hxxps://guidedhacking[.]com/resources/guided-hacking-dll-injector[.]4/

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
3s
max time network
11s
platform
windows10-2004_x64
resource
win10v2004-20260513-de
resource tags

arch:x64arch:x86image:win10v2004-20260513-delocale:de-deos:windows10-2004-x64systemwindows
submitted
02/08/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://guidedhacking.com/resources/guided-hacking-dll-injector.4/
Sample260802-wpsaasvset

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2936	firefox.exe
2936	firefox.exe
2936	firefox.exe
2936	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2936	firefox.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2936	1440	firefox.exe	85
PID 1440 wrote to memory of 2936	1440	firefox.exe	85
PID 2936 wrote to memory of 3456	2936	firefox.exe	86
PID 2936 wrote to memory of 3456	2936	firefox.exe	86
PID 2936 wrote to memory of 3456	2936	firefox.exe	86
PID 2936 wrote to memory of 3708	2936	firefox.exe	87
PID 2936 wrote to memory of 3708	2936	firefox.exe	87
PID 2936 wrote to memory of 3708	2936	firefox.exe	87
PID 2936 wrote to memory of 3708	2936	firefox.exe	87
PID 2936 wrote to memory of 4256	2936	firefox.exe	89
PID 2936 wrote to memory of 4256	2936	firefox.exe	89
PID 2936 wrote to memory of 4256	2936	firefox.exe	89
PID 2936 wrote to memory of 4256	2936	firefox.exe	89
PID 2936 wrote to memory of 1608	2936	firefox.exe	90
PID 2936 wrote to memory of 1608	2936	firefox.exe	90
PID 2936 wrote to memory of 1608	2936	firefox.exe	90

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://guidedhacking.com/resources/guided-hacking-dll-injector.4/"
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://guidedhacking.com/resources/guided-hacking-dll-injector.4/
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27099 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {2c96917c-8653-404c-8df0-cd11f6d7f963} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2544 -prefsLen 27135 -prefMapHandle 2548 -prefMapSize 270279 -ipcHandle 2400 -initialChannelId {d8288a56-05e1-4a63-8d9b-c620a69b4e6a} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3784 -prefsLen 25164 -prefMapHandle 3788 -prefMapSize 270279 -jsInitHandle 3792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3800 -initialChannelId {5c151c75-cf82-4979-8e42-471e98dd5297} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3944 -prefsLen 27276 -prefMapHandle 3948 -prefMapSize 270279 -ipcHandle 4016 -initialChannelId {33a28457-5d37-4113-958d-0b43ed7868bf} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2928 -prefsLen 34775 -prefMapHandle 3024 -prefMapSize 270279 -jsInitHandle 3160 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2920 -initialChannelId {7bb93a4d-c4b8-4ec5-9b62-2d3aa65d7661} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    PID:1320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2936 -prefsLen 35012 -prefMapHandle 4424 -prefMapSize 270279 -ipcHandle 4008 -initialChannelId {6ff9bd05-e019-4fb8-afb9-a7008a6880c0} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    PID:3720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5048 -prefsLen 32900 -prefMapHandle 5052 -prefMapSize 270279 -jsInitHandle 5056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4776 -initialChannelId {1e197edd-7bb6-4371-8678-a2a48f5a1dad} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    PID:3864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5144 -prefsLen 32952 -prefMapHandle 5148 -prefMapSize 270279 -jsInitHandle 5152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5132 -initialChannelId {7f1724ac-676a-4dd2-a195-82173d2d34a2} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    PID:2352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4004 -prefsLen 32952 -prefMapHandle 5156 -prefMapSize 270279 -jsInitHandle 5492 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5500 -initialChannelId {e57bfb00-9d89-4d19-9210-95d40d25df6d} -parentPid 2936 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2936" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    PID:1136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 8b34a00b51847fb8baf76d84e861759d2171eee8220d43ec469402f7ca76839a
MD5 c0b42c66e7cb754a8d76c7c26e94cf6d
SHA1 fe8819757058f0891a8f66d4484c5dd30ce0231a
SHA512 3578c93a5b9b8766f65f7e9affbcd69674b82d192f5e023c8651c552da39071755485b9ab472638135f15017a4015f8e6e835e4a6267f3f6c624780fad9893e6
TLSH
T10061DB58F229863FE445413ACC861B412F70B443A8AF3F2A34ACA04D1E5B3CE768D03D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 c24e1de44a9b9b98b4d6c347c5f81b3d7ab47810544375f48559bfb81a7312c6
MD5 4dd570f4f01aa0b967846a97d3e5c308
SHA1 e88d82a2dee225b30219838674eb6cb80c18a169
SHA512 77ca9f2538580d4113b5e774738eb28ee44948f7575fa2a89089ee88897d2a0ab091612ed6b695c71119030734e64f82640690036f90354894121ac89ab68cee
SSDEEP 96:HFO2F5FAF+F8/dd66JozGzgClKtmc0d/URFSdF95/7bkW60rcEmlyUR67WI:O1d66JozGzgCl6mc0dAOv5zbowbmlyjl
TLSH
T1EEC1FB68F628863BC449523BCCA60F410F72795B984E3F2931DC641D2C566DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 eccb3a001b387d5ff9f4ad78d3cb73a9f5e02104001fcd465ccbd778adbbeae5
MD5 a150db29df3c0fe1b7d888d9cee2a0cd
SHA1 dbe9642a3efb2e615a926cb460d103b1c68b91b7
SHA512 362bc3bec91c185ee007d8e44520f732ee92d4f22205ff514a70405a06e77e3f521e394993346bb43b0bfdf40cfae7c27600012fa0e6797a2c9d911f62956bd6
SSDEEP 192:O1d66JozGzgCl6mc0dyOv5zboPdZmlyjQlM:od66JozGzgC1jvbo1Zmlyj
TLSH
T1FAE12DA8E628823FC419527BCCA61F450F35399B984E3F2931DDA51C2D4B6DE368E07D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\events\events
Size 1KB
SHA256 417d17793bf06573f1189373f20c6b8c4ca028148a6687aa83836f350d91c525
MD5 4616371e0468d58b7a7b33c1ebe14983
SHA1 20ae81a7c591f3525ae958088f9219a7ff58c61d
SHA512 76822f5758687312532432c2d85bef2a2f0e7b7f3fdda9cc7b0b45ea2473a6c6f900a72e5507dfffe66d01ffab542fa484605daf845ae3e364c6fd9732f1ee2c
TLSH
T1AC11CC6C3DF84F2FA8C7E3ACB442128E57624E0B08871D074D02EE8DCE90AD93269439
MD5 SHA1 SHA512 TLSH

