URL:

https://demrush.pages.dev

Full analysis: https://app.any.run/tasks/e3336428-70e3-4ef8-bd0a-08528c81d62c
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: February 23, 2026, 17:25:15
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
discord
stealer
microstealer
Indicators:
MD5:

5F646AA9ED4713D8C505E63D969128C4

SHA1:

B436F6F8784502368D6E69DD65E47B3E471485BD

SHA256:

52D7971E18AA857597282991912CBDEE6219765F2203029F66C2BFCE81514122

SSDEEP:

3:N8Yqz2T:2YzT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 5200)

    • MICROSTEALER has been detected (SURICATA)

      • javaw.exe (PID: 7764)

    • Uses Task Scheduler to autorun other applications

      • javaw.exe (PID: 7764)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • DemrushSetup.exe (PID: 2036)

    • The process creates files with name similar to system file names

      • DemrushSetup.exe (PID: 2036)

    • Get information on the list of running processes

      • DemrushSetup.exe (PID: 2036)
      • cmd.exe (PID: 9096)
      • javaw.exe (PID: 7764)

    • Starts CMD.EXE for commands execution

      • GameForge.exe (PID: 4756)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 5200)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 5200)

    • Application launched itself

      • GameForge.exe (PID: 4756)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 8968)

    • The process hide an interactive prompt from the user

      • cmd.exe (PID: 5200)

    • Uses WMIC.EXE to obtain Windows Installer data

      • javaw.exe (PID: 7764)

    • Uses TASKKILL.EXE to kill process

      • javaw.exe (PID: 7764)

    • Uses TASKKILL.EXE to kill Browsers

      • javaw.exe (PID: 7764)

    • Creates scheduled task with highest privileges

      • schtasks.exe (PID: 5516)
      • schtasks.exe (PID: 7204)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 7312)

    • Drops script file

      • chrome.exe (PID: 7312)
      • GameForge.exe (PID: 4756)
      • powershell.exe (PID: 8968)

    • Reads the computer name

      • DemrushSetup.exe (PID: 2036)
      • GameForge.exe (PID: 4756)
      • GameForge.exe (PID: 3048)
      • GameForge.exe (PID: 3208)
      • javaw.exe (PID: 7764)

    • Manual execution by a user

      • DemrushSetup.exe (PID: 2036)
      • GameForge.exe (PID: 4756)

    • Checks supported languages

      • DemrushSetup.exe (PID: 2036)
      • GameForge.exe (PID: 4756)
      • GameForge.exe (PID: 3048)
      • GameForge.exe (PID: 3208)
      • GameForge.exe (PID: 1824)
      • javaw.exe (PID: 7764)

    • Create files in a temporary directory

      • DemrushSetup.exe (PID: 2036)
      • GameForge.exe (PID: 4756)
      • javaw.exe (PID: 7764)

    • Reads security settings of Internet Explorer

      • DemrushSetup.exe (PID: 2036)
      • WMIC.exe (PID: 4040)
      • WMIC.exe (PID: 6884)
      • WMIC.exe (PID: 7604)
      • WMIC.exe (PID: 9188)
      • WMIC.exe (PID: 772)

    • Creates files or folders in the user directory

      • DemrushSetup.exe (PID: 2036)
      • GameForge.exe (PID: 1824)
      • javaw.exe (PID: 7764)

    • Creates a software uninstall entry

      • DemrushSetup.exe (PID: 2036)

    • Process checks computer location settings

      • GameForge.exe (PID: 4756)
      • GameForge.exe (PID: 1824)

    • Reads Environment values

      • GameForge.exe (PID: 4756)
      • GameForge.exe (PID: 1824)

    • Reads product name

      • GameForge.exe (PID: 4756)
      • GameForge.exe (PID: 1824)

    • Reads the machine GUID from the registry

      • GameForge.exe (PID: 4756)
      • javaw.exe (PID: 7764)

    • The executable file from the user directory is run by the Powershell process

      • GameForge.exe (PID: 1824)

    • There is functionality for taking screenshot (YARA)

      • DemrushSetup.exe (PID: 2036)

    • Checks proxy server information

      • GameForge.exe (PID: 4756)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
225
Monitored processes
77
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs demrushsetup.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs gameforge.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs gameforge.exe no specs gameforge.exe no specs slui.exe no specs gameforge.exe #MICROSTEALER javaw.exe wmic.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs taskkill.exe no specs tasklist.exe no specs conhost.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs tasklist.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
772WMIC /Node:localhost /Namespace:\\root\CIMV2 Path Win32_ComputerSystemProduct Get UUID /Format:ListC:\Windows\System32\wbem\WMIC.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
1040tasklist.exeC:\Windows\System32\tasklist.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1172\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1340\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1692\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1824"C:\Users\admin\AppData\Local\Programs\GameForge\GameForge.exe" --r7u2 C:\Users\admin\AppData\Local\Programs\GameForge\GameForge.exe
powershell.exe
User:
admin
Company:
GameForge Studios
Integrity Level:
HIGH
Description:
GameForge
Exit code:
0
Version:
2.0.0
Modules
Images
c:\users\admin\appdata\local\programs\gameforge\gameforge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1868"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --field-trial-handle=4832,i,11805659698087136225,2424860646427030869,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=4848 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1872taskkill /F /IM vivaldi.exe /TC:\Windows\System32\taskkill.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2036"C:\Users\admin\Downloads\DemrushSetup.exe" C:\Users\admin\Downloads\DemrushSetup.exe—explorer.exe
User:
admin
Company:
GameForge Studios
Integrity Level:
MEDIUM
Description:
GameForge - Next Generation Desktop Gaming Platform
Exit code:
0
Version:
2.0.0
Modules
Images
c:\users\admin\downloads\demrushsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2280"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --field-trial-handle=5360,i,11805659698087136225,2424860646427030869,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20251218-201203.402000 --mojo-platform-channel-handle=5676 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
9 143
Read events
9 130
Write events
13
Delete events
0

Modification events

(PID) Process:(2036) DemrushSetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1eef940d-2184-5266-bff6-aed88f0cfc7c
Operation:writeName:DisplayIcon
Value:
C:\Users\admin\AppData\Local\Programs\GameForge\GameForge.exe,0
(PID) Process:(2036) DemrushSetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1eef940d-2184-5266-bff6-aed88f0cfc7c
Operation:writeName:Publisher
Value:
GameForge Studios
(PID) Process:(2036) DemrushSetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1eef940d-2184-5266-bff6-aed88f0cfc7c
Operation:writeName:NoModify
Value:
1
(PID) Process:(2036) DemrushSetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1eef940d-2184-5266-bff6-aed88f0cfc7c
Operation:writeName:NoRepair
Value:
1
(PID) Process:(2036) DemrushSetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1eef940d-2184-5266-bff6-aed88f0cfc7c
Operation:writeName:EstimatedSize
Value:
372850
(PID) Process:(2036) DemrushSetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\1eef940d-2184-5266-bff6-aed88f0cfc7c
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Local\Programs\GameForge
(PID) Process:(2036) DemrushSetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\1eef940d-2184-5266-bff6-aed88f0cfc7c
Operation:writeName:KeepShortcuts
Value:
true
(PID) Process:(2036) DemrushSetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\1eef940d-2184-5266-bff6-aed88f0cfc7c
Operation:writeName:ShortcutName
Value:
GameForge
(PID) Process:(2036) DemrushSetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1eef940d-2184-5266-bff6-aed88f0cfc7c
Operation:writeName:DisplayName
Value:
GameForge 2.0.0
(PID) Process:(2036) DemrushSetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1eef940d-2184-5266-bff6-aed88f0cfc7c
Operation:writeName:UninstallString
Value:
"C:\Users\admin\AppData\Local\Programs\GameForge\Uninstall GameForge.exe" /currentuser
Executable files
0
Suspicious files
23
Text files
14
Unknown types
406

Dropped files

PID
Process
Filename
Type
7312chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\LOG.old~RF1e538c.TMP —
MD5:—
SHA256:—
7312chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\LOG.old —
MD5:—
SHA256:—
7312chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF1e538c.TMP —
MD5:—
SHA256:—
7312chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\LOG.old~RF1e538c.TMP —
MD5:—
SHA256:—
7312chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\LOG.old —
MD5:—
SHA256:—
7312chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
7312chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF1e538c.TMP —
MD5:—
SHA256:—
7312chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF1e539c.TMP —
MD5:—
SHA256:—
7312chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
7312chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF1e539c.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
38
TCP/UDP connections
57
DNS requests
54
Threats
29

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7944
chrome.exe
GET
200
142.251.143.99:443
https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=133
unknown
—
86.4 Kb
whitelisted
7944
chrome.exe
GET
200
142.250.201.78:80
http://clients2.google.com/time/1/current?cup2key=8:cOeIaLrXU6AS6aXR-psfNEsKOwKWXXt7j3iQ2eBnR9s&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
7944
chrome.exe
GET
200
142.251.208.170:443
https://safebrowsingohttpgateway.googleapis.com/v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE
unknown
—
41 b
whitelisted
7944
chrome.exe
POST
200
142.251.127.84:443
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
unknown
binary
17 b
whitelisted
7944
chrome.exe
GET
200
172.66.44.99:443
https://demrush.pages.dev/
unknown
binary
18.8 Kb
unknown
7944
chrome.exe
GET
200
172.66.44.99:443
https://demrush.pages.dev/src/script.js
unknown
binary
18.8 Kb
unknown
7944
chrome.exe
GET
200
172.66.44.99:443
https://demrush.pages.dev/src/styles/style.css
unknown
binary
42.2 Kb
unknown
7944
chrome.exe
GET
200
172.66.44.99:443
https://demrush.pages.dev/public/images/screenshot2.png
unknown
binary
3.03 Mb
unknown
7944
chrome.exe
GET
200
172.66.44.99:443
https://demrush.pages.dev/public/images/wallpaper.png
unknown
binary
3.53 Mb
unknown
7944
chrome.exe
GET
200
172.66.44.99:443
https://demrush.pages.dev/public/images/screenshot3.png
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
7588
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
8736
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3412
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7944
chrome.exe
142.251.208.170:443
safebrowsingohttpgateway.googleapis.com
GOOGLE
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
7944
chrome.exe
142.250.201.78:80
clients2.google.com
GOOGLE
US
whitelisted
7944
chrome.exe
142.251.143.99:443
clientservices.googleapis.com
GOOGLE
US
whitelisted
7944
chrome.exe
142.251.127.84:443
accounts.google.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
self.events.data.microsoft.com
  • 104.46.162.224
whitelisted
google.com
  • 216.58.206.46
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
clients2.google.com
  • 142.250.201.78
whitelisted
safebrowsingohttpgateway.googleapis.com
  • 142.251.208.170
  • 216.58.206.74
  • 142.251.140.170
  • 142.251.141.138
  • 216.58.206.42
  • 142.250.201.170
  • 142.251.37.10
  • 172.217.16.202
  • 142.251.127.95
  • 172.217.168.74
  • 142.251.36.106
  • 172.217.20.138
  • 172.217.16.170
  • 142.251.208.10
  • 142.251.143.106
  • 142.251.141.106
whitelisted
clientservices.googleapis.com
  • 142.251.143.99
whitelisted
demrush.pages.dev
  • 172.66.44.99
  • 172.66.47.157
unknown
accounts.google.com
  • 142.251.127.84
whitelisted
fonts.googleapis.com
  • 172.217.16.202
whitelisted
fonts.gstatic.com
  • 142.250.187.227
whitelisted

Threats

PID
Process
Class
Message
7944
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Pages platform for frontend developers to collaborate and deploy websites (pages .dev)
7944
chrome.exe
Misc activity
ET INFO DNS Query to Cloudflare Page Developer Domain (pages .dev)
7944
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Pages platform for frontend developers to collaborate and deploy websites (pages .dev)
7944
chrome.exe
Misc activity
ET INFO Observed Cloudflare Page Developer Domain (pages .dev in TLS SNI)
7944
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Pages platform for frontend developers to collaborate and deploy websites (pages .dev)
7944
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Pages platform for frontend developers to collaborate and deploy websites (pages .dev)
7944
chrome.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
7944
chrome.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain (ipapi .co in DNS lookup)
7944
chrome.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
7944
chrome.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://demrush.pages.dev