File name:

MuMuInstaller_3.1.7.0_gw-win-download_all_1746775276.exe

Full analysis: https://app.any.run/tasks/e5c84275-843d-43a5-a25a-c4f68891ff0e
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: July 14, 2025, 19:42:46
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

2B41F760C72634D3A358836691F4C76A

SHA1:

62D09E9FE8F9F90DD18135461BF74A093323AECE

SHA256:

A0F69BB4FA62CB9B5C1A6BC32A94B230B21CED278B1AB67EE9396D152C9FA083

SSDEEP:

98304:tfUDapf95UyB+DqQ5a0Ckwu8qAvx47z9Ta/WaeNOUKQmG0WTvBQ9r6x/PHq79e0i:G43k53PLUFM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe (PID: 3952)

  • SUSPICIOUS

    • The process drops C-runtime libraries

      • MuMuInstaller_3.1.7.0_gw-win-download_all_1746775276.exe (PID: 5712)
      • MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe (PID: 3952)

    • Process drops legitimate windows executable

      • MuMuInstaller_3.1.7.0_gw-win-download_all_1746775276.exe (PID: 5712)
      • MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe (PID: 3952)

    • Drops 7-zip archiver for unpacking

      • MuMuInstaller_3.1.7.0_gw-win-download_all_1746775276.exe (PID: 5712)
      • MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe (PID: 3952)

    • Drops a system driver (possible attempt to evade defenses)

      • MuMuInstaller_3.1.7.0_gw-win-download_all_1746775276.exe (PID: 5712)
      • ColaBoxChecker.exe (PID: 728)
      • MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe (PID: 3952)

    • Executable content was dropped or overwritten

      • MuMuInstaller_3.1.7.0_gw-win-download_all_1746775276.exe (PID: 5712)
      • ColaBoxChecker.exe (PID: 728)
      • MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe (PID: 3952)

    • Reads security settings of Internet Explorer

      • nemu-downloader.exe (PID: 2120)
      • MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe (PID: 3952)

    • There is functionality for taking screenshot (YARA)

      • nemu-downloader.exe (PID: 2120)
      • MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe (PID: 3952)

    • Connects to the server without a host name

      • nemu-downloader.exe (PID: 2120)

    • Process requests binary or script from the Internet

      • MuMuDownloader.exe (PID: 7152)

    • Potential Corporate Privacy Violation

      • MuMuDownloader.exe (PID: 7152)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe (PID: 3952)

    • Windows service management via SC.EXE

      • sc.exe (PID: 1812)
      • sc.exe (PID: 4948)
      • sc.exe (PID: 2512)
      • sc.exe (PID: 5824)
      • sc.exe (PID: 1704)

    • Creates/Modifies COM task schedule object

      • MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe (PID: 3952)
      • regsvr32.exe (PID: 6716)

    • The process creates files with name similar to system file names

      • MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe (PID: 3952)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe (PID: 3952)

  • INFO

    • Checks supported languages

      • MuMuInstaller_3.1.7.0_gw-win-download_all_1746775276.exe (PID: 5712)
      • nemu-downloader.exe (PID: 2120)
      • ColaBoxChecker.exe (PID: 728)
      • HyperVChecker.exe (PID: 3396)
      • MuMuDownloader.exe (PID: 7152)
      • MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe (PID: 3952)
      • HyperVChecker.exe (PID: 6700)
      • HyperVChecker.exe (PID: 4844)
      • MuMuVMMSVC.exe (PID: 4920)
      • MuMuVMMSVC.exe (PID: 304)
      • NetLwfUninstall.exe (PID: 5444)
      • SUPUninstall.exe (PID: 2780)
      • SUPUninstall.exe (PID: 5500)
      • SUPInstall.exe (PID: 4824)

    • The sample compiled with english language support

      • MuMuInstaller_3.1.7.0_gw-win-download_all_1746775276.exe (PID: 5712)
      • MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe (PID: 3952)

    • The sample compiled with chinese language support

      • MuMuInstaller_3.1.7.0_gw-win-download_all_1746775276.exe (PID: 5712)
      • MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe (PID: 3952)

