cdd7ed9d16efb04803cea00156bd2a8b9f616ef2b6af16d9760867a1336d0c96

Analysis

user interaction
yes
max time kernel
36s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/10/2026, 17:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SentinelClient-free-1.0.3.exe
Size 48.3MB
Sample261022-vxbf3sswfx
SHA256 cdd7ed9d16efb04803cea00156bd2a8b9f616ef2b6af16d9760867a1336d0c96
MD5 e7f09d675104fd14de0665758c6b777d
SHA1 7f2679a8dc531cf97f682e223678c52f74efeb03
SHA512 44598df6bf1033b7dfeb5cac432f9a952cfb64c86cfd78065d9e541c81a1863126b9b1b765424a18b6acc0dbbfbaef9c861985c2d36fd4edfe0383d34e73effd
SSDEEP 786432:ytPRadD/ehi36Pww7OJ3bNTP1Xvy+qYupgNlwZBfRlsxtyhaou3bZxZPmk8d2:IRW/ehiGwwQNBftP5aBfoLytu31j8d2
TLSH
T19BB7333FA5CFA13AE15F4A377976A640C63B7BA1A6518C4786E4C44C8F164B02D3E783
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1964	SentinelClient-free-1.0.3.tmp
4516	SentinelLauncher.exe
4928	SentinelLauncher.exe

Loads dropped DLL 6 IoCs

pid	Process
4516	SentinelLauncher.exe
4516	SentinelLauncher.exe
4516	SentinelLauncher.exe
4928	SentinelLauncher.exe
4928	SentinelLauncher.exe
4928	SentinelLauncher.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Sentinel Launcher\SentinelLauncher.exe	SentinelClient-free-1.0.3.tmp
File created	C:\Program Files\Sentinel Launcher\unins000.dat	SentinelClient-free-1.0.3.tmp
File created	C:\Program Files\Sentinel Launcher\is-QI0ZBJJUUJ.tmp	SentinelClient-free-1.0.3.tmp
File created	C:\Program Files\Sentinel Launcher\is-YCWNG4YT4S.tmp	SentinelClient-free-1.0.3.tmp
File created	C:\Program Files\Sentinel Launcher\licenses\is-TSDJXEYCY7.tmp	SentinelClient-free-1.0.3.tmp
File created	C:\Program Files\Sentinel Launcher\licenses\is-72ZF0J8VYN.tmp	SentinelClient-free-1.0.3.tmp
File created	C:\Program Files\Sentinel Launcher\licenses\is-JYHXRG9NDQ.tmp	SentinelClient-free-1.0.3.tmp
File opened for modification	C:\Program Files\Sentinel Launcher\unins000.dat	SentinelClient-free-1.0.3.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SentinelLauncher.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SentinelLauncher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SentinelClient-free-1.0.3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SentinelClient-free-1.0.3.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/2168-0-0x00000000002C0000-0x00000000003AD000-memory.dmp	innosetup
behavioral1/memory/2168-7-0x00000000002C0000-0x00000000003AD000-memory.dmp	innosetup
behavioral1/memory/2168-53-0x00000000002C0000-0x00000000003AD000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1964	SentinelClient-free-1.0.3.tmp
1964	SentinelClient-free-1.0.3.tmp

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4516	SentinelLauncher.exe
Token: SeDebugPrivilege	4928	SentinelLauncher.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1964	SentinelClient-free-1.0.3.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4928	SentinelLauncher.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1964	2168	SentinelClient-free-1.0.3.exe	84
PID 1964 wrote to memory of 4516	1964	SentinelClient-free-1.0.3.tmp	93

C:\Users\Admin\AppData\Local\Temp\SentinelClient-free-1.0.3.exe
"C:\Users\Admin\AppData\Local\Temp\SentinelClient-free-1.0.3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Users\Admin\AppData\Local\Temp\is-ORNO5MUHYK.tmp\SentinelClient-free-1.0.3.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-ORNO5MUHYK.tmp\SentinelClient-free-1.0.3.tmp" /SL5="$60112,49404360,910336,C:\Users\Admin\AppData\Local\Temp\SentinelClient-free-1.0.3.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Program Files\Sentinel Launcher\SentinelLauncher.exe
    "C:\Program Files\Sentinel Launcher\SentinelLauncher.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:4516

C:\Program Files\Sentinel Launcher\SentinelLauncher.exe
"C:\Program Files\Sentinel Launcher\SentinelLauncher.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4928
- C:\ProgramData\Sentinel\runtime\bc16d5febe3a026e9a98c7019d03ceb5aa94169019f3ee91f2c65d0265e00050\SentinelLoader.exe
  "C:\ProgramData\Sentinel\runtime\bc16d5febe3a026e9a98c7019d03ceb5aa94169019f3ee91f2c65d0265e00050\SentinelLoader.exe" --auth-only --ipc SentinelLauncher_e83733255e3f4a2c9c3e4c5f6afef7d6
  2⤵
  PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/oauth2/authorize?client_id=1542996597305245817&redirect_uri=https%3A%2F%2Fapi.sentinelgtag.com%2Fapi%2Fdiscord%2Fcallback&response_type=code&scope=identify+guilds.members.read&prompt=consent&code_challenge_method=S256&code_challenge=j99s16wUATPHUGetJwSTN-Q1341n8Gx654DcAMbVcBs&state=537c0a798d550388c0445a79fda30cdb
    3⤵
    PID:3164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discord.com/oauth2/authorize?client_id=1542996597305245817&redirect_uri=https%3A%2F%2Fapi.sentinelgtag.com%2Fapi%2Fdiscord%2Fcallback&response_type=code&scope=identify+guilds.members.read&prompt=consent&code_challenge_method=S256&code_challenge=j99s16wUATPHUGetJwSTN-Q1341n8Gx654DcAMbVcBs&state=537c0a798d550388c0445a79fda30cdb
      4⤵
      PID:5056
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2b0,0x7fff4f3bc188,0x7fff4f3bc194,0x7fff4f3bc1a0
        5⤵
        
