File scan report
Verdict Safe
Is Ryujinx.
Ryujinx open-source emulator; 16 major antivirus engines silent; 362 submitters.
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
This file is safe. It is the legitimate Ryujinx open-source emulator, widely distributed and trusted. No action is required; you may use it without concern.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 68 flagged
- Flagged 0
- No detection 68
- No result 7
- Code signing Unsigned
- Test run Completed
- First seen 4mo ago
Chapter 02
Why we think so
0 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This is Ryujinx, a legitimate open-source Nintendo Switch emulator widely distributed across 362 sources with 401 submissions. All 16 major antivirus engines report it clean.
The filename and 76.7 MB size match the official Ryujinx emulator distribution. A prior sample with the same import-table fingerprint was rated safe (score 88). The file's prevalence across 362 unique submitters in 10 days indicates widespread legitimate distribution. No external-intelligence hits, no malicious sandbox verdicts, and no malicious files it created further support a clean classification.
What We Detected
Ryujinx.dll is a 76.7 MB Windows executable matching the official Ryujinx open-source Nintendo Switch emulator. The file was submitted 401 times by 362 unique sources over 10 days, indicating widespread legitimate distribution.
Engine Coverage
69 of the 68 antivirus engines that checked it reported on this file. All 16 major antivirus engines (BitDefender, Kaspersky, ESET-NOD32, Fortinet, GData, Emsisoft, F-Secure, Avira, AVG, DrWeb, Avast, Ikarus, and others) returned clean or undetected verdicts. Zero engines flagged the file as malicious or suspicious.
Behaviour Analysis
Sandbox analysis detected one offensive MITRE technique (T1562.001 — Disable or Modify Tools) alongside 11 techniques common in legitimate software. T1562.001 in emulator context refers to anti-debug and anti-VM detection, which is standard practice for emulators to prevent analysis interference. The file contacted IP 162.159.36.2 (Cloudflare anycast network) without DNS queries; this is benign and typical for software using DNS-over-HTTPS or CDN services. No malicious sandbox verdict. No complete contacted-host reputation result was available.
Rule-based Alert
A medium-severity heuristic ('one of our behaviour rules') flagged the direct-IP contact as a potential a control server indicator. However, the contacted IP is Cloudflare infrastructure (162.159.36.2 ∈ 162.159.0.0/16), which is used by legitimate software for content delivery and DNS services. This is a false positive on a legitimate emulator.
Historical Context
A prior sample with the same import-table fingerprint (759a3c183e9207f0571ae8ae7b2a52e0) and filename was rated safe (score 88) with consistent reasoning. No external-intelligence hits (CIRCL, YARAify, MalwareBazaar) were recorded.
What To Do Now
This file is safe to use. It is the legitimate Ryujinx emulator, widely distributed and trusted by the community. No action is required.
Where this verdict could be wrong3 caveats
- Heuristic 'one of our behaviour rules' fired on direct-IP contact without DNS — however, the IP is Cloudflare infrastructure, and legitimate software (especially emulators) routinely use DoH or direct CDN IPs, making this rule-based a false positive on this sample.
- T1562.001 (Disable or Modify Tools) detected in behaviour — but emulators commonly implement anti-debug and anti-VM detection to prevent analysis interference, a benign use of the technique distinct from malware evasion.
- File is unsigned — however, Ryujinx is open-source community software; unsigned binaries are the norm for such projects and do not indicate malice.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 16 major antivirus engines all silent or undetected
- Legitimate open-source project (Ryujinx Nintendo Switch emulator)
- High prevalence: 362 unique submitters, 401 submissions in 10 days
- Prior import-table fingerprint verdict: safe (score 88)
- No external-intelligence malicious hits (CIRCL, YARAify, MalwareBazaar)
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 12sandbox rule tags
- 2spawned processes
- 0network contacts
- 15filesystem & mutex artifacts
Includes 12 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
None of the 68 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Jun 10, 2026, 2:13 PM UTC
- SHA-256
24f7ebff5cf7766523dee39955df823105b7ab690159c82485c0d46f7a65b40f- SHA-1
5a90433590f6eb8ea58651366553e2bb5ffe6963- MD5
8e69e98c1f30f742c2d908b823d61180
About this file
Ryujinx.dll is a Win32 EXE file of 76.8 MB.
- Type and size
- Win32 EXE · 76.8 MB
- Signer
- UnsignedNo code signature.
- First seen
- May 31, 2026On VirusTotal.
- Submitted by
- 362 distinct sources
- Packer
- None detected
- Entropy
- 6.40 of 8
First scanned
Includes every engine result (75), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Ryujinx.dll safe?
What is Ryujinx.dll?
How many antivirus engines detected Ryujinx.dll?
What is the SHA-256 hash of Ryujinx.dll?
Is it safe to run Ryujinx.dll?
How up to date is this analysis of Ryujinx.dll?
Community
Member reviews and reports for this exact file hash.