Tools: Mumu Player (netease) Silently Runs 17 Reconnaissance Commands...

MuMu Player Pro for macOS (by NetEase) executes a comprehensive system data collection routine every 30 minutes while the emulator is running. This includes enumerating all devices on your local network, capturing every running process with full command-line arguments, inventorying all installed applications, reading your hosts file, and dumping kernel parameters -- all tied to your Mac's serial number via SensorsData analytics.

Every 30 minutes, MuMu creates a timestamped directory under:

Each directory (e.g. 20260220-071645) contains the output of the following commands, all executed automatically in the background:

A collect-finished manifest file logs the success/failure of each collection.

The process list captures full command-line arguments for every process on the system. In practice this exposes:

This is captured every 30 minutes, creating a detailed behavioral timeline of your computer usage.

MuMu uses SensorsData (a Chinese analytics platform) for tracking. Files in the report/ directory include:

Identity tracking (sensorsanalytics-com.sensorsdata.identities.plist):

Your Mac's hardware serial number is collected and used as a persistent identifier.

Campaign tracking (sensorsanalytics-super_properties.plist):

Source: HackerNews