File scan report
Verdict Safe
Is Nemu
Only 2 of the 70 antivirus engines that checked it raised PUA-style labels, while the verified NetEase signature, clean runtime result, and matched file history strongly favor…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Use the executable only if it came from the expected NetEase or MuMu distribution channel and its signature remains valid. Keep antivirus protection enabled and decline any unexpected bundled offers.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
2 of 70 flagged
- Flagged 2
- No detection 68
- No result 5
- Code signing Netease Interactive Entertainment Pte. Ltd.
- Test run Completed
- First seen 2mo ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The executable is verified as signed by Netease Interactive Entertainment Pte. Ltd., and all three matching historical samples received benign assessments. Only 2 of the 70 antivirus engines that checked it raised adware or riskware labels, while major antivirus engines found nothing and the completed sandbox showed no offensive behavior.
Two of the 70 antivirus engines that checked it flagged the executable, using differing adware or riskware labels, while none of the major antivirus engines did so. Ltd. is verified, and the publisher's three recorded historical samples all received benign assessments. Three closely matched files sharing both the import-table fingerprint and signer were also previously assessed as benign. One completed sandbox recorded no offensive techniques, no injected processes, and no malicious runtime verdict. The observed non-background hosts were fully covered by the available reputation check and had no malicious or suspicious entries, although ten dropped components still lack individual saved verdicts.
What We Detected
Only 2 of the 70 antivirus engines that checked it flagged this executable. NANO-Antivirus called it Riskware.Win32.Fragtor.ljrxgl, while VBA32 used the Adware.Packunwan label; these are PUA-style findings and do not form a consistent malware-family consensus. None of the major antivirus engines flagged the sample.
Identity and History
The executable carries a verified signature from Netease Interactive Entertainment Pte. Ltd. All three historical samples recorded for this signer received benign assessments. Three closely matched executables with the same import-table fingerprint and signer were also previously assessed as benign, which strongly supports a recurring legitimate downloader build rather than an isolated impersonation.
Threat Behavior
One completed sandbox run produced no malicious verdict and recorded no high-risk techniques, process injection, or persistence indicators. The sample contacted NetEase-associated service domains and one additional public IP; all three distinct non-background hosts were covered by the available reputation check, with no malicious or suspicious cache entries. Ten dropped components have no saved individual verdict, so their reputations remain unresolved rather than confirmed clean.
What To Do Now
Obtain the file through the publisher's official distribution channel and verify that Windows still reports the NetEase signature as valid before running it. Keep security software enabled; users who do not expect NetEase or MuMu software should remove the installer instead of executing it.
Where this verdict could be wrong3 caveats
- NANO-Antivirus and VBA32 apply riskware or adware labels, so unwanted bundling cannot be ruled out solely from the signature.
- The publisher history contains only three earlier samples and does not yet meet the automatic-trust threshold.
- Ten dropped files lack saved verdicts, leaving their individual reputations unresolved even though none is currently known to be malicious.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- The executable has a verified signature from Netease Interactive Entertainment Pte. Ltd.
- None of the major antivirus engines flagged the file.
- Three closely matched, same-signer files previously received benign assessments.
- The completed sandbox found no offensive behavior, injection, persistence, or malicious runtime verdict.
- The full observed host set was checked against the available reputation cache without malicious or suspicious matches.
- Two antivirus engines apply adware or riskware labels.
- The publisher history is favorable but limited to three prior samples.
- Ten extracted components do not yet have individual saved assessments.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 11sandbox rule tags
- 5spawned processes
- 3network contacts
- 18filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
11MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1036
- T1057· Lists programs
- T1059· Runs commands
- T1070.006· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1129· Loads modules
- T1222
Observed activity
Processes started
5Programs the file ran, with their command lines.
nemu-downloader.exeC:\Users\<USER>\AppData\Local\Temp\7z3E50D92C\nemu-downloader.execrashpad_handler.exeC:\Users\<USER>\AppData\Local\Temp\7z3E50D92C\crashpad_handler.exe --no-rate-limit --database=C:\Users\<USER>\AppData\Local\NemuServer\.sentry-native --metrics-dir=C:\Users\<USER>\AppData\Local\NemuServer\.sentry-native --url=https://sentry.netease.com:443/api/325/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=d7282c50f1b64296835edf7d19667322 --attachment=C:\Users\<USER>\AppData\Local\NemuServer\.sentry-native\376974d9-5ecb-4470-785c-7c8296378c2b.run\__sentry-event --attachment=C:\Users\<USER>\AppData\Local\NemuServer\.sentry-native\376974d9-5ecb-4470-785c-7c8296378c2b.run\__sentry-br…MuMu_6.0.2_TE4VNWC.exe"C:\Users\user\Desktop\MuMu_6.0.2_TE4VNWC.exe"nemu-downloader.exeC:\Users\user\AppData\Local\Temp\7z66F7D8D8\nemu-downloader.execrashpad_handler.exeC:\Users\user\AppData\Local\Temp\7z66F7D8D8\crashpad_handler.exe --no-rate-limit --database=C:\Users\user\AppData\Local\NemuServer\.sentry-native --metrics-dir=C:\Users\user\AppData\Local\NemuServer\.sentry-native --url=https://sentry.netease.com:443/api/325/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=d7282c50f1b64296835edf7d19667322 --attachment=C:\Users\user\AppData\Local\NemuServer\.sentry-native\4a434ed9-9694-4bb5-ccb0-d2e19f278c74.run\__sentry-event --attachment=C:\Users\user\AppData\Local\NemuServer\.sentry-native\4a434ed9-9694-4bb5-ccb0-d2e19f278c74.run\__sentry-breadcrumb1 …
Network contacts
33 hosts, listed as 2 domains, 1 address. Links show the host and path only.