        PID:456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,15536161330924621204,1598884628928192414,524288 --field-trial-handle=2344,i,13808440013528920719,13919619170328442025,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
        5⤵
        
        PID:1392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SentinelLoader.exe

Path C:\ProgramData\Sentinel\runtime\bc16d5febe3a026e9a98c7019d03ceb5aa94169019f3ee91f2c65d0265e00050\SentinelLoader.exe
Size 277KB
SHA256 6e7c02123b7c03c1201c607b093d14fa7f3757d6899c4c4f50922e1eca82728a
MD5 204e0d10125639bf56002c0e367f5dfe
SHA1 e7fd575319208097f77b2c17fe62c990fbb55aec
SHA512 6fcf50b8f7f29ecd1d19d17de527a1bcf6d50f8147c62b4905d199cf66005e49611f975aea4e0a73ec328f4544bc7cbcb1b2dd4a7694f80e3e0431bf414774f1
SSDEEP 6144:2KhhjNShB1bUytgvevnz0vIGTNPyDiVO0FuJY85u:3KB1tgvevgwCVCJf
TLSH
T162545D2AB6550D7CF1F6C178DD87C842E7727C89037299EF07D049A36D676E0AD3AA02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

D3DCompiler_47_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\SentinelLauncher\kzJqFM0mltbusRErgGtLORXeZ5IH_jM=\D3DCompiler_47_cor3.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationNative_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\SentinelLauncher\kzJqFM0mltbusRErgGtLORXeZ5IH_jM=\PresentationNative_cor3.dll
Size 1.2MB
SHA256 3fb36edaa2c4fe4ac8be075a3a4e903da159bbe38fb77e51c32b58e2adecb2d6
MD5 b43c09fd1eab8feb0d9d87e6eeb8fa95
SHA1 d8935765faf6e12d1d7f7e8b0f54f8e0f077a43c
SHA512 1432fefe98029f475c0a53e0c551dd917713da346e9b7d5ee5ee5314fb43072cfb24f95b4e2ceef2f67d7f01084d398428b075bf09812a9f90f510f0a40bdfc8
SSDEEP 24576:mhNpKcF6kPHmTw+MLYpX7T3hjnHFOcJqCPoG5MupGJvaCbztQcfRYQXLFGvHLPa7:mxKcdPHmMLYpX7T35/fPoGPpGFjztQcT
TLSH
T1F0453A22E2E642E5C47FC1B8C646972BFBB07449131C66CB87608B552F67FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpfgfx_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\SentinelLauncher\kzJqFM0mltbusRErgGtLORXeZ5IH_jM=\wpfgfx_cor3.dll
Size 1.9MB
SHA256 4b4fdbd1a77ac91a348d3d83a06bc103c6617fdd11445e327b7b6019bcfc1a6d
MD5 8d8bc2c0a836661c601330f9c184cec5
SHA1 58e6e5f72e5d51e0cde18f6c7bf296a5bb4d004d
SHA512 f27e64c6acce5727ce1cfcf3d3fe4ff600fe41643b7886ab1d117724e48d39253702bae381734588eb0d5756cddc73912f109a8d683d090c278075875ad6fa9e
SSDEEP 49152:CJBarecoR28GPaM6YqVim/oBiEyBhoci/H:0nlkRwiIoBi1BK/
TLSH
T13B955A46B6AC40E9C07AD33CDAD7961BF27174152761A3CF23A0479E6F27BD00A7A361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SentinelClient-free-1.0.3.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-ORNO5MUHYK.tmp\SentinelClient-free-1.0.3.tmp
Size 4.2MB
SHA256 08ccd664ebb6f2d6bbf4845e16dddd3e1dc20c7567e82388e5608f68d0c1963e
MD5 5818cb963042b723d31b598920c7cdd8
SHA1 8364d3c690e8b478c562d27cbfdcb2f0021a4978
SHA512 ee4b327c3be0e9a301f6859554f1b66b5cbdb56aab8c45c5f2d08e01a091ce9aae778e482134bd3546666465553bbac3c1be54f88f90c6f037adb3632f636b1b
SSDEEP 98304:o9SZUvl30aj90ZFcvdQ0hdgvminQLMj+JR333D:fItJj90Z6RgKwG
TLSH
T1C5168F03B388753EE4B71E3A883FA654583F7A213A26CD4B6BF4095C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1964-34-0x0000000000FB0000-0x00000000013F8000-memory.dmp

Download

memory/1964-8-0x0000000000FB0000-0x00000000013F8000-memory.dmp

Download

memory/1964-9-0x0000000001810000-0x0000000001811000-memory.dmp

Download

memory/1964-52-0x0000000000FB0000-0x00000000013F8000-memory.dmp

Download

memory/1964-5-0x0000000001810000-0x0000000001811000-memory.dmp

Download

memory/2168-0-0x00000000002C0000-0x00000000003AD000-memory.dmp

Download

memory/2168-53-0x00000000002C0000-0x00000000003AD000-memory.dmp

Download

memory/2168-7-0x00000000002C0000-0x00000000003AD000-memory.dmp

Download