    • Create files in a temporary directory

      • MuMuInstaller_3.1.7.0_gw-win-download_all_1746775276.exe (PID: 5712)
      • nemu-downloader.exe (PID: 2120)
      • ColaBoxChecker.exe (PID: 728)
      • MuMuDownloader.exe (PID: 7152)
      • MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe (PID: 3952)

    • Reads the computer name

      • nemu-downloader.exe (PID: 2120)
      • ColaBoxChecker.exe (PID: 728)
      • MuMuDownloader.exe (PID: 7152)
      • MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe (PID: 3952)
      • MuMuVMMSVC.exe (PID: 4920)
      • SUPInstall.exe (PID: 4824)
      • NetLwfUninstall.exe (PID: 5444)
      • SUPUninstall.exe (PID: 5500)
      • MuMuVMMSVC.exe (PID: 304)
      • SUPUninstall.exe (PID: 2780)

    • Reads the software policy settings

      • nemu-downloader.exe (PID: 2120)
      • slui.exe (PID: 3844)

    • Process checks computer location settings

      • nemu-downloader.exe (PID: 2120)

    • Reads the machine GUID from the registry

      • MuMuDownloader.exe (PID: 7152)

    • Creates files in the program directory

      • nemu-downloader.exe (PID: 2120)
      • MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe (PID: 3952)

    • Checks proxy server information

      • slui.exe (PID: 3844)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:06:15 13:00:00+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 28672
InitializedDataSize: 126464
UninitializedDataSize: -
EntryPoint: 0x7c84
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 22.0.0.0
ProductVersionNumber: 22.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: NetEase, Inc.
FileDescription: MuMu Player 12
FileVersion: 2022
InternalName: 7zS2.sfx
LegalCopyright: Copyright (C) 2022
OriginalFileName: NemuDownloader.exe
ProductName: MuMu Player 12
ProductVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
186
Monitored processes
48
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start mumuinstaller_3.1.7.0_gw-win-download_all_1746775276.exe nemu-downloader.exe colaboxchecker.exe conhost.exe no specs hypervchecker.exe no specs conhost.exe no specs hypervchecker.exe no specs conhost.exe no specs hypervchecker.exe no specs conhost.exe no specs mumudownloader.exe conhost.exe no specs slui.exe mumung-setup-v4.1.32.3729-overseas-0617102718.exe sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs mumuvmmsvc.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs mumuvmmsvc.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs netlwfuninstall.exe no specs conhost.exe no specs supuninstall.exe no specs conhost.exe no specs supuninstall.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs supinstall.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs netsh.exe no specs netsh.exe no specs conhost.exe no specs conhost.exe no specs svchost.exe mumuinstaller_3.1.7.0_gw-win-download_all_1746775276.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
304"C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe" /RegServerC:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe—MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe
User:
admin
Company:
NetEase Corporation
Integrity Level:
HIGH
Description:
MuMuVMM Interface
Exit code:
0
Version:
6.1.36.152435
Modules
Images
c:\program files\mumuvmmvbox\hypervisor\mumuvmmsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
320\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
480\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
728"C:\Users\admin\AppData\Local\Temp\7z77059650\ColaBoxChecker.exe" checker /baseboardC:\Users\admin\AppData\Local\Temp\7z77059650\ColaBoxChecker.exe
nemu-downloader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\7z77059650\colaboxchecker.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
888\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—HyperVChecker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1036"C:\WINDOWS\system32\netsh.exe" advfirewall firewall add rule name="MuMuVMMSVC" dir=in action=allow program="C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe" enable=yesC:\Windows\SysWOW64\netsh.exe—MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1296\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—NetLwfUninstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1704"C:\WINDOWS\system32\sc.exe" query MuMuVMMDrvC:\Windows\SysWOW64\sc.exe—MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1812"C:\WINDOWS\system32\sc.exe" query MuMuVMMNetLwfC:\Windows\SysWOW64\sc.exe—MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2120C:\Users\admin\AppData\Local\Temp\7z77059650\nemu-downloader.exe C:\Users\admin\AppData\Local\Temp\7z77059650\nemu-downloader.exe
MuMuInstaller_3.1.7.0_gw-win-download_all_1746775276.exe
User:
admin
Company:
NetEase, Inc.
Integrity Level:
HIGH
Description:
MuMu Player Installer
Version:
1.3.0.1
Modules
Images
c:\users\admin\appdata\local\temp\7z77059650\nemu-downloader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
Total events
8 658
Read events
8 640
Write events
18
Delete events
0

