585e3876b61133571cec83a46240a62581d5465639b
MD5 7a4f8614679dd4483d88215f54e35428
SHA1 bc706007430e6213dcfd18149e487f5df9f017dc
SHA512 90fba91f795603897590237a5305871ae249e475b324870f0f2a7cf88451b6a8ba9ec78ea0181fa18d400cf64149659901ad68d68086f440152c98e698ff4553
SSDEEP 49152:m3Z7vXstHcoY/clfYkjB01PW/e0b7b7b7b7bu7b7b7b7b731n9s71L/iPGHOfKVs:M7fstvl6wc7uPYWYC1i
TLSH
T1C4268D56B2BD00DDC4B6D1B8C6D74917FAB238491338DBEB02644A661F27BE16A3F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\hostfxr.dll
Size 370KB
SHA256 838591885c5396fb0588a3aedc2f3e841d3afc67570868b1bce615264005a44c
MD5 6a3b9c4600fc05e0275d7b1ab20a9ae5
SHA1 0601e1db524cca08efe8dc63d1cd5dea23fdab78
SHA512 c1401763882b408c66940fe4c1f9729746086dc471664f4c643403932843b551994dabb56e1099f7f75092e779ae6b5a56684a3cde82efc65716f1553b9a646e
SSDEEP 6144:hal9vjNggqbRRdaUzIS64W+/zvZ0UCVvfpdAl0FsGxilKmkRAwBAO/Ux62CUHFhb:hFRAOOnpa2vD3Q9Bqk
TLSH
T147841816D3E8057CF0B79678DAB29902EB727C494BB0E5DF139088651E73BD09A39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostpolicy.dll

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\hostpolicy.dll
Size 369KB
SHA256 e92a2e71eeeaf7c574e905935b3e3724ef29bade44317659dbe06f505e99dbe0
MD5 10d0786927018fffb019bfd445ad3d9b
SHA1 c19dd3e6017d8cf0ca8084c87ad01d57604388d1
SHA512 709fce701554b4e65b3a9fa60665391c8ea30f3bdd22e06032b9ab4d7825b414d58b8dd0f2c3b47f105ddbe34874378202e297337a19b849fea8cdf019508221
SSDEEP 6144:Os0pbUUvKO9fssrJDpMBqyiNluCZO7ptsPB7dGd2b1ucZaLr9H/VLuxJb/FDtaDb:OrFvKOHlKcyiB8HB+UDwKkEFT/X
TLSH
T117842916D6EC007CF0B7E679CAB28901EB727C4947B196DF139099A61E73BD09E39312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-S00GXCAOKG.tmp

Path C:\Users\Admin\AppData\Local\Programs\ReWindow\is-S00GXCAOKG.tmp
Size 1.3MB
SHA256 86c29a7b945525135de16c3dcb71e3b8517848c459cbb21395b352d4e6bba09c
MD5 ae07f51b1de6dfefecc54d70a85889f0
SHA1 7b5fc1a1beb42afb2d3adc07bc43f7afed21a6b8
SHA512 23963d6a2e14b3e226b53ba7b0de9f022fdf49c1463c34bd3fd5c0180432433043bdf275992ab4292bb0aa40070a7e8b7dad43a77a8bf1073fff04e1155fc8ba
SSDEEP 24576:vAPmRdpMfSHeSSl9pRF3SEsqJCUkMGt84y1zSgpl2gBSSoGjsgDF:imRdpMfSHd8RSELkMGty
TLSH
T1C6555B56D6BC4499CEB9D0F8C547491FEBB13811033466EF46A48B192F3BBE66ABC310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rewindow.log

Path C:\Users\Admin\AppData\Local\Rewindow\Rewindow.log
Size 4KB
SHA256 583a24ff6d0f4f8f5ec10a9b52cfdc73cc28d3e7c1bfac87aa3258b162a8de95
MD5 33ca7d3c40a707cd2ce3ff46f984ba77
SHA1 42021ead51a5ed49508dc96677f0032c9aa148fd
SHA512 3c6255f12a543eeb06e217eaa697bc4e5fe3670622772c05c5d6d6846fb9751e8b4d1e1d4a132a61dfb1392d95a92f88a0775388e3e607da6d05691b9ecfed43
SSDEEP 96:rsSW6RzFQ9OnTNdjvAbGAZ/n91bSQmVlk67/GG8QTAckxepwl6FKgWYhLoF+bjs/:7W6VFYJR
TLSH
T15A910FEE41D280C2D3DA0EE7042F276B6093B5641E1C66D7B16CA65D346CD4EBEEB8C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapshot-20261003-132238.json

Path C:\Users\Admin\AppData\Local\Rewindow\history\snapshot-20261003-132238.json
Size 1KB
SHA256 3a46d2063c6fb4297b2c736df8917ba9deeec2977de50bd134a2012b22a6b50a
MD5 059f2033380ccbc823483a5c84c90522
SHA1 8b0f53403c7032a661fcec94947ce52f0be1a72c
SHA512 f6ac51613cb88bb6f490d752bd9fa8330071c97699c5ffc4b3022dc4f595625513fc78ee2de37f9c4a02f412f171c8225b439c94aad0d115bb0b7f6e680ddb81
TLSH
T14F41842BD4508C3F20F616246CF99F06E298137B62004C5BBBBD560DDFB297A1451E7B
MD5 SHA1 SHA512 TLSH

Submit Download

Rewindow-Setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-K3LY68JY3F.tmp\Rewindow-Setup.tmp
Size 4.2MB
SHA256 cd5b0b1c71c09fc23c90402278fa8e8b754b09863859e0859f2947f68b3db3be
MD5 528403fb7647e01848e57d031768b1f1
SHA1 620978e39acbd4d0242ce19f69ad75f0a0012460
SHA512 fceb4b89038bcf9a5948a4ee16a01fb8fdb5932ddaadcb1aba30e6e381228c225d16083d8f865805296bdaeb9e16e0b4efc9c525a3b06b40d9ad8b827a75fdf8
SSDEEP 98304:z9SZUvl30aj90ZFcvdQ0hdgvminQLMj+J1333F:IItJj90Z6RgKwQ
TLSH
T180267D07B288713AD4A72A3F883BA258587F7E203D17CD976FF4195C4E399816D2A743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4768-10-0x0000000001500000-0x0000000001501000-memory.dmp

Download

memory/4768-904-0x0000000000680000-0x0000000000AD3000-memory.dmp

Download

memory/4768-6-0x0000000001500000-0x0000000001501000-memory.dmp

Download

memory/4768-9-0x0000000000680000-0x0000000000AD3000-memory.dmp

Download

memory/4768-12-0x0000000000680000-0x0000000000AD3000-memory.dmp

Download

memory/4768-920-0x0000000000680000-0x0000000000AD3000-memory.dmp

Download

memory/4768-14-0x0000000000680000-0x0000000000AD3000-memory.dmp

Download

memory/4768-644-0x0000000000680000-0x0000000000AD3000-memory.dmp

Download

memory/5108-0-0x0000000000600000-0x00000000006F7000-memory.dmp

Download

memory/5108-8-0x0000000000600000-0x00000000006F7000-memory.dmp

Download

memory/5108-921-0x0000000000600000-0x00000000006F7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads