f8026c1b7e78c80e8e85ddbbfe96f76cae6fc0bf3d09fb06a85c68aefadc8a6a

Analysis

user interaction
yes
max time kernel
60s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BorderlessGaming9.6_admin_setup.exe
Size 2.2MB
Sample261002-tk2l3adg69
SHA256 f8026c1b7e78c80e8e85ddbbfe96f76cae6fc0bf3d09fb06a85c68aefadc8a6a
MD5 9aaf3b5854d4d34ba5ee77b88b96d7f9
SHA1 32872aadc95c4ee3d15af50bcea94fd6b49f19d4
SHA512 e5f7352a7ddbb1588263a9c03012d402f490be74f1ece32553570244451b32c3efde2539c5f473682dfb8f692c52e8ccfb50cfbb8d0915c3406c3a8c82670d46
SSDEEP 49152:8nfhrouOy34IGPdOtHwlKi8i3fpE7NfnFnrpObm:8nfhrIw4pagu9n9pmm
TLSH
T10CB5E123B24E773EE46A99350962AE01543FAA60A51F8DA7D6F40D8CCF2E0541D7EF07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery installer spyware

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	BorderlessGaming9.6_admin_setup.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	BorderlessGaming.exe

Executes dropped EXE 3 IoCs

pid	Process
3584	BorderlessGaming9.6_admin_setup.tmp
3844	BorderlessGaming.exe
4296	BorderlessGaming.exe

Loads dropped DLL 16 IoCs

pid	Process
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
4296	BorderlessGaming.exe
4296	BorderlessGaming.exe
4296	BorderlessGaming.exe
4296	BorderlessGaming.exe
4296	BorderlessGaming.exe
4296	BorderlessGaming.exe
4296	BorderlessGaming.exe
4296	BorderlessGaming.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 42 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Borderless Gaming\is-REG9O.tmp	BorderlessGaming9.6_admin_setup.tmp
File opened for modification	C:\Program Files (x86)\Borderless Gaming\en\BorderlessGaming.resources.dll	BorderlessGaming9.6_admin_setup.tmp
File created	C:\Program Files (x86)\Borderless Gaming\is-4L43R.tmp	BorderlessGaming9.6_admin_setup.tmp
File created	C:\Program Files (x86)\Borderless Gaming\de\is-ESF2V.tmp	BorderlessGaming9.6_admin_setup.tmp
File created	C:\Program Files (x86)\Borderless Gaming\fr\is-47GOH.tmp	BorderlessGaming9.6_admin_setup.tmp
File opened for modification	C:\Program Files (x86)\Borderless Gaming\de\Microsoft.Win32.TaskScheduler.resources.dll	BorderlessGaming9.6_admin_setup.tmp
File opened for modification	C:\Program Files (x86)\Borderless Gaming\fr\Microsoft.Win32.TaskScheduler.resources.dll	BorderlessGaming9.6_admin_setup.tmp
File opened for modification	C:\Program Files (x86)\Borderless Gaming\zh-CN\BorderlessGaming.resources.dll	BorderlessGaming9.6_admin_setup.tmp
File created	C:\Program Files (x86)\Borderless Gaming\is-RNE14.tmp	BorderlessGaming9.6_admin_setup.tmp
File created	C:\Program Files (x86)\Borderless Gaming\it\is-MT0ML.tmp	BorderlessGaming9.6_admin_setup.tmp
File created	C:\Program Files (x86)\Borderless Gaming\zh-CN\is-IB2N5.tmp	BorderlessGaming9.6_admin_setup.tmp
File opened for modification	C:\Program Files (x86)\Borderless Gaming\unins000.dat	BorderlessGaming9.6_admin_setup.tmp
File created	C:\Program Files (x86)\Borderless Gaming\is-0VVVR.tmp	BorderlessGaming9.6_admin_setup.tmp
File opened for modification	C:\Program Files (x86)\Borderless Gaming\ru\Microsoft.Win32.TaskScheduler.resources.dll	BorderlessGaming9.6_admin_setup.tmp
File opened for modification	C:\Program Files (x86)\Borderless Gaming\BorderlessGaming.exe	BorderlessGaming9.6_admin_setup.tmp
File opened for modification	C:\Program Files (x86)\Borderless Gaming\CommandLine.dll	BorderlessGaming9.6_admin_setup.tmp
File opened for modification	C:\Program Files (x86)\Borderless Gaming\Microsoft.Win32.TaskScheduler.dll	BorderlessGaming9.6_admin_setup.tmp
File opened for modification	C:\Program Files (x86)\Borderless Gaming\es\Microsoft.Win32.TaskScheduler.resources.dll	BorderlessGaming9.6_admin_setup.tmp
File created	C:\Program Files (x86)\Borderless Gaming\en\is-VHUJN.tmp	BorderlessGaming9.6_admin_setup.tmp
File created	C:\Program Files (x86)\Borderless Gaming\zh-CN\is-JK4ML.tmp	BorderlessGaming9.6_admin_setup.tmp
File opened for modification	C:\Program Files (x86)\Borderless Gaming\en-US\BorderlessGaming.resources.dll	BorderlessGaming9.6_admin_setup.tmp
File opened for modification	C:\Program Files (x86)\Borderless Gaming\protobuf-net.dll	BorderlessGaming9.6_admin_setup.tmp
File created	C:\Program Files (x86)\Borderless Gaming\is-LQC0K.tmp	BorderlessGaming9.6_admin_setup.tmp
File created	C:\Program Files (x86)\Borderless Gaming\is-4NF8F.tmp	BorderlessGaming9.6_admin_setup.tmp
File opened for modification	C:\Program Files (x86)\Borderless Gaming\it\Microsoft.Win32.TaskScheduler.resources.dll	BorderlessGaming9.6_admin_setup.tmp
File created	C:\Program Files (x86)\Borderless Gaming\unins000.dat	BorderlessGaming9.6_admin_setup.tmp
File created	C:\Program Files (x86)\Borderless Gaming\is-121H6.tmp	BorderlessGaming9.6_admin_setup.tmp
File created	C:\Program Files (x86)\Borderless Gaming\pl\is-5285E.tmp	BorderlessGaming9.6_admin_setup.tmp
File created	C:\Program Files (x86)\Borderless Gaming\is-8IF6O.tmp	BorderlessGaming9.6_admin_setup.tmp
File created	C:\Program Files (x86)\Borderless Gaming\is-7QEOG.tmp	BorderlessGaming9.6_admin_setup.tmp
File created	C:\Program Files (x86)\Borderless Gaming\is-TTH64.tmp	BorderlessGaming9.6_admin_setup.tmp
File created	C:\Program Files (x86)\Borderless Gaming\es\is-AHI1I.tmp	BorderlessGaming9.6_admin_setup.tmp
File created	C:\Program Files (x86)\Borderless Gaming\is-CHM6E.tmp	BorderlessGaming9.6_admin_setup.tmp
File created	C:\Program Files (x86)\Borderless Gaming\de\is-QFMIL.tmp	BorderlessGaming9.6_admin_setup.tmp
File opened for modification	C:\Program Files (x86)\Borderless Gaming\de\BorderlessGaming.resources.dll	BorderlessGaming9.6_admin_setup.tmp
File opened for modification	C:\Program Files (x86)\Borderless Gaming\pl\Microsoft.Win32.TaskScheduler.resources.dll	BorderlessGaming9.6_admin_setup.tmp
File created	C:\Program Files (x86)\Borderless Gaming\is-4RJTQ.tmp	BorderlessGaming9.6_admin_setup.tmp
File created	C:\Program Files (x86)\Borderless Gaming\en-US\is-GGT3Q.tmp	BorderlessGaming9.6_admin_setup.tmp
File created	C:\Program Files (x86)\Borderless Gaming\ru\is-JTC8M.tmp	BorderlessGaming9.6_admin_setup.tmp
File opened for modification	C:\Program Files (x86)\Borderless Gaming\BorderlessGaming.Logic.dll	BorderlessGaming9.6_admin_setup.tmp
File opened for modification	C:\Program Files (x86)\Borderless Gaming\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll	BorderlessGaming9.6_admin_setup.tmp
File created	C:\Program Files (x86)\Borderless Gaming\is-39MTU.tmp	BorderlessGaming9.6_admin_setup.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BorderlessGaming9.6_admin_setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BorderlessGaming.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BorderlessGaming.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BorderlessGaming9.6_admin_setup.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4228-0-0x00000000004A0000-0x0000000000580000-memory.dmp	innosetup
behavioral1/memory/4228-7-0x00000000004A0000-0x0000000000580000-memory.dmp	innosetup
behavioral1/memory/4228-168-0x00000000004A0000-0x0000000000580000-memory.dmp	innosetup

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 5600310000000000425d0d811000526f616d696e6700400009000400efbe2b5de578425d20812e00000065e101000000010000000000000000000000000000007613790052006f0061006d0069006e006700000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000002b5de57812004170704461746100400009000400efbe2b5de578425d02812e00000064e10100000001000000000000000000000000000000ac52d7004100700070004400610074006100000016000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000002b5de5781100557365727300640009000400efbe874f7748425d02812e000000c70500000000010000000000000000003a0000000000f702e80055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000002b5d2480100041646d696e003c0009000400efbe2b5de578425d02812e00000059e101000000010000000000000000000000000000000d543800410064006d0069006e00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 6600310000000000425d0d811000414e445245577e3100004e0009000400efbe425d0d81425d20812e000000284502000000070000000000000000000000000000007613790041006e0064007200650077002000530061006d00700073006f006e00000018000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = 6c00310000000000425d0d811000424f524445527e310000540009000400efbe425d0d81425d0d812e000000294502000000070000000000000000000000000000007613790042006f0072006400650072006c006500730073002000470061006d0069006e006700000018000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1900	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3584	BorderlessGaming9.6_admin_setup.tmp
3584	BorderlessGaming9.6_admin_setup.tmp
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3844	BorderlessGaming.exe
Token: SeDebugPrivilege	4296	BorderlessGaming.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3584	BorderlessGaming9.6_admin_setup.tmp
3844	BorderlessGaming.exe
4296	BorderlessGaming.exe
3844	BorderlessGaming.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
4296	BorderlessGaming.exe
4296	BorderlessGaming.exe
4296	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
4296	BorderlessGaming.exe
4296	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
4296	BorderlessGaming.exe
4296	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
4296	BorderlessGaming.exe
4296	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
4296	BorderlessGaming.exe
4296	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
4296	BorderlessGaming.exe
4296	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe
4296	BorderlessGaming.exe
4296	BorderlessGaming.exe
3844	BorderlessGaming.exe
3844	BorderlessGaming.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1900	explorer.exe
1900	explorer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 3584	4228	BorderlessGaming9.6_admin_setup.exe	87
PID 3584 wrote to memory of 3844	3584	BorderlessGaming9.6_admin_setup.tmp	104
PID 3844 wrote to memory of 2172	3844	BorderlessGaming.exe	110

C:\Users\Admin\AppData\Local\Temp\BorderlessGaming9.6_admin_setup.exe
"C:\Users\Admin\AppData\Local\Temp\BorderlessGaming9.6_admin_setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Users\Admin\AppData\Local\Temp\is-9FAE2.tmp\BorderlessGaming9.6_admin_setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-9FAE2.tmp\BorderlessGaming9.6_admin_setup.tmp" /SL5="$A002E,1302003,855040,C:\Users\Admin\AppData\Local\Temp\BorderlessGaming9.6_admin_setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Program Files (x86)\Borderless Gaming\BorderlessGaming.exe
    "C:\Program Files (x86)\Borderless Gaming\BorderlessGaming.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\System32\explorer.exe" /e,"C:\Users\Admin\AppData\Roaming\Andrew Sampson\Borderless Gaming","C:\Users\Admin\AppData\Roaming\Andrew Sampson\Borderless Gaming"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2172

C:\Program Files (x86)\Borderless Gaming\BorderlessGaming.exe
"C:\Program Files (x86)\Borderless Gaming\BorderlessGaming.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4296

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1900

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BorderlessGaming.Logic.dll

Path C:\Program Files (x86)\Borderless Gaming\BorderlessGaming.Logic.dll
Size 103KB
SHA256 f01edcb5e7c85e1a2f73fd30392ceaa59744f02cc09fc0292f834c6ce96d8e38
MD5 660149f97b8d983183b4adec9681ac52
SHA1 6600eb23eb257bef075466aebb1451f77e51109b
SHA512 7fa2defc1a1efdb37571c8a2e06ba884e36d6f184a0ab4a9ba0607d2442b82a6090a2d25bfb96f7a0d4f7207d4317992a1c9e8fb3223892f91a038d70254ff71
SSDEEP 3072:70o4vNyvwjU3utTRXLkR/Q/nnnSj1uYqi:OyvkU3sTR7kKnnnScu
TLSH
T1D9A39E3053A887A5F9EF8F39B8640723CFB1E585682EFB990E8D78999C533D64405363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BorderlessGaming.exe

Path C:\Program Files (x86)\Borderless Gaming\BorderlessGaming.exe
Size 377KB
SHA256 40773053b79d2a48fff7c47883f718a1ecb1b447919310464f6899258c1aef75
MD5 95123b5cbc53be2be8ce08865f6b2c44
SHA1 e57c08d04323f3cc94419d6dc624ab8cad0778d0
SHA512 c2116c97a4e8b0b8cb44b53c692a2319d2788306616e606f61039523d4620a7c407a58d2ae228cefee60372bfa9d895d8f46c57b19f4dd2a69d3038bd8674eaf
SSDEEP 6144:IvDZzs/ae3ZerSAQ8CITmCIKJRhWAyCRXDaeZ7JRhyJRhqeNUJRhVnJRhbO04RD/:EJTzJ0kJuJoJhnJm048q
TLSH
T1DE84D87033AB211CD8BB9A3204601383A63D6756DA49DBDE657833CC8B6364F672176F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BorderlessGaming.exe.config

Path C:\Program Files (x86)\Borderless Gaming\BorderlessGaming.exe.config
Size 184B
SHA256 16286566d54d81c3721f7ecf7f426d965de364e9be2f9e628d7363b684b6fe6a
MD5 13ff21470b63470978e08e4933eb8e56
SHA1 3fa7077272c55e85141236d90d302975e3d14b2e
SHA512 56d0e52874744df091ba8421eeda9c37854ece32a826bd251f74b88b6334df69736b8cd97104e6e7b2279ef01d2144fee100392744cc1afb7025ebbad5c307a8
TLSH
T123C0124940A8BD269D338A279250C922FFB022A2A024140CF02FAA6A0B311AD464736A
MD5 SHA1 SHA512 TLSH

Submit Download

CommandLine.dll

Path C:\Program Files (x86)\Borderless Gaming\CommandLine.dll
Size 57KB
SHA256 4923528d3d18689d58fa30b3d822ab72a13be21a57f13e0bc59b55b864424f7a
MD5 ec0e2dd54144d6f6a317b7daa715d418
SHA1 62c2e04bba8436912d9bcec1ec4d4c7afc843a47
SHA512 ccaf01f89fab001ef2ded15b352e1dd2ab3967584a8720acb7c6b7203240f9c896f7d46600b12e0e86b25b30779b1e5ed59ce97fb3f295afb11d6391670265ef
SSDEEP 768:Aa4UCvHii8p2scLC8OfyHxy1XdF0l1t8HQDGiejOsSZhD3T1x:A9hircRL9OfPtCJE9iejOsSv7
TLSH
T1EC43F95467E8872AE6BF0B75B83062510BB4BF46B963D76E4D44B49E1423FD085223B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Languages.zip

Path C:\Program Files (x86)\Borderless Gaming\Languages.zip
Size 23KB
SHA256 548fcd5ecde0e68cd11e58293fdebf56b3ff359b07111d7e39b149fd79da049e
MD5 076b8f22e4f2a3460cce0f69f60ab975
SHA1 184a9ac0fd860e1f4dae885c056359c4019da4f4
SHA512 f418f1f9c7827fa92b5069dc8536754cf4e31d1ead5a835bf439827788eb95d273f2f509c5d8f94b4e618e761040eecd7da0e2c5c7241eb6790caa351f356c4b
SSDEEP 384:QMESBxmCHqQ7GEFZkJkSifiYz5UjcK3Gt1wrc4QPH5tCHr7EiJxZ:5nBxmCKQ73GJ2iWmjB3Gt8QPZ09D
TLSH
T172B2C023CD26EA0AE69F947FA54E8696FA3D734815282C2757D2414C3B13D901B3DECD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

License.txt

Path C:\Program Files (x86)\Borderless Gaming\License.txt
Size 15KB
SHA256 69ae0f66367f715777c452b02cbfbf6d79bc7b4bf03310b17723267db5f331e3
MD5 6f8b60a98e2b832dfd3231365732fece
SHA1 c5012655da9a6d948603d5480c9c792da93fbc78
SHA512 68e2a70c14cf0321a5250f8064f24fd76c0dc296cc8fcadd334641cba7f1da6fd0ea51dcf43f28efc2da26441a63d6f2e3788d03db0a851c389ae4b3371cd05b
SSDEEP 192:se4HVPM3N2zZ654fLBtIi6VeUyPv4IdQQBJItn1OiDao7AUK/uMT5/sS/SlLEHsS:F4HmkTEi6Vby4I3iV1O2N7AOMRIU
TLSH
T1F462611E7F0643F206D242816A4B68DFE32ED078723A11657469C19D337FE3583BEA99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Win32.TaskScheduler.dll

Path C:\Program Files (x86)\Borderless Gaming\Microsoft.Win32.TaskScheduler.dll
Size 317KB
SHA256 4d62c95536f88eee447042cf4907bde48c7f22cebac30f7c5afd4748497ccdc2
MD5 6257d4a618328bbbccc63e2dd34ce45c
SHA1 53381dbd1d92349a4c5f81fe0da21d3ec2ee9d9b
SHA512 da359eccad0048cd1f0e5316d5d81b2d5adc1bdebea36e1a64c9a2024e6359c018b93d9781ae427035e1da093661fc4f18fa3c10da4371fb7247aa413d2a701e
SSDEEP 6144:JmrqJZtlDVC+sEm8iR8RMXZyYzhJS+8sX6PxQEcaBKBAw:jZrcbPPR8RMXZyYzhJS+8sX6PxQEb8B
TLSH
T1F5644B2263FC872AE9FF177EF43541108AB9F94AA866DF0E4550A9988E73740C953337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Read Me.txt

Path C:\Program Files (x86)\Borderless Gaming\Read Me.txt
Size 2KB
SHA256 df0ccf887dbd5dd1691fd30ee4f8712365ebd2f6eb8b5d13348b8a856bacac22
MD5 a5c09ed2750b7213d71ec292fba1d6f2
SHA1 57adc901686523775f570b853464b60a59bf0a41
SHA512 de804056a12b6a153c5ffa5ac9f76c5acf517d8efeac3e81c0cc504d7c6f18f015f8bc91b2e0bb18e0eb73ea08f0311465fe6d6444f7158471b2f66d4c9e0a95
TLSH
T15B51A5EF811E53793F0156D07D17B4EEE313D1DEA796ECE9780A8618161E8628A3B0CC
MD5 SHA1 SHA512 TLSH

Submit Download

protobuf-net.dll

Path C:\Program Files (x86)\Borderless Gaming\protobuf-net.dll
Size 269KB
SHA256 042b8c1c1e0eb7648b164ee48c95168c48324f1fb439cabd5f2e41db0938d807
MD5 4a4756e227c10623d81228bc4bc49c1d
SHA1 964014f538918d85f6eb6a7b4023b304067b28f7
SHA512 93d2c6f47c618dc9493f5a538cbfb5a32c1e3bb35a623b51561057245f2fa557c452ee18ae274182c3e0440b77353c5490d196f16eda142b6129e8d1108e5a04
SSDEEP 3072:2ne8csJldhXG4JhEj9n8RHq6MY7qLfoDb4LUcqbrKKu55O/u85wcT/0c8yiwo3aa:2nT7JxXJ7qFLMrKXE/9YLy1W2WNU6
TLSH
T195448D14A3EC4616E6FEE7B4E9B815484BF6BA4B752FEB0D589060FD0C2378189017B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unins000.exe

Path C:\Program Files (x86)\Borderless Gaming\unins000.exe
Size 3.5MB
SHA256 f91e2955cb63968d70252fe981afd5b50c53d1781ddcec7a18d78cd151734329
MD5 81d0df5ba58d3bc6b47833f236c80fa9
SHA1 c88fa8dbcc5e6944d5a3f9268487fc8fe09ef1c7
SHA512 d4088dfc7339fac97cfea379595f131ad4add525e110be8ac4d4f95c08f46bcb6e130a909f89d31c7b0c9fdba29a19e9f2f5e790a8e7d5bace1d347cd47d1950
SSDEEP 49152:D6RlZSDcbZsSNFZnpZv4sxNhdaodRl4FHKBCg3332cd:D6RHzbv4sxNhnrl5BV333D
TLSH
T1F8F56C13F3C9613ED05B1A3A39379245983F766079228C5797EC3E8C8F762852E2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BorderlessGaming9.6_admin_setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-9FAE2.tmp\BorderlessGaming9.6_admin_setup.tmp
Size 3.4MB
SHA256 a8026871bf153a4fb9ce2edd0a3363fd9814f79bb0f278a2c8e61adc6f493018
MD5 96251bc7df0e1048cebc21d58a76e67d
SHA1 a13de68743bbe4d8c584000c07a43ba5323f8e6b
SHA512 98d09fe8b6f2e9264efe8e8401d5167aec9c78bdf67e0325678fa884a513db3bb95aa2b7347445291cd85118b4b9943b6112f69e2e22df29c9479c053ee3f42b
SSDEEP 49152:r6RlZSDcbZsSNFZnpZv4sxNhdaodRl4FHKBCg3332ce:r6RHzbv4sxNhnrl5BV333c
TLSH
T151F57D13F385613ED05B1A3A39379285983F766079128C579BFC3E8C8F762852E2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

de-DE.lang

Path C:\Users\Admin\AppData\Roaming\Andrew Sampson\Borderless Gaming\Languages\de-DE.lang
Size 4KB
SHA256 e7acf08ad799dbf2435e191a9da1af2c4ab172d257076db006e7ea1ef8416651
MD5 8bcfbe1e4eb0c30990196862e5ea97f2
SHA1 2f24361dd03e5dce10348f08c0ebefb12e7c3560
SHA512 d4df3c2153e3ef5515ca206468168f2ca93462d92a69af5951fbc93a4a00b47b24a54b9e588f28295d713e131db2cedeca525d438f733029d05973362def8816
SSDEEP 96:IOXaXykfnNgEMpNeQosN4TNqbAfE+2oi6mFMn:7qZg7eQxWqW1fsFMn
TLSH
T1D2913112D06AB199EEA233133D069AD27B25D13AC774A512206DC15FFE8E4EBC2073E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.lang

Path C:\Users\Admin\AppData\Roaming\Andrew Sampson\Borderless Gaming\Languages\en-US.lang
Size 3KB
SHA256 a1f5ce1e90cfe59c6a27ef67a80fbf30f0bfe6d8d2c63538bfde345241bdf08a
MD5 35ead1f2272efaa8276cb46d7acbda82
SHA1 c667f3061d3e790f94cdd547f455c0849d57b302
SHA512 e6ca2252eaa87cecdc8823a3e9b213aadb5f2df26f52b7e553309068e89a2d82509f6a557801d509fcf06b88f287b7960122095e29e66dd5771667bb1f486d39
TLSH
T19D811165E039B166EC72A3635A43A7433B12C43DC3B5912708BD8608FE9D0E3D2432EA
MD5 SHA1 SHA512 TLSH

Submit Download

es-419.lang

Path C:\Users\Admin\AppData\Roaming\Andrew Sampson\Borderless Gaming\Languages\es-419.lang
Size 4KB
SHA256 dbfe6a31d3a0295a3c0f3ae0ca2273707a4abcaaf86f9d216c1bc29696feb988
MD5 4aab97285db61f3aef670e017c76bb27
SHA1 66ca85aa40170dd9103292ea659c042eca47495e
SHA512 fda80328f162391dd2fa3c82477c8ef06ffbac090e265c35877a84615d10d69dc9d537650adf02cc7c1859b14e297b785346aa01519a71e2ceceecdd6be87e25
SSDEEP 96:L2ENblJqnYfwPVRYv2sQTa9pOATGVlUfYhO16XMuzDf:7+ndu2sQTepihquzDf
TLSH
T1E0916626D1BCA1A6FD5263538B43E203FA60D03D9B7DC11314AD4A59BF8C9D6C043AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr-FR.lang

Path C:\Users\Admin\AppData\Roaming\Andrew Sampson\Borderless Gaming\Languages\fr-FR.lang
Size 4KB
SHA256 ce031da8649f37e331de10b5c4486b961f6b5992a3ec07f5740852f50bfda11f
MD5 fd3de12f9be56c06fe7c82ec1a59d5ad
SHA1 089d7553fdab3569f2348bcec2c8f7b9bd3245a9
SHA512 7179c1ff5c1cf4cad75c87eb9ca408da9195f5ea98a91d5e49297be0ddb047b865611cdd5ef949b5f59916a6135a14be976425c5f26c9253f47e2149c949ace2
SSDEEP 96:7n7fSHVQhI6LVlEQQtz+CVCX0Af9gPdv9fi0b:77eV2lEQQUJaPdvo8
TLSH
T186A13267E1B9B0E5ADD22327AD02D653FB60C43DD7B4C25048994606BF8C8EEE1833E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

it-IT.lang

Path C:\Users\Admin\AppData\Roaming\Andrew Sampson\Borderless Gaming\Languages\it-IT.lang
Size 4KB
SHA256 4a6b0c1c254a64f85c10333833ae46ee758595f512b586f214c1440be81e703e
MD5 7d92a9cb3d937e256216000c4d8fc5b4
SHA1 0a5ab843899acb533ac7201526d0ae3ce2698096
SHA512 08bd677416e6cf40fcb94ca38ac5302cfabc170b08eb04ce69a4a14351eb4052d999270ed1f7922b9a162dae4b2c913ef15c8de295c7e9eb4869f9ad11de80a8
SSDEEP 96:y03WjADv8d2AQHpBJ+hEjQBTS4aUxgUt4MAr5JLWMAOJ7Sr7t:yWWqqdapBYEjQB1PZt4d5JqMAISft
TLSH
T17AA16534E46CD095BCA613ABC54262037B61D86DBF7C901655B90308FF8E5A2E1B37FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ja-JP.lang

Path C:\Users\Admin\AppData\Roaming\Andrew Sampson\Borderless Gaming\Languages\ja-JP.lang
Size 5KB
SHA256 c60bd8e03161fbdf8ff7bfb0459696437308f486a51785a29f5bd4b812a3838f
MD5 6e4792ac4c7a858ea869e76806a700f2
SHA1 fd091c2dce2eac6c8a50b76f4e62466d9f0a4eb7
SHA512 056e1aec1f861ed0b82e497d07dacc5c247f494b1a7776567357f20b776fe8ab5419bc9e71b07cf14af1269b0f85e425ffd063eb69b57d3aeec46d345b956214
SSDEEP 96:U4e79cCKB2UDZsiarrILQgvusNmTjAsnt2/yOwM8+ESjsap1:Ut9UYr+QbPTL4yyESYap1
TLSH
T186B1DE2CA3E1A424ED3696B7188B718276928D3BEF717926002CE561BE980DFD1437F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko-KR.lang

Path C:\Users\Admin\AppData\Roaming\Andrew Sampson\Borderless Gaming\Languages\ko-KR.lang
Size 4KB
SHA256 ec3c8c9b84f6d262dd832007d0c7ad3a451e96f53479e89aec2dd577da703645
MD5 e48db0c67dad329d423950556c512eae
SHA1 d84b10e6bad7dc85fe417d83aa77623de39d9b3f
SHA512 d0d194492dc2d4ebdd2ba6ad08dce84894b6029ec9b541d78eef51085e168634e3c877a63367c8e2eb3d419bf574682174967a680ea30d1a1550b320b5216323
SSDEEP 96:b81rYnVaoNz0lGvVQHCDq2/iCARw1tOIOTJX21FlRf:iXlGdQHAq2/pwClt
TLSH
T159913260F8FFA4E8BC739A579D42630A3346963A737542314C584A88FD9C4E3C247AF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl-PL.lang

Path C:\Users\Admin\AppData\Roaming\Andrew Sampson\Borderless Gaming\Languages\pl-PL.lang
Size 4KB
SHA256 8b76894dcc0b69e3870929dafc6fb55beca47e1ef15fea932919e97bdf2b779a
MD5 823b1f1348bef3aa0c4b83d4114b28d7
SHA1 64a581ce00b70b3dc4521dd47965bbd9b83f5927
SHA512 db937d4e5886388e409500264c58016e65e798401c2b988aca75170298f3ad82a10284996c50bc1c3e4ee0495f6d8118ebed51c39371c3d0efbf86c848127a58
SSDEEP 96:fT4tP3T71vUzke5Zp/79yVYhiQx7vUpAVBpJhX+sTtp3HrK:fctP3T71vUzkg/ZwQxVBjtjTfHrK
TLSH
T104917319F0B5D15DFE750A3B98AA17527B16883EE779C952546D8440BECC0D7C2A33E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ru-RU.lang

Path C:\Users\Admin\AppData\Roaming\Andrew Sampson\Borderless Gaming\Languages\ru-RU.lang
Size 5KB
SHA256 e1f86499c27286e7268122a271a04a8028b99814c7388dcb77544af8fe4428a3
MD5 c25fe4be9ef227e5c15b499fc45166b5
SHA1 f5b37e26da43c71a3dd47165d42c954c88516476
SHA512 eb0e9f12e992755b6e0499ac9736fae2baac703c1870809c03e8b3fc3511af7404b939a88973f07ce94b6b344e41c4b699583d3968eab53e4ee3825c584bad0e
SSDEEP 96:fWntbrou7NYBofvfYdiHQumsQYWgqKakgAZ1sKYK2n0xE:Ontbp7yMHQuZQYEKakiLKYSE
TLSH
T122C1AF24D1AA70AB9901F92BCD056F097DB5807E3FBEA3160C641D7E3DFA071C22A795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sl-SI.lang

Path C:\Users\Admin\AppData\Roaming\Andrew Sampson\Borderless Gaming\Languages\sl-SI.lang
Size 4KB
SHA256 30a71a4c55dd725fce190a309e57c5f2af06c5d99cf7bdc823b85f81a4b98beb
MD5 9a6d6060f9231b3bc9b0c70fd81bf553
SHA1 9df033b7a6692dc4d54a3baad3beb359e84c5330
SHA512 22d894f57717e397d76e8913d25289e7b27c8bded3de03365ff9bab18bf885385cbf83528cb2281b0fb92eac92d170ad7342f41018581f61ffb5225851e94e37
SSDEEP 96:BC7wI3Vxp8QZTaGCLw4OnAE/NVEXqFBIhvbHrd:c1eQ1kL/2vS6Ihfd
TLSH
T1D6918421D07EDC84EE2263AF9A9303517F568C79D3358125786E024AFECC8E2C1936E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zh-CN.lang

Path C:\Users\Admin\AppData\Roaming\Andrew Sampson\Borderless Gaming\Languages\zh-CN.lang
Size 3KB
SHA256 d74ace4d47728ed53518b32403ec8b0b1f601bdab48e53976552ccc7bd3444ec
MD5 2972dd2505facc15ba9490a190f9657d
SHA1 42a4578d41cf97578d1542020edc523a7b0806c7
SHA512 7f96bed3110c8b3c4b8e3f10ce92040c14804f20da4929af1ea829897148fec3157e36183df4f281537682a37fd6da3411c02241678d55ae1bcdb0293176dd98
TLSH
T1AD81A774D47CADB9FE269377298503073F00A53AFB31A66144688609BDCC4DAE6437C9
MD5 SHA1 SHA512 TLSH

Submit Download

zh-TW.lang

Path C:\Users\Admin\AppData\Roaming\Andrew Sampson\Borderless Gaming\Languages\zh-TW.lang
Size 4KB
SHA256 0f1b829360e57a15e3a64d799a2ff2a9c1107ee9c64bcfd064a40b097df849a6
MD5 01800538136847bee7840172dc1d192d
SHA1 363290b5790bdc32fc88be72ef983e4913d2e5d5
SHA512 9c09cdc9b14736a85f3d9b3baab975a68c3631e9dd8ef3a37e93425b0c0e79ab16efd7983303724c979941deeb35ef4cc346162707a00a1aa55e9f46477c6f53
SSDEEP 96:xAO42L7mhUcNq6QerHO+kFA5didNeVjktNj6bm/RGllloG:Z42Hm+uQerDkyUjuBK/R2QG
TLSH
T1EA91645094B9982CFE62AE371B8603133B609579AB74A62100BE81D1BFCD8E7E1433D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.bin

Path C:\Users\Admin\AppData\Roaming\Andrew Sampson\Borderless Gaming\config.bin
Size 4B
SHA256 68b1415224acc0ed3af7254f1de675bde57e475cf8c89cb1beaccae9833649fc
MD5 8f29e676f6dbf42cd067b4876a989b97
SHA1 b70ec05b50c69b4b4b100e49ce98a061c8fb34a4
SHA512 a1f2c6a47ef88fc11aa14be2aacdd40b369f3beb4400dbbaead2d89f49c287a964785ad8962fed69b3a2aaeed928ed57a7fd28dbd661956ffe725067fe31e985
MD5 SHA1 SHA512

Submit Download

config.bin

Path C:\Users\Admin\AppData\Roaming\Andrew Sampson\Borderless Gaming\config.bin
Size 42B
SHA256 f7f0a60358ed2ddf8619eb1fa704a706d7a57432e1ed358657296f050f2aaa06
MD5 5d7bddbe197432e29fee391ca87ab99e
SHA1 2996e6e1840c89511ce2e49a497dc63cb9596aca
SHA512 13f69ee1e63c3b2470185a4732232ec94f67aaaffb641b44ed2944b39900414bd7daf4e8a45d22ecff02bf9d479e6abd3194ced91aca8d8ca69904c5acdaf8c5
MD5 SHA1 SHA512

Submit Download

memory/3584-95-0x0000000000FB0000-0x0000000001332000-memory.dmp

Download

memory/3584-131-0x0000000000FB0000-0x0000000001332000-memory.dmp

Download

memory/3584-5-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Download

memory/3584-9-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Download

memory/3584-8-0x0000000000FB0000-0x0000000001332000-memory.dmp

Download

memory/3844-125-0x0000000005330000-0x000000000537A000-memory.dmp

Download

memory/3844-111-0x0000000005410000-0x00000000059B4000-memory.dmp

Download

memory/3844-177-0x0000000006820000-0x0000000006876000-memory.dmp

Download

memory/3844-169-0x0000000005400000-0x000000000540A000-memory.dmp

Download

memory/3844-129-0x00000000053A0000-0x00000000053B2000-memory.dmp

Download

memory/3844-121-0x0000000005BB0000-0x0000000005BC0000-memory.dmp

Download

memory/3844-120-0x0000000005210000-0x0000000005224000-memory.dmp

Download

memory/3844-116-0x0000000005240000-0x00000000052D2000-memory.dmp

Download

memory/3844-115-0x0000000004DB0000-0x0000000004DCE000-memory.dmp

Download

memory/3844-128-0x0000000005320000-0x000000000532A000-memory.dmp

Download

memory/3844-110-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/3844-173-0x0000000005BB0000-0x0000000005BC0000-memory.dmp

Download

memory/3844-172-0x0000000005BB0000-0x0000000005BC0000-memory.dmp

Download

memory/3844-170-0x0000000005BB0000-0x0000000005BC0000-memory.dmp

Download

memory/4228-7-0x00000000004A0000-0x0000000000580000-memory.dmp

Download

memory/4228-0-0x00000000004A0000-0x0000000000580000-memory.dmp

Download

memory/4228-168-0x00000000004A0000-0x0000000000580000-memory.dmp

Download