File name:

MuMu-Player-12-Windows-3-8-3-2696-en.exe

Full analysis: https://app.any.run/tasks/0fb4d546-8d74-4872-ace9-bf709b14dd66
Verdict: Malicious activity
Analysis date: September 05, 2025, 22:12:07
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

0032DB0E51AA3EB59524C60CCE8EC586

SHA1:

0986ACB5F3120CBC8191D8507B4C34C5FBB49861

SHA256:

8DE592EFEB1B2BCAB19077F08766308D049E62F7A4E467DC7204F7710320624B

SSDEEP:

98304:sVUDapf95UxB+DqQ52nippI8EtGYXqy2cdBw8qO7YyjC6lHq79e0Sfe2ceem0XTK:DRGa53PLUFU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • The process drops C-runtime libraries

      • MuMu-Player-12-Windows-3-8-3-2696-en.exe (PID: 3944)

    • Drops a system driver (possible attempt to evade defenses)

      • MuMu-Player-12-Windows-3-8-3-2696-en.exe (PID: 3944)
      • ColaBoxChecker.exe (PID: 3976)

    • Drops 7-zip archiver for unpacking

      • MuMu-Player-12-Windows-3-8-3-2696-en.exe (PID: 3944)

    • Process drops legitimate windows executable

      • MuMu-Player-12-Windows-3-8-3-2696-en.exe (PID: 3944)

    • Executable content was dropped or overwritten

      • MuMu-Player-12-Windows-3-8-3-2696-en.exe (PID: 3944)
      • ColaBoxChecker.exe (PID: 3976)

    • Reads security settings of Internet Explorer

      • nemu-downloader.exe (PID: 4688)

    • There is functionality for taking screenshot (YARA)

      • nemu-downloader.exe (PID: 4688)

    • Potential Corporate Privacy Violation

      • MuMuDownloader.exe (PID: 6812)

  • INFO

    • The sample compiled with chinese language support

      • MuMu-Player-12-Windows-3-8-3-2696-en.exe (PID: 3944)

    • Checks supported languages

      • MuMu-Player-12-Windows-3-8-3-2696-en.exe (PID: 3944)
      • nemu-downloader.exe (PID: 4688)
      • ColaBoxChecker.exe (PID: 3976)
      • HyperVChecker.exe (PID: 3844)
      • HyperVChecker.exe (PID: 6956)
      • HyperVChecker.exe (PID: 4412)
      • MuMuDownloader.exe (PID: 6812)

    • The sample compiled with english language support

      • MuMu-Player-12-Windows-3-8-3-2696-en.exe (PID: 3944)

    • Reads the computer name

      • nemu-downloader.exe (PID: 4688)
      • ColaBoxChecker.exe (PID: 3976)
      • MuMuDownloader.exe (PID: 6812)

    • Create files in a temporary directory

      • MuMu-Player-12-Windows-3-8-3-2696-en.exe (PID: 3944)
      • ColaBoxChecker.exe (PID: 3976)
      • nemu-downloader.exe (PID: 4688)
      • MuMuDownloader.exe (PID: 6812)

    • Process checks computer location settings

      • nemu-downloader.exe (PID: 4688)

    • Reads the software policy settings

      • nemu-downloader.exe (PID: 4688)

    • Creates files in the program directory

      • nemu-downloader.exe (PID: 4688)