Submit Download

0a09be72-ff02-45c7-b0bd-de624fa17dd5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\0a09be72-ff02-45c7-b0bd-de624fa17dd5
Size 235B
SHA256 1a193e9c8556ec027dd6d62cbbb498b50f7399ccd42f1663d211f3c8328d4ea1
MD5 63bb6186e414e78a6a3805efadf3bae2
SHA1 808e7f6361a2c19ee637bd56d2c2343085e53e71
SHA512 72b0909eba27b0ae5f1554f8444fde17bb597ff4a71aef05f9c8f8b74714b0667790942eb53bdd764207b1238dc76868a5e184db0d518341f68a747d41fb7365
TLSH
T1F3D097846898631E09058F07B0F028C638488C3314A99860CA61067CEAF8DCC019181B
MD5 SHA1 SHA512 TLSH

Submit Download

34bb01f8-a95e-4d10-ac27-e867685a9716

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\34bb01f8-a95e-4d10-ac27-e867685a9716
Size 886B
SHA256 03a59a4d8d36a3d0f532ff990d2510e01fd71737d79b3871ba6a4985a770b3ce
MD5 3ba954724bdf57b4a1508fdd38d334ab
SHA1 eeb3c22bf0a0852958f5ce9fc7af72ef4be9f649
SHA512 212104d93d9109fbd5c848773d34b436c00b03a193fc3103b688346737c27bbb5c33b8faf9b9379c3e80756f26743418c2e1bd44afcdb771119470e2a5f1f409
TLSH
T1331140819674B5B28C6CE29B98953B4247E0B92380C619083D609B1C0DBE51E636710B
MD5 SHA1 SHA512 TLSH

Submit Download

38c438f8-6db1-4066-bf9a-8b8e589b0cd0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\38c438f8-6db1-4066-bf9a-8b8e589b0cd0
Size 883B
SHA256 77b2b8e7d0a999eb3360a1481987d7126710f0f8a4e831698960d284bddd2f8f
MD5 b3c63340249e9616524cae1e152b159b
SHA1 f3611f652b024a6f8acc76e5bc3fd3fe1c806bd5
SHA512 9b9274dce746a0d756bc920d5926e68ac1a1f0972b6b78f93d736d8d7b397cafeb3c381ef2a5494f97ecd465021d050ba4ba5c45a5a2954ef065ba6e9057c535
TLSH
T121110085A23475B3CDBCE29BC9553B064BE4BA2380C655183EA14A180D7991E936B207
MD5 SHA1 SHA512 TLSH

