File scan report
Verdict Safe
Is Nemu
Only 2 of the 70 antivirus engines that checked it raised PUA-style labels, while the verified NetEase signature, clean runtime result, and matched file history strongly favor…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Use the executable only if it came from the expected NetEase or MuMu distribution channel and its signature remains valid. Keep antivirus protection enabled and decline any unexpected bundled offers.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
2 of 70 flagged
- Flagged 2
- No detection 68
- No result 5
- Code signing Netease Interactive Entertainment Pte. Ltd.
- Test run Completed
- First seen 2mo ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The executable is verified as signed by Netease Interactive Entertainment Pte. Ltd., and all three matching historical samples received benign assessments. Only 2 of the 70 antivirus engines that checked it raised adware or riskware labels, while major antivirus engines found nothing and the completed sandbox showed no offensive behavior.
Two of the 70 antivirus engines that checked it flagged the executable, using differing adware or riskware labels, while none of the major antivirus engines did so. Ltd. is verified, and the publisher's three recorded historical samples all received benign assessments. Three closely matched files sharing both the import-table fingerprint and signer were also previously assessed as benign. One completed sandbox recorded no offensive techniques, no injected processes, and no malicious runtime verdict. The observed non-background hosts were fully covered by the available reputation check and had no malicious or suspicious entries, although ten dropped components still lack individual saved verdicts.
What We Detected
Only 2 of the 70 antivirus engines that checked it flagged this executable. NANO-Antivirus called it Riskware.Win32.Fragtor.ljrxgl, while VBA32 used the Adware.Packunwan label; these are PUA-style findings and do not form a consistent malware-family consensus. None of the major antivirus engines flagged the sample.
Identity and History
The executable carries a verified signature from Netease Interactive Entertainment Pte. Ltd. All three historical samples recorded for this signer received benign assessments. Three closely matched executables with the same import-table fingerprint and signer were also previously assessed as benign, which strongly supports a recurring legitimate downloader build rather than an isolated impersonation.
Threat Behavior
One completed sandbox run produced no malicious verdict and recorded no high-risk techniques, process injection, or persistence indicators. The sample contacted NetEase-associated service domains and one additional public IP; all three distinct non-background hosts were covered by the available reputation check, with no malicious or suspicious cache entries. Ten dropped components have no saved individual verdict, so their reputations remain unresolved rather than confirmed clean.
What To Do Now
Obtain the file through the publisher's official distribution channel and verify that Windows still reports the NetEase signature as valid before running it. Keep security software enabled; users who do not expect NetEase or MuMu software should remove the installer instead of executing it.
Where this verdict could be wrong3 caveats
- NANO-Antivirus and VBA32 apply riskware or adware labels, so unwanted bundling cannot be ruled out solely from the signature.
- The publisher history contains only three earlier samples and does not yet meet the automatic-trust threshold.
- Ten dropped files lack saved verdicts, leaving their individual reputations unresolved even though none is currently known to be malicious.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- The executable has a verified signature from Netease Interactive Entertainment Pte. Ltd.
- None of the major antivirus engines flagged the file.
- Three closely matched, same-signer files previously received benign assessments.
- The completed sandbox found no offensive behavior, injection, persistence, or malicious runtime verdict.
- The full observed host set was checked against the available reputation cache without malicious or suspicious matches.
- Two antivirus engines apply adware or riskware labels.
- The publisher history is favorable but limited to three prior samples.
- Ten extracted components do not yet have individual saved assessments.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 11sandbox rule tags
- 5spawned processes
- 3network contacts
- 18filesystem & mutex artifacts
Includes the sandbox verdicts, 11 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
2 of the 70 antivirus engines that checked it flag it; signed by Netease Interactive Entertainment Pte. Ltd..
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
The Safe verdict weighed these detections and treats them as non-decisive.
- NANO-AntivirusRiskware.Win32.Fragtor.ljrxgl
- VBA32Adware.Packunwan
File fingerprint
- Last analyzed
- Oct 10, 2026, 2:01 AM UTC
- SHA-256
9133f31db3c7de22fe14bfbc93f700a944e4c41847274591fc12023b0a89060a- SHA-1
4b117474d698d8db3901a92e679141ba0f49cade- MD5
69012bcf746ce22f742a5cf845903094
About this file
NemuDownloader.exe is a Win32 EXE file of 6.1 MB.
- Type and size
- Win32 EXE · 6.1 MB
- Signer
- Netease Interactive Entertainment Pte. Ltd.Valid code signature.
- First seen
- Aug 13, 2026On VirusTotal.
- Submitted by
- 40 distinct sources
- Packer
- None detected
- Entropy
- 5.54 of 8
First scanned
Includes every engine result (75), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is NemuDownloader.exe safe?
What is NemuDownloader.exe?
How many antivirus engines detected NemuDownloader.exe?
Is NemuDownloader.exe digitally signed?
What is the SHA-256 hash of NemuDownloader.exe?
Is it safe to run NemuDownloader.exe?
How up to date is this analysis of NemuDownloader.exe?
Community
Member reviews and reports for this exact file hash.