    • Reads the machine GUID from the registry

      • MuMuDownloader.exe (PID: 6812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:06:15 13:00:00+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 28672
InitializedDataSize: 126464
UninitializedDataSize: -
EntryPoint: 0x7c84
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 22.0.0.0
ProductVersionNumber: 22.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: NetEase, Inc.
FileDescription: MuMu Player 12
FileVersion: 2022
InternalName: 7zS2.sfx
LegalCopyright: Copyright (C) 2022
OriginalFileName: NemuDownloader.exe
ProductName: MuMu Player 12
ProductVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
15
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start mumu-player-12-windows-3-8-3-2696-en.exe nemu-downloader.exe colaboxchecker.exe conhost.exe no specs hypervchecker.exe no specs conhost.exe no specs hypervchecker.exe no specs conhost.exe no specs hypervchecker.exe no specs conhost.exe no specs mumudownloader.exe conhost.exe no specs slui.exe no specs mumu-player-12-windows-3-8-3-2696-en.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
888"C:\Users\admin\AppData\Local\Temp\MuMu-Player-12-Windows-3-8-3-2696-en.exe" C:\Users\admin\AppData\Local\Temp\MuMu-Player-12-Windows-3-8-3-2696-en.exe—explorer.exe
User:
admin
Company:
NetEase, Inc.
Integrity Level:
MEDIUM
Description:
MuMu Player 12
Exit code:
3221226540
Version:
2022
Modules
Images
c:\users\admin\appdata\local\temp\mumu-player-12-windows-3-8-3-2696-en.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1300C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1828\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—HyperVChecker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2728\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—ColaBoxChecker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3844"C:\Users\admin\AppData\Local\Temp\7z8DAD5F68\HyperVChecker.exe" C:\Users\admin\AppData\Local\Temp\7z8DAD5F68\HyperVChecker.exe—nemu-downloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\7z8dad5f68\hypervchecker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\winhvplatform.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\vid.dll
c:\windows\system32\kernel.appcore.dll
3944"C:\Users\admin\AppData\Local\Temp\MuMu-Player-12-Windows-3-8-3-2696-en.exe" C:\Users\admin\AppData\Local\Temp\MuMu-Player-12-Windows-3-8-3-2696-en.exe
explorer.exe
User:
admin
Company:
NetEase, Inc.
Integrity Level:
HIGH
Description:
MuMu Player 12
Version:
2022
Modules
Images
c:\users\admin\appdata\local\temp\mumu-player-12-windows-3-8-3-2696-en.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
3976"C:\Users\admin\AppData\Local\Temp\7z8DAD5F68\ColaBoxChecker.exe" checker /baseboardC:\Users\admin\AppData\Local\Temp\7z8DAD5F68\ColaBoxChecker.exe
nemu-downloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\7z8dad5f68\colaboxchecker.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
4412"C:\Users\admin\AppData\Local\Temp\7z8DAD5F68\HyperVChecker.exe" C:\Users\admin\AppData\Local\Temp\7z8DAD5F68\HyperVChecker.exe—nemu-downloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\7z8dad5f68\hypervchecker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\winhvplatform.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\vid.dll
c:\windows\system32\kernel.appcore.dll
4652\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—HyperVChecker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
3 154
Read events
3 151
Write events
3
Delete events
0

Modification events

(PID) Process:(4688) nemu-downloader.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\NemuServer
Operation:writeName:uuid
Value:
0dc6e12e-75c7-4d9e-8bc5-598f469a744b
(PID) Process:(4688) nemu-downloader.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\NemuServer
Operation:writeName:channel
Value:
gw-overseas12
(PID) Process:(4688) nemu-downloader.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\NemuServer
Operation:writeName:package
Value:
mumu
Executable files
14
Suspicious files
12
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
3944MuMu-Player-12-Windows-3-8-3-2696-en.exeC:\Users\admin\AppData\Local\Temp\7z8DAD5F68\winring0x64.catbinary
MD5:E7CEE7F541C057F490D486927D659122
SHA256:317D01D9956F052D929FDBAC258F1A2DC5163D3432FC488023A1F4D332AE3D45
3944MuMu-Player-12-Windows-3-8-3-2696-en.exeC:\Users\admin\AppData\Local\Temp\7z8DAD5F68\WinRing0.infbinary
MD5:F069F20871CB316BFB73C276393D1648
SHA256:07942017E8CAAA1065867AECC561577199E53142545CB6FB41239AE4C607D46B
3944MuMu-Player-12-Windows-3-8-3-2696-en.exeC:\Users\admin\AppData\Local\Temp\7z8DAD5F68\WinRing0x64.infbinary
MD5:0F6D3047D1B670058D71C411707EF16E
SHA256:3FDED2F4457B0BEB415B841B40F6EDE5ED527DD537E53E2F70F2FB4A6E24EBFD
3944MuMu-Player-12-Windows-3-8-3-2696-en.exeC:\Users\admin\AppData\Local\Temp\7z8DAD5F68\msvcrt.dllexecutable
MD5:0DAA0D9DC786F95C8DC2CCC0221B2863
SHA256:279A03ACC810C1FE613BE283EB24762F0451DA9A6142ED3DC996A1D10FE2F692
3944MuMu-Player-12-Windows-3-8-3-2696-en.exeC:\Users\admin\AppData\Local\Temp\7z8DAD5F68\WinRing0.sysexecutable
MD5:A73EE34A7A50BE60E77CC277A96D7BA8
SHA256:4448BEFF8366E42E3393E8C7F8261AEE0B0340356C31AA3B97DE07452AE01888
3944MuMu-Player-12-Windows-3-8-3-2696-en.exeC:\Users\admin\AppData\Local\Temp\7z8DAD5F68\skin.zipcompressed
MD5:463F8C3E2CFFD812ED7474233FEDB777
SHA256:A057B7298DAB7EAC58371937FA28C418D24D254C71E9914A78F0A46F2EAD5AD3
3944MuMu-Player-12-Windows-3-8-3-2696-en.exeC:\Users\admin\AppData\Local\Temp\7z8DAD5F68\config.initext
MD5:07904DB88D48F3325B042C45E80445C9
SHA256:7C70D75AF6E4D6C82238F1CB5A1BA82C72E13CB59D1A992154E4DF1919A64299
3944MuMu-Player-12-Windows-3-8-3-2696-en.exeC:\Users\admin\AppData\Local\Temp\7z8DAD5F68\winring0.catbinary
MD5:5691A9B76C5B0BD1DD83687F5F0E87A1
SHA256:784E031565C67F1D29640C62F0CC205D5B56C1F78BE894252CCE06474B64A618
6812MuMuDownloader.exeC:\Users\admin\AppData\Local\Temp\MuMuNG-setup-V4.1.34.3742-overseas-0718171742.exe —
MD5:—
SHA256:—
3944MuMu-Player-12-Windows-3-8-3-2696-en.exeC:\Users\admin\AppData\Local\Temp\7z8DAD5F68\nemu-downloader.exeexecutable
MD5:61CE1418B06DDB339C582F81AF039E45
SHA256:55A72B89FB48775739E4D4EFB1756FACEB3AEDC33C37FC2A5E332B9DC250A482
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
32
DNS requests
16
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3092
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
1268
svchost.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
4688
nemu-downloader.exe
GET
200
76.223.88.1:80
http://76.223.88.1/v2/?domain=a11.gdl.netease.com
US
binary
82 b
unknown
6812
MuMuDownloader.exe
GET
—
2.18.190.166:80
http://2.18.190.166:80/MuMuNG-setup-V4.1.34.3742-overseas-0718171742.exe
NL
—
—
unknown
6812
MuMuDownloader.exe
GET
—
2.18.190.166:80
http://2.18.190.166:80/MuMuNG-setup-V4.1.34.3742-overseas-0718171742.exe
NL
—
—
unknown
6812
MuMuDownloader.exe
GET
—
2.18.190.166:80
http://2.18.190.166:80/MuMuNG-setup-V4.1.34.3742-overseas-0718171742.exe
NL
—
—
unknown
6812
MuMuDownloader.exe
GET
—
2.18.190.166:80
http://2.18.190.166:80/MuMuNG-setup-V4.1.34.3742-overseas-0718171742.exe
NL
—
—
unknown
1268
svchost.exe
GET
200
104.79.89.142:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
814 b
whitelisted
6812
MuMuDownloader.exe
GET
—
2.18.190.166:80
http://2.18.190.166:80/MuMuNG-setup-V4.1.34.3742-overseas-0718171742.exe
NL
—
—
unknown
5468
SIHClient.exe
GET
200
104.79.89.142:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
DE
binary
407 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1636
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4688
nemu-downloader.exe
34.36.47.246:443
api.mumuglobal.com
GOOGLE-CLOUD-PLATFORM
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4688
nemu-downloader.exe
184.30.208.222:443
dns.update.easebar.com
AKAMAI-AS
DE
unknown
3092
svchost.exe
40.126.31.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3092
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
google.com
  • 216.58.206.46
whitelisted
api.mumuglobal.com
  • 34.36.47.246
unknown
dns.update.easebar.com
  • 184.30.208.222
unknown
login.live.com
  • 40.126.31.2
  • 20.190.159.4
  • 20.190.159.68
  • 40.126.31.131
  • 20.190.159.128
  • 20.190.159.23
  • 40.126.31.1
  • 40.126.31.130
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
www.microsoft.com
  • 104.79.89.142
whitelisted
a11.gdl.netease.com
  • 23.32.239.11
  • 23.32.239.82
whitelisted
slscr.update.microsoft.com
  • 135.232.92.137
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
6812
MuMuDownloader.exe
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
6812
MuMuDownloader.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
6812
MuMuDownloader.exe
Misc activity
ET INFO EXE - Served Attached HTTP
6812
MuMuDownloader.exe
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
6812
MuMuDownloader.exe
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
6812
MuMuDownloader.exe
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
6812
MuMuDownloader.exe
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
6812
MuMuDownloader.exe
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
6812
MuMuDownloader.exe
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MuMu-Player-12-Windows-3-8-3-2696-en.exe