Submit Download

58fee142-6419-4581-8f93-e799838f1b25

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\58fee142-6419-4581-8f93-e799838f1b25
Size 235B
SHA256 2620261aa493a72610cc5480d6965961d3d2bc79adbf13d767d79881e52eb8c6
MD5 abdbd3261d9fdd80d61e0d65c9400153
SHA1 1d1b833528c5b5e66e0773e4760b43ae91b982cb
SHA512 5c921af2adba311eb580c69249b313585762adfd2e7261f7b50f2622d622a6048dff902bcfb2108ab382da236219fdf7925fc484b7baffa52694fc6f5e1a8039
TLSH
T1BCD023C424C823AD1C345F07F0F2ACD234444C3314709870DA61417C8DFCDC41221827
MD5 SHA1 SHA512 TLSH

Submit Download

97656c2b-e931-4120-8e1f-e6aec7e44065

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\97656c2b-e931-4120-8e1f-e6aec7e44065
Size 16KB
SHA256 8c29fdc649aa5e14f3c5db33a48411352e6717d13464129dbf9f1c673b14c6c7
MD5 56c99259755df8c0b815788fa8e67cf6
SHA1 d9223cd001ec5732838cf2b466ae3c53b999b9e1
SHA512 8acf31ba02c02de7aa573421bebeb572d63881ca6a84bbdecd2ed48f692f70e37f9c452e7ffb4186e7eb176e602bf34ad8734de0e0cc99e579cb3bc0c73b1182
SSDEEP 192:Mz3S8jcpi3uVL23yG/VXFgFIuAy+gsmuyMlRED3er/ZJtFP1/JOJ6ekO91iM10BO:M7S8jcpie2AHD3O/RFPlEoeFh106WOZj
TLSH
T14D72C856686045BA8251E368D8FC7FC3E6F528CF4C418FCADBE4BE0859DA06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b22a49c-55b9-4907-aa31-d3877458d6d5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\9b22a49c-55b9-4907-aa31-d3877458d6d5
Size 2KB
SHA256 75d8622550795f3399c9c34af4dc80ced6ecb84ea786c390d5cd1a2a8d55b8bd
MD5 6f32cb337793ed0d83144501e29748e9
SHA1 038b8ec24fedc94b91410b2428bead0eabe5292f
SHA512 342836a790c46408dfe573579cebda9b1360064ebf064373fcb2999587c6d03be213701e5dc6aa8b0f933fb01e0d608570c47370eedc51a90a94c1430ef06589
TLSH
T1D941115C35B85DB75CEBF19DD582238E47A48A0300C628436E52EF0C8D96A5E336E56F
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs-1.js
Size 6KB
SHA256 20c9887a3d12f508249ca128f84449bb6dcac71652f58a8da77178978741f882
MD5 1d15ebb09c2b768d4eae6113cc3c1d95
SHA1 a0ff3fd66b97419a548fce9495afa5f9f14fae93
SHA512 ddc7068d319a8e2b7fca79ae7cc8c69e57811ac0ff6f4d88fc573b00771f1c4e24136516c9d93bce1b4878b55492fd327115069fd581f77aa45ca69daae8eaeb
SSDEEP 96:xHBUTUxVqGq5fg1z1zSWSSlWdv9jHnqH/8MBw88n8L4cn+wGC:HyR5fg1zHSSrdBw88hC
TLSH
T1D9E11F789408CB7F64B677BCAC648C716AB2413B77BF68C610BA5484051CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs.js
Size 6KB
SHA256 a7bfc309ebdf20d400e024854d0a19a3425442f37a712e447d66fc22e5f77b03
MD5 3d9c04a2e77a58f4a410a5583ad9c583
SHA1 43df5784a922d126efe3362d806a5e77e15b3d12
SHA512 5ede9c5cb0944ccbed6b7f61a55fdeb17080ef6a4889cf493e83393cc95d8429239f7b63baa172c0f7bb8d891644d1c75718e7e46172d29a5905c9615604d25e
SSDEEP 96:xHBUTUxVqGq5fg9o1zSsWSSlWdv9jHnqH/8MBw88n8L4cn+wGC:HyR5fg9oeSSrdBw88hC
TLSH
T14CE120789408CB7F75B676ACAC648C715AB2413B77BF68C710BA5484051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.5MB
SHA256 ade973791d4ea5823c5a1a8c4bbbe986c2c87a98aab539f6de2f23058eedb7fd
MD5 95378d1b6725e7e0e00041f3e82d2e38
SHA1 c7c6b26909927cf95a461b1dad60def9d78ea402
SHA512 8690e0fbbb14281e7c75910ea2b5038b47de91e609217abd70706c9f8d4740cda235491d7c4316585ad04bdd19d8e154f92a9573ba83d34aa6d213ceefbf9df3
SSDEEP 49152:+iwbkMngvZR+Uh3YdAifVQ9hJxHkdar5zRFN/:pwbkMngRMfVQ9hPHkdiV
TLSH
T1132639E820D1A257F3814073A64553EB21FFD00C6037DE484BA956E9A4B8CDF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads