Find similar analyses in TI Lookup
Analysis date (UTC): 14 July 2025, 17:19Analysis environment: Windows 10 Pro, build 19044, x64

https://archive.ph/

MD5:7BA253860656D13ACC634CCAE672673E
SHA1:0D5B0A4EA5A2C83D32E8A84E5A17BC1C38EB82B2
SHA256:37F64996CBADE0479D36D5D1AEE34574E5AC66CA4B4C28E58BA1A44286917EB3

Analysis result

Threat level:Malicious activity
Full analysis:Analysis https://archive.ph/ Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

No malicious indicators.

SUSPICIOUS

No suspicious indicators.

INFO

Checks proxy server information

  • slui.exe (PID: 7136)

Reads the computer name

  • identity_helper.exe (PID: 7412)

Checks supported languages

  • identity_helper.exe (PID: 7412)

Application launched itself

  • msedge.exe (PID: 5480)

Reads Environment values

  • identity_helper.exe (PID: 7412)

Reads the software policy settings

  • slui.exe (PID: 7136)

Threats

PIDProcessClassMessage
4040msedge.exePotentially Bad TrafficET INFO Observed Abused Website Archival Domain in DNS Lookup (archive .ph)
4040msedge.exePotentially Bad TrafficET INFO Observed Abused Website Archival Domain in DNS Lookup (archive .ph)
4040msedge.exePotentially Bad TrafficET INFO Observed Abused Website Archival Domain (archive .ph in TLS SNI)
4040msedge.exePotentially Bad TrafficET INFO Observed Abused Website Archival Domain (archive .ph in TLS SNI)
4040msedge.exePotentially Bad TrafficET INFO Observed Abused Website Archival Domain (archive .ph in TLS SNI)
4040msedge.exePotentially Bad TrafficET INFO Observed Abused Website Archival Domain (archive .ph in TLS SNI)
4040msedge.exePotentially Bad TrafficET INFO Observed Abused Website Archival Domain (archive .ph in TLS SNI)
4040msedge.exePotentially Bad TrafficET INFO Observed Abused Website Archival Domain in DNS Lookup (archive .ph)
4040msedge.exePotentially Bad TrafficET INFO Observed Abused Website Archival Domain in DNS Lookup (archive .ph)
4040msedge.exePotentially Bad TrafficET INFO Observed Abused Website Archival Domain (archive .ph in TLS SNI)

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN

© 2017-2026 ANY.RUN LLC. ALL RIGHTS RESERVED