Modification events

(PID) Process:(2120) nemu-downloader.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\NemuServer
Operation:writeName:uuid
Value:
300854f4-28c4-497d-9035-095020f71943
(PID) Process:(2120) nemu-downloader.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\NemuServer
Operation:writeName:channel
Value:
gw-win-download
(PID) Process:(2120) nemu-downloader.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\NemuServer
Operation:writeName:package
Value:
mumu
(PID) Process:(3952) MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32
Operation:writeName:InprocServer32
Value:
C:\WINDOWS\system32\oleaut32.dll
(PID) Process:(3952) MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exeKey:HKEY_CLASSES_ROOT\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Both
(PID) Process:(3952) MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32
Operation:writeName:InprocServer32
Value:
C:\WINDOWS\system32\oleaut32.dll
(PID) Process:(3952) MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Both
(PID) Process:(3952) MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32
Operation:writeName:InprocServer32
Value:
C:\WINDOWS\system32\oleaut32.dll
(PID) Process:(3952) MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Both
(PID) Process:(3952) MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32
Operation:writeName:InprocServer32
Value:
C:\WINDOWS\system32\oleaut32.dll
Executable files
538
Suspicious files
106
Text files
891
Unknown types
37

Dropped files

PID
Process
Filename
Type
5712MuMuInstaller_3.1.7.0_gw-win-download_all_1746775276.exeC:\Users\admin\AppData\Local\Temp\7z77059650\WinRing0.infbinary
MD5:F069F20871CB316BFB73C276393D1648
SHA256:07942017E8CAAA1065867AECC561577199E53142545CB6FB41239AE4C607D46B
5712MuMuInstaller_3.1.7.0_gw-win-download_all_1746775276.exeC:\Users\admin\AppData\Local\Temp\7z77059650\msvcp_win.dllexecutable
MD5:F9E704B67ECCD77A18965E9CFA128461
SHA256:F7AC4CEB149EAE5184B957D90EBEDD9BC916CD1BA3053548B637B4E32A7F8A07
5712MuMuInstaller_3.1.7.0_gw-win-download_all_1746775276.exeC:\Users\admin\AppData\Local\Temp\7z77059650\nemu-downloader.exeexecutable
MD5:F1C149C43FB294E19F151D66E6F79A89
SHA256:750C159F8496FEF1AC71F2E43E02B9BB4E9A836F200D0DDBB8E42EF429191A65
5712MuMuInstaller_3.1.7.0_gw-win-download_all_1746775276.exeC:\Users\admin\AppData\Local\Temp\7z77059650\msvcp140.dllexecutable
MD5:FF877A5DFFD764197250BD4BA28496B1
SHA256:83F935454AE8E450B6F042509ECF28CCEFF95EDB2495C63A782B9D45C2EAF1C0
5712MuMuInstaller_3.1.7.0_gw-win-download_all_1746775276.exeC:\Users\admin\AppData\Local\Temp\7z77059650\MuMuDownloader.exeexecutable
MD5:2F3D77B4F587F956E9987598B0A218EB
SHA256:2F980C56D81F42BA47DC871A04406976DC490DED522131CE9A2E35C40CA8616E
5712MuMuInstaller_3.1.7.0_gw-win-download_all_1746775276.exeC:\Users\admin\AppData\Local\Temp\7z77059650\WinRing0x64.sysexecutable
MD5:1C57D067B9FC5E9EF9AEB14223481243
SHA256:D5BCA2CA464A6CC91344BD85E812A7BAC6E7C67038C4929A29E0BC60C7EABE4D
5712MuMuInstaller_3.1.7.0_gw-win-download_all_1746775276.exeC:\Users\admin\AppData\Local\Temp\7z77059650\winring0x64.catcat
MD5:E7CEE7F541C057F490D486927D659122
SHA256:317D01D9956F052D929FDBAC258F1A2DC5163D3432FC488023A1F4D332AE3D45
5712MuMuInstaller_3.1.7.0_gw-win-download_all_1746775276.exeC:\Users\admin\AppData\Local\Temp\7z77059650\msvcrt.dllexecutable
MD5:0DAA0D9DC786F95C8DC2CCC0221B2863
SHA256:279A03ACC810C1FE613BE283EB24762F0451DA9A6142ED3DC996A1D10FE2F692