- Domain
api.mumuglobal.com - Domain
zsos-api.ntes53.netease.com - IP address
34.36.47.246
Files
16Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\7z3E50D92C\config.ini - Written
C:\Users\<USER>\AppData\Local\Temp\7z3E50D92C\skin.zip - Written
C:\Users\<USER>\AppData\Local\Temp\7z3E50D92C\nemu-downloader.exe - Written
C:\Users\<USER>\AppData\Local\Temp\7z3E50D92C\MuMuDownloader.exe - Written
C:\Users\<USER>\AppData\Local\Temp\7z3E50D92C\msvcp_win.dll - Written
C:\Users\<USER>\AppData\Local\Temp\7z3E50D92C\msvcrt.dll
Show all 16 entries for files
- Written
C:\Users\<USER>\AppData\Local\Temp\7z3E50D92C\api-ms-win-core-console-l1-1-0.dll - Written
C:\Users\<USER>\AppData\Local\Temp\7z3E50D92C\api-ms-win-core-datetime-l1-1-0.dll - Written
C:\Users\<USER>\AppData\Local\Temp\7z3E50D92C\api-ms-win-core-debug-l1-1-0.dll - Written
C:\Users\<USER>\AppData\Local\Temp\7z3E50D92C\api-ms-win-core-errorhandling-l1-1-0.dll - Written
C:\Users\<USER>\AppData\Local\Temp\7z3E50D92C\api-ms-win-core-file-l1-1-0.dll - Written
C:\Users\<USER>\AppData\Local\Temp\7z3E50D92C\api-ms-win-core-file-l1-2-0.dll - Written
C:\Users\<USER>\AppData\Local\Temp\7z3E50D92C\api-ms-win-core-file-l2-1-0.dll - Written
C:\Users\<USER>\AppData\Local\Temp\7z3E50D92C\api-ms-win-core-handle-l1-1-0.dll - Written
C:\Users\<USER>\AppData\Local\Temp\7z3E50D92C\api-ms-win-core-heap-l1-1-0.dll - Deleted
C:\Users\<USER>\AppData\Local\NemuServer\.sentry-native\376974d9-5ecb-4470-785c-7c8296378c2b.run\session.json
Registry and auto-start
5Settings the file changed, including ways to start again after a restart.
- Set
Software\NemuServer\uuid - Set
Software\NemuServer\channel - Set
HKEY_USERS\S-1-5-21-4270068108-2931534202-3907561125-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids\exefile - Set
HKEY_LOCAL_MACHINE\Software\WOW6432Node\NemuServer - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\NemuServer\uuid
Mutexes
2Named locks a program uses so only one copy runs; malware families often reuse them.
nemu-downloader-run-mutex\Sessions\1\BaseNamedObjects\nemu-downloader-run-mutex
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM host
8.8.8.8
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- d32d9cb75b13b8605f98…0f2a5cNot checkedno saved verdict
- aa40840b724a3c1e1d2d…454c10Not checkedno saved verdict
- fcdc71d87b45e68563c3…3d05faNot checkedno saved verdict
- 7b3463c16416c93d9b8b…658a3cNot checkedno saved verdict
- d56c631b0f4f70bdeebc…d22399Not checkedno saved verdict
- da48178bbdd98fa8906b…09fcdaNot checkedno saved verdict
- 6ee46c6b6727eb77bcbc…58844eNot checkedno saved verdict
- dcb9cf7e31d6772434c6…88294cNot checkedno saved verdict
- b15964d49a2c5219e092…4e401fNot checkedno saved verdict
- 582e87ade6dac2588441…74c74bNot checkedno saved verdict
Chapter 04
Technical details
2 of the 70 antivirus engines that checked it flag it; signed by Netease Interactive Entertainment Pte. Ltd..
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
The Safe verdict weighed these detections and treats them as non-decisive.
- NANO-AntivirusRiskware.Win32.Fragtor.ljrxgl
- VBA32Adware.Packunwan
File fingerprint
- Last analyzed
- Oct 10, 2026, 2:01 AM UTC
- SHA-256
9133f31db3c7de22fe14bfbc93f700a944e4c41847274591fc12023b0a89060a- SHA-1
4b117474d698d8db3901a92e679141ba0f49cade- MD5
69012bcf746ce22f742a5cf845903094
About this file
NemuDownloader.exe is a Win32 EXE file of 6.1 MB.
- Type and size
- Win32 EXE · 6.1 MB
- Signer
- Netease Interactive Entertainment Pte. Ltd.Valid code signature.
- First seen
- Aug 13, 2026On VirusTotal.
- Submitted by
- 40 distinct sources
- Packer
- None detected
- Entropy
- 5.54 of 8
First scanned
Antivirus consensus
2 of 70 engines flagged this file
5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines1flagged
- Low-trust17 engines1flagged
View all 75 engine results
- NANO-AntivirusMalicious: Riskware.Win32.Fragtor.ljrxgl
- VBA32Malicious: Adware.Packunwan
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
These identify the compiler, runtime or installer used to build the file. They are not packing and are not a risk signal on their own.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is NemuDownloader.exe safe?
What is NemuDownloader.exe?
How many antivirus engines detected NemuDownloader.exe?
Is NemuDownloader.exe digitally signed?
What is the SHA-256 hash of NemuDownloader.exe?
Is it safe to run NemuDownloader.exe?
How up to date is this analysis of NemuDownloader.exe?
Community
Member reviews and reports for this exact file hash.