| URL: | https://whatthingsweigh.com/ |
| Full analysis: | https://app.any.run/tasks/21c990cd-bc65-4774-8c77-766374c7f6e3 |
| Verdict: | Malicious activity |
| Analysis date: | August 09, 2025, 00:43:01 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 3006930E6C809D3DEDDCEC66FC1CF55B |
| SHA1: | 168EEC384AF407B7EAE0AB16DD43F355ADEE4BCE |
| SHA256: | 33299A0FB3FDDF51F36A96C3F03AF91211AF5ED8298C33F9826124C5AA75750F |
| SSDEEP: | 3:N8cERRN4MkR:2c4Rru |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 320 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4032 -prefsLen 39912 -prefMapHandle 4988 -prefMapSize 272997 -jsInitHandle 7692 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 11564 -initialChannelId {082067bc-462e-4e36-b108-87541eadbe5f} -parentPid 4700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4700" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 39 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 136.0 Modules
| |||||||||||||||
| 952 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7136 -prefsLen 39862 -prefMapHandle 7036 -prefMapSize 272997 -jsInitHandle 7436 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 8040 -initialChannelId {951f3b0f-f0e8-4f66-ad97-34ce68c253f2} -parentPid 4700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4700" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 136.0 Modules
| |||||||||||||||
| 1132 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3348 -prefsLen 31090 -prefMapHandle 3352 -prefMapSize 272997 -jsInitHandle 3356 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 3364 -initialChannelId {1611336a-affe-42e1-ba9a-df31fd841cae} -parentPid 4700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4700" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 136.0 Modules
| |||||||||||||||
| 1632 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6448 -prefsLen 45401 -prefMapHandle 6196 -prefMapSize 272997 -jsInitHandle 6188 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 6240 -initialChannelId {b9726916-5016-4e9b-ad6b-94531248e676} -parentPid 4700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4700" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 18 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 136.0 Modules
| |||||||||||||||
| 1668 | "C:\Program Files\Mozilla Firefox\firefox.exe" "https://whatthingsweigh.com/" | C:\Program Files\Mozilla Firefox\firefox.exe | — | explorer.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 136.0 Modules
| |||||||||||||||
| 2200 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2232 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250227124745 -sandboxingKind 1 -prefsHandle 5208 -prefsLen 45080 -prefMapHandle 3960 -prefMapSize 272997 -ipcHandle 5228 -initialChannelId {1726bb58-9c59-4b30-b136-2c7a9cf51e3a} -parentPid 4700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4700" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 utility | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 136.0 Modules
| |||||||||||||||
| 2428 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1048 -prefsLen 39708 -prefMapHandle 5332 -prefMapSize 272997 -jsInitHandle 4012 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 2872 -initialChannelId {f5237dcd-7b53-4685-8dfb-8a79d3ea1035} -parentPid 4700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4700" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 136.0 Modules
| |||||||||||||||
| 3636 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250227124745 -prefsHandle 1896 -prefsLen 36520 -prefMapHandle 1900 -prefMapSize 272997 -ipcHandle 1860 -initialChannelId {6410dee0-7d15-48cb-b492-6fb4338c8231} -parentPid 4700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4700" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 136.0 Modules
| |||||||||||||||
| 4700 | "C:\Program Files\Mozilla Firefox\firefox.exe" https://whatthingsweigh.com/ | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 136.0 Modules
| |||||||||||||||
| (PID) Process: | (4700) firefox.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: 0 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4700 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite | — | |
MD5:— | SHA256:— | |||
| 4700 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.bin | binary | |
MD5:3134ED3F12E4F4F8643DB90043B0FD7B | SHA256:26E4F122034D7A03F6DA0E707799B09CBEEBDAF8D7A3133A1F7BD894AC72EEA1 | |||
| 4700 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs.js | text | |
MD5:2FD670934FEF0C60E2119BD874AAF470 | SHA256:771A7C83CA015BDBC6AB86A7BD9B1D54E40062E28942D311A9178A0FE6433CF2 | |||
| 4700 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.json | binary | |
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A | SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA | |||
| 4700 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\protections.sqlite-journal | binary | |
MD5:5AAF4B2E27B77206D441124376F2D0F2 | SHA256:66F8B38E7DF63CE7AFCA3C370F1E6D2EBE96ACB02BCE896C677001CBF3A990D5 | |||
| 4700 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\safebrowsing-updating\ads-track-digest256.sbstore | — | |
MD5:— | SHA256:— | |||
| 4700 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\datareporting\glean\db\data.safe.tmp | binary | |
MD5:B83B5E168B2FA2C3E4691069606540B3 | SHA256:F426B7858ACE862FA123FAE606D4DE796B78AD6C153F70ED26696546EB9F4E85 | |||
| 4700 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\datareporting\glean\db\data.safe.bin | binary | |
MD5:B83B5E168B2FA2C3E4691069606540B3 | SHA256:F426B7858ACE862FA123FAE606D4DE796B78AD6C153F70ED26696546EB9F4E85 | |||
| 4700 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\activity-stream.contile.json.tmp | binary | |
MD5:A3E5E7692F12A9883368EBFD573400F9 | SHA256:D3A8469B69968F62C07B194D782557DB48012FA72AD51388B7CE549BAB98E897 | |||
| 4700 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\safebrowsing-updating\analytics-track-digest256.sbstore | — | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4700 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | unknown | — | — | whitelisted |
4700 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | unknown | — | — | whitelisted |
4700 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | unknown | — | — | whitelisted |
4700 | firefox.exe | POST | 200 | 216.58.206.35:80 | http://o.pki.goog/s/wr3/k58 | unknown | — | — | whitelisted |
4700 | firefox.exe | POST | 200 | 216.58.206.35:80 | http://o.pki.goog/we2 | unknown | — | — | whitelisted |
4700 | firefox.exe | POST | 200 | 216.58.206.35:80 | http://o.pki.goog/s/wr3/azY | unknown | — | — | whitelisted |
4700 | firefox.exe | POST | 200 | 216.58.206.35:80 | http://o.pki.goog/s/wr3/azY | unknown | — | — | whitelisted |
4700 | firefox.exe | POST | 200 | 216.58.206.35:80 | http://o.pki.goog/s/wr3/azY | unknown | — | — | whitelisted |
4700 | firefox.exe | POST | 200 | 216.58.206.35:80 | http://o.pki.goog/we2 | unknown | — | — | whitelisted |
4700 | firefox.exe | POST | 200 | 184.30.131.245:80 | http://status.thawte.com/ | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
5944 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1268 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3876 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4700 | firefox.exe | 34.160.144.191:443 | content-signature-2.cdn.mozilla.net | GOOGLE | US | whitelisted |
4700 | firefox.exe | 172.233.219.78:443 | whatthingsweigh.com | Akamai International B.V. | US | unknown |
4700 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | GOOGLE | US | whitelisted |
4700 | firefox.exe | 34.36.137.203:443 | contile.services.mozilla.com | GOOGLE-CLOUD-PLATFORM | US | whitelisted |
4700 | firefox.exe | 216.58.206.35:80 | o.pki.goog | GOOGLE | US | whitelisted |
4700 | firefox.exe | 34.149.100.209:443 | firefox.settings.services.mozilla.com | GOOGLE | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
content-signature-2.cdn.mozilla.net |
| whitelisted |
content-signature-chains.prod.autograph.services.mozaws.net |
| whitelisted |
whatthingsweigh.com |
| unknown |
detectportal.firefox.com |
| whitelisted |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
contile.services.mozilla.com |
| whitelisted |
spocs.getpocket.com |
| whitelisted |
mc.prod.ads.prod.webservices.mozgcp.net |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
— | — | Misc activity | ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M1 |
— | — | Misc activity | ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M2 |
— | — | Misc activity | ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M3 |
— | — | Unknown Traffic | ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW) |
2200 | svchost.exe | Misc activity | ET INFO CMS Hosting Domain in DNS Lookup (storyblok .com) |
4700 | firefox.exe | Misc activity | ET INFO CMS Hosting Domain in TLS SNI (storyblok .com) |
2200 | svchost.exe | Misc activity | ET INFO CMS Hosting Domain in DNS Lookup (storyblok .com) |
2200 | svchost.exe | Not Suspicious Traffic | INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com) |
2200 | svchost.exe | Misc activity | ET INFO CMS Hosting Domain in DNS Lookup (storyblok .com) |
4700 | firefox.exe | Misc activity | ET INFO CMS Hosting Domain in TLS SNI (storyblok .com) |