URL:

https://g-meh.com/vst/win/plugins/purity

Full analysis: https://app.any.run/tasks/84e94673-ea25-4acd-8993-13323e54cd2d
Verdict: Malicious activity
Analysis date: January 30, 2024, 11:45:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

90B18538055589139441DAB0225DCD4E

SHA1:

9E3521DB9241F838729DBEE2DE046466413DDFCE

SHA256:

06B888D8C41A882D26091C9098DCA2E2555D5F3965763B89BC9E5B9F7A6C7B03

SSDEEP:

3:N83KKvS:2aH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Purity_Setup.exe (PID: 3720)
      • Purity_Setup.exe (PID: 2960)

    • Creates a writable file in the system directory

      • Purity_Setup.exe (PID: 3720)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • Purity_Setup.exe (PID: 3720)
      • Purity_Setup.exe (PID: 2960)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Purity_Setup.exe (PID: 3720)
      • Purity_Setup.exe (PID: 2960)

    • Executable content was dropped or overwritten

      • Purity_Setup.exe (PID: 3720)
      • Purity_Setup.exe (PID: 2960)

    • Process drops legitimate windows executable

      • Purity_Setup.exe (PID: 3720)

    • The process drops C-runtime libraries

      • Purity_Setup.exe (PID: 3720)

    • Searches for installed software

      • Purity_Setup.exe (PID: 2960)

    • Creates a software uninstall entry

      • Purity_Setup.exe (PID: 2960)

    • Reads the Internet Settings

      • Purity.exe (PID: 1992)

  • INFO

    • Manual execution by a user

      • WinRAR.exe (PID: 2912)
      • Purity_Setup.exe (PID: 3300)
      • Purity_Setup.exe (PID: 3720)
      • keygen.exe (PID: 3304)
      • Purity_Setup.exe (PID: 3940)
      • Purity_Setup.exe (PID: 2960)
      • keygen.exe (PID: 948)
      • keygen.exe (PID: 1540)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 2912)
      • iexplore.exe (PID: 1588)

    • Application launched itself

      • iexplore.exe (PID: 1588)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2912)

    • Checks supported languages

      • Purity_Setup.exe (PID: 3720)
      • Purity_Setup.exe (PID: 2960)
      • Purity.exe (PID: 1992)
      • keygen.exe (PID: 3304)
      • keygen.exe (PID: 948)
      • keygen.exe (PID: 1540)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2912)

    • Reads the computer name

      • Purity_Setup.exe (PID: 3720)
      • keygen.exe (PID: 3304)
      • Purity.exe (PID: 1992)
      • Purity_Setup.exe (PID: 2960)
      • keygen.exe (PID: 1540)
      • keygen.exe (PID: 948)

    • Create files in a temporary directory

      • Purity_Setup.exe (PID: 3720)
      • Purity_Setup.exe (PID: 2960)
      • Purity.exe (PID: 1992)

    • Creates files in the program directory

      • Purity_Setup.exe (PID: 3720)
      • Purity.exe (PID: 1992)

    • Reads the machine GUID from the registry

      • Purity.exe (PID: 1992)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
12
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iexplore.exe winrar.exe purity_setup.exe no specs purity_setup.exe keygen.exe no specs purity_setup.exe no specs purity_setup.exe purity.exe keygen.exe no specs keygen.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
896"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1588 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
948"C:\Users\admin\Downloads\Purity\keygen.exe" C:\Users\admin\Downloads\Purity\keygen.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\downloads\purity\keygen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winmm.dll
1540"C:\Users\admin\Downloads\Purity\keygen.exe" C:\Users\admin\Downloads\Purity\keygen.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\downloads\purity\keygen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winmm.dll
1588"C:\Program Files\Internet Explorer\iexplore.exe" "https://g-meh.com/vst/win/plugins/purity"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1992"C:\Program Files\LUXONIX\Purity\Purity.exe"C:\Program Files\LUXONIX\Purity\Purity.exe
Purity_Setup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\luxonix\purity\purity.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2912"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Downloads\Purity.zip" C:\Users\admin\Downloads\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2960"C:\Users\admin\Downloads\Purity\Purity_Setup.exe" C:\Users\admin\Downloads\Purity\Purity_Setup.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\downloads\purity\purity_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3300"C:\Users\admin\Downloads\Purity\Purity_Setup.exe" C:\Users\admin\Downloads\Purity\Purity_Setup.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\downloads\purity\purity_setup.exe
c:\windows\system32\ntdll.dll
3304"C:\Users\admin\Downloads\Purity\keygen.exe" C:\Users\admin\Downloads\Purity\keygen.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\downloads\purity\keygen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winmm.dll
3600"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1588 CREDAT:3282193 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
26 057
Read events
25 926
Write events
125
Delete events
6

Modification events

(PID) Process:(1588) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(1588) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(1588) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(1588) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1588) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1588) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1588) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1588) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1588) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1588) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
14
Suspicious files
85
Text files
39
Unknown types
0