7152MuMuDownloader.exeC:\Users\admin\AppData\Local\Temp\MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe —
MD5:—
SHA256:—
728ColaBoxChecker.exeC:\Users\admin\AppData\Local\Temp\winring0.catcat
MD5:5691A9B76C5B0BD1DD83687F5F0E87A1
SHA256:784E031565C67F1D29640C62F0CC205D5B56C1F78BE894252CCE06474B64A618
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
39
DNS requests
22
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.55.110.193:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7152
MuMuDownloader.exe
GET
—
104.166.182.223:80
http://104.166.182.223:80/MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe
unknown
—
—
unknown
7152
MuMuDownloader.exe
GET
—
104.166.182.223:80
http://104.166.182.223:80/MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe
unknown
—
—
unknown
7152
MuMuDownloader.exe
GET
—
104.166.182.223:80
http://104.166.182.223:80/MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe
unknown
—
—
unknown
1208
SIHClient.exe
GET
200
23.32.97.216:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7152
MuMuDownloader.exe
GET
206
104.166.182.223:80
http://104.166.182.223:80/MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe
unknown
—
—
unknown
7152
MuMuDownloader.exe
GET
206
104.166.182.223:80
http://104.166.182.223:80/MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe
unknown
—
—
unknown
7152
MuMuDownloader.exe
GET
206
104.166.182.223:80
http://104.166.182.223:80/MuMuNG-setup-V4.1.32.3729-overseas-0617102718.exe
unknown
—
—
unknown
2120
nemu-downloader.exe
GET
200
76.223.88.1:80
http://76.223.88.1/v2/?domain=a11.gdl.netease.com
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
592
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
nemu-downloader.exe
34.36.47.246:443
api.mumuglobal.com
GOOGLE-CLOUD-PLATFORM
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2120
nemu-downloader.exe
23.215.21.22:443
dns.update.easebar.com
Akamai International B.V.
US
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
23.55.110.193:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 216.58.206.78
whitelisted
api.mumuglobal.com
  • 34.36.47.246
unknown
dns.update.easebar.com
  • 23.215.21.22
whitelisted
crl.microsoft.com
  • 23.55.110.193
  • 23.55.110.211
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.32.97.216
whitelisted
a11.gdl.netease.com
  • 184.86.251.199
  • 184.86.251.197
whitelisted
login.live.com
  • 20.190.160.4
  • 20.190.160.3
  • 20.190.160.66
  • 20.190.160.20
  • 20.190.160.2
  • 20.190.160.64
  • 20.190.160.14
  • 20.190.160.131
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted

Threats

PID
Process
Class
Message
7152
MuMuDownloader.exe
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
7152
MuMuDownloader.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7152
MuMuDownloader.exe
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
7152
MuMuDownloader.exe
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
7152
MuMuDownloader.exe
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
7152
MuMuDownloader.exe
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
7152
MuMuDownloader.exe
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
7152
MuMuDownloader.exe
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
7152
MuMuDownloader.exe
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
7152
MuMuDownloader.exe
A Network Trojan was detected
ET USER_AGENTS Aria2 User-Agent
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MuMuInstaller_3.1.7.0_gw-win-download_all_1746775276.exe