File name:

MANWOLVES - These Days.mp3

Full analysis: https://app.any.run/tasks/fe3f13e0-0614-4459-83bb-0f70c7357d74
Verdict: No threats detected
Analysis date: December 29, 2018, 22:39:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: audio/mpeg
File info: Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 192 kbps, 44.1 kHz, Stereo
MD5:

32E275B5329F1E25F3DCD7C53376EA04

SHA1:

2B232D5C4404B5FB4A91909539A270D655DCDC1E

SHA256:

E9F8A16B3DD9FEBF66244A43F638E09CE7276CE81A955EE6B8DF375CB15ACBBC

SSDEEP:

98304:6rlMkLavGUWmp4QHOViW59pn2F4w/noG7GWVS6hp7zxJHIUPQ6m9SO9nIooxQ7YJ:6pMmavhgiWD1Wo4NdzjQSO9nVE+6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Creates files in the user directory

      • vlc.exe (PID: 3120)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.mp3 | LAME encoded MP3 audio (ID3 v2.x tag) (62.5)
.mp3 | MP3 audio (ID3 v2.x tag) (37.5)

EXIF

MPEG

MPEGAudioVersion: 1
AudioLayer: 3
AudioBitrate: 192 kbps
SampleRate: 44100
ChannelMode: Stereo
MSStereo: Off
IntensityStereo: Off
CopyrightFlag: -
OriginalMedia: -
Emphasis: None

ID3

UserDefinedText: (compatible_brands) isommp42
EncoderSettings: Lavf57.56.101

Composite

Duration: 0:03:59 (approx)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start vlc.exe sndvol.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2732SndVol.exe -f 45876384 4901C:\Windows\system32\SndVol.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Volume Mixer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sndvol.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
3120"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\admin\AppData\Local\Temp\MANWOLVES - These Days.mp3"C:\Program Files\VideoLAN\VLC\vlc.exe
explorer.exe
User:
admin
Company:
VideoLAN
Integrity Level:
MEDIUM
Description:
VLC media player
Exit code:
0
Version:
2.2.6
Modules
Images
c:\program files\videolan\vlc\vlc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\videolan\vlc\libvlc.dll
c:\program files\videolan\vlc\libvlccore.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
365
Read events
365
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
3120vlc.exeC:\Users\admin\AppData\Local\Temp\VLCA83C.tmp —
MD5:—
SHA256:—
3120vlc.exeC:\Users\admin\AppData\Local\Temp\VLCA9C4.tmp —
MD5:—
SHA256:—
3120vlc.exeC:\Users\admin\AppData\Local\Temp\VLCA9C5.tmp —
MD5:—
SHA256:—
3120vlc.exeC:\Users\admin\AppData\Local\Temp\VLCA9C6.tmp —
MD5:—
SHA256:—
3120vlc.exeC:\Users\admin\AppData\Local\Temp\VLCA9C7.tmp —
MD5:—
SHA256:—
3120vlc.exeC:\Users\admin\AppData\Local\Temp\VLCA9C8.tmp —
MD5:—
SHA256:—
3120vlc.exeC:\Users\admin\AppData\Local\Temp\VLCA9D9.tmp —
MD5:—
SHA256:—
3120vlc.exeC:\Users\admin\AppData\Local\Temp\VLCA9DA.tmp —
MD5:—
SHA256:—
3120vlc.exeC:\Users\admin\AppData\Local\Temp\VLCA9DB.tmp —
MD5:—
SHA256:—
3120vlc.exeC:\Users\admin\AppData\Local\Temp\VLCAA39.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
Process
Message
vlc.exe
core libvlc: one instance mode ENABLED
vlc.exe
core libvlc: Running vlc with the default interface. Use 'cvlc' to use vlc without interface.
vlc.exe
mpgatofixed32 audio converter error: libmad error: bad main_data_begin pointer
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MANWOLVES - These Days.mp3