Dropped files

PID
Process
Filename
Type
896iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:02693FF04684714E627EADB0045D1B14
SHA256:98E765E88A26557A187A72FB8AA430BB71D38733A467D45213D50656DEDB364B
896iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\a40e717ea31d100f[1].csstext
MD5:BD86AD8D3FD3331E9449818E221E3F04
SHA256:465D35276B48C22C390FA32AD95192E88ED617F5241A2B6166B859745CA3CE30
896iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:DB62A7A6AAE68EFCD6966FDB66EF82F5
SHA256:91657A213267FBF98EE2659C5FEE9F088BCD35A3DDCFA0020D9BCC81B681F610
896iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\v84a3a4012de94ce1a686ba8c167c359c1696973893317[1].jstext
MD5:DD1D068FDB5FE90B6C05A5B3940E088C
SHA256:6153D13804862B0FC1C016CF1129F34CB7C6185F2CF4BF1A3A862EECDAB50101
896iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:2FB864475E132421F49F93A3C47D8E05
SHA256:9D41FB8AAF167F4BE387287F0F25301C1F1463C643CEAB32CE4A7731301F1302
896iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:211918A803C11AA41883B881D75566F8
SHA256:C90AA0A1DAF5259072521D322657F679E5830D361617C057FD2A617784A1E8FF
896iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\webpack-dee17c54abc13c2b[1].jstext
MD5:1DA0346C4D0DEBDAFC9C791217C8F6C2
SHA256:F4414190E749568CA4D229E22D462BE4C21513285ECE59358D9251522555FAE3
896iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\_buildManifest[1].jstext
MD5:B18DB52846888C39EAC91CF4CB9F860E
SHA256:753D4297013A828ABE228A8A01EBE88E96F120F1EF688F0F00A92F635F619A2B
896iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\framework-ce84985cd166733a[1].jstext
MD5:7139A33E17FAA89B1EA96AEB70592AD5
SHA256:21E67844BD44AF52119DE8C22C866E82CBC0C8E38A3ED317EFB1C418422B6D4A
896iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\polyfills-c67a75d1b6f99dc8[1].jstext
MD5:837C0DF77FD5009C9E46D446188ECFD0
SHA256:0225EB034D024A03BDC90EA6C79F56193662E7C3EEE909696298820E517CBB83
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
38
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
896
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d7a4c83e7f191cf0
unknown
—
—
—
896
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f324de6a56943962
unknown
—
—
—
896
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
—
896
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D
unknown
binary
724 b
—
896
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
unknown
binary
1.47 Kb
—
1588
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?95d95b669c097e41
unknown
—
—
—
1588
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5565915fab5f2bac
unknown
—
—
—
3600
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?b150b552b216e1f4
unknown
compressed
65.2 Kb
—
3600
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?fcbfea4cae399b90
unknown
compressed
65.2 Kb
—
3600
iexplore.exe
GET
200
2.19.105.18:80
http://x1.c.lencr.org/
unknown
binary
717 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
896
iexplore.exe
104.21.73.4:443
g-meh.com
CLOUDFLARENET
—
unknown
896
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
unknown
896
iexplore.exe
142.250.74.195:80
ocsp.pki.goog
GOOGLE
US
unknown
896
iexplore.exe
104.16.56.101:443
static.cloudflareinsights.com
CLOUDFLARENET
—
unknown
896
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1588
iexplore.exe
104.21.73.4:443
g-meh.com
CLOUDFLARENET
—
unknown
1588
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
unknown

DNS requests

Domain
IP
Reputation
g-meh.com
  • 104.21.73.4
  • 172.67.156.6
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
unknown
ocsp.pki.goog
  • 142.250.74.195
unknown
static.cloudflareinsights.com
  • 104.16.56.101
  • 104.16.57.101
unknown
ocsp.digicert.com
  • 192.229.221.95
unknown
b2.gangsloni.com
  • 104.21.45.158
  • 172.67.216.105
unknown
x1.c.lencr.org
  • 2.19.105.18
unknown
x2.c.lencr.org
  • 2.18.97.144
unknown
api.bing.com
  • 13.107.5.80
unknown
www.bing.com
  • 2.19.96.98
  • 2.19.96.81
  • 2.19.96.73
  • 2.19.96.80
  • 2.19.96.113
  • 2.19.96.82
  • 2.19.96.91
  • 2.19.96.120
  • 2.19.96.75
unknown

Threats

No threats detected
Process
Message
Purity.exe
- initialize options
Purity.exe
[ERROR] failed to read option (C:\Program Files\LUXONIX\Purity\Purity.ini)
Purity.exe
- VST:LUXONIX:Purity:version 1.2.5.2
Purity.exe
- Plug-in Path: C:\Program Files\LUXONIX\Purity\Purity.dll
Purity.exe
- VST:LUXONIX:Purity:Path(Appl): C:\Program Files\LUXONIX\Purity\
Purity.exe
- Total 588 Wavetables (Melody 299, Drum 289)
Purity.exe
- Total 1322 Samples (Loop 1022, 1shot 300)
Purity.exe
- Total 1366 Patches (Combi 345, Single 1021)
Purity.exe
[2024/01/30 11:49:54] [ERROR] Serial Number or Authorization Code is not correct. - Please re-enter them carefully.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://g-meh.com/vst/win/plugins/purity