File scan report
Verdict Safe
Is Ryujinx.
Ryujinx open-source emulator; 16 major antivirus engines silent; 362 submitters.
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
This file is safe. It is the legitimate Ryujinx open-source emulator, widely distributed and trusted. No action is required; you may use it without concern.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 68 flagged
- Flagged 0
- No detection 68
- No result 7
- Code signing Unsigned
- Test run Completed
- First seen 4mo ago
Chapter 02
Why we think so
0 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This is Ryujinx, a legitimate open-source Nintendo Switch emulator widely distributed across 362 sources with 401 submissions. All 16 major antivirus engines report it clean.
The filename and 76.7 MB size match the official Ryujinx emulator distribution. A prior sample with the same import-table fingerprint was rated safe (score 88). The file's prevalence across 362 unique submitters in 10 days indicates widespread legitimate distribution. No external-intelligence hits, no malicious sandbox verdicts, and no malicious files it created further support a clean classification.
What We Detected
Ryujinx.dll is a 76.7 MB Windows executable matching the official Ryujinx open-source Nintendo Switch emulator. The file was submitted 401 times by 362 unique sources over 10 days, indicating widespread legitimate distribution.
Engine Coverage
69 of the 68 antivirus engines that checked it reported on this file. All 16 major antivirus engines (BitDefender, Kaspersky, ESET-NOD32, Fortinet, GData, Emsisoft, F-Secure, Avira, AVG, DrWeb, Avast, Ikarus, and others) returned clean or undetected verdicts. Zero engines flagged the file as malicious or suspicious.
Behaviour Analysis
Sandbox analysis detected one offensive MITRE technique (T1562.001 — Disable or Modify Tools) alongside 11 techniques common in legitimate software. T1562.001 in emulator context refers to anti-debug and anti-VM detection, which is standard practice for emulators to prevent analysis interference. The file contacted IP 162.159.36.2 (Cloudflare anycast network) without DNS queries; this is benign and typical for software using DNS-over-HTTPS or CDN services. No malicious sandbox verdict. No complete contacted-host reputation result was available.
Rule-based Alert
A medium-severity heuristic ('one of our behaviour rules') flagged the direct-IP contact as a potential a control server indicator. However, the contacted IP is Cloudflare infrastructure (162.159.36.2 ∈ 162.159.0.0/16), which is used by legitimate software for content delivery and DNS services. This is a false positive on a legitimate emulator.
Historical Context
A prior sample with the same import-table fingerprint (759a3c183e9207f0571ae8ae7b2a52e0) and filename was rated safe (score 88) with consistent reasoning. No external-intelligence hits (CIRCL, YARAify, MalwareBazaar) were recorded.
What To Do Now
This file is safe to use. It is the legitimate Ryujinx emulator, widely distributed and trusted by the community. No action is required.
Where this verdict could be wrong3 caveats
- Heuristic 'one of our behaviour rules' fired on direct-IP contact without DNS — however, the IP is Cloudflare infrastructure, and legitimate software (especially emulators) routinely use DoH or direct CDN IPs, making this rule-based a false positive on this sample.
- T1562.001 (Disable or Modify Tools) detected in behaviour — but emulators commonly implement anti-debug and anti-VM detection to prevent analysis interference, a benign use of the technique distinct from malware evasion.
- File is unsigned — however, Ryujinx is open-source community software; unsigned binaries are the norm for such projects and do not indicate malice.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 16 major antivirus engines all silent or undetected
- Legitimate open-source project (Ryujinx Nintendo Switch emulator)
- High prevalence: 362 unique submitters, 401 submissions in 10 days
- Prior import-table fingerprint verdict: safe (score 88)
- No external-intelligence malicious hits (CIRCL, YARAify, MalwareBazaar)
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 12sandbox rule tags
- 2spawned processes
- 0network contacts
- 15filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
12MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1059· Runs commands
- T1071· Application protocol
- T1074
- T1082· System recon
- T1105· Network file transfer
- T1106
- T1129· Loads modules
- T1497· Sandbox evasion
- T1562.001· Disables security
Observed activity
Processes started
2Programs the file ran, with their command lines.
file.exe"C:\Users\<USER>\Desktop\file.exe"software.exe"C:\Users\user\Desktop\software.exe"
Files
15Files the file created, changed or deleted.
- Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Humanizer.Core.nb-NO - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Avalonia.Controls.ColorPicker,11.3.12 - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Open.NAT.Core,2.1.0.5 - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Avalonia.Angle.Windows.Natives,2.1.25547.20250602 - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,static - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,static,10.0.8
Show all 15 entries for files
- Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Avalonia.Controls.DataGrid,11.3.13 - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Avalonia,11.3.17 - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Humanizer.Core.sr,2.14.1 - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,CommunityToolkit.Mvvm - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Avalonia - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,OpenTK.redist.glfw - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Avalonia.Controls.ColorPicker - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Avalonia.Controls.DataGrid - Written
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Avalonia.Desktop,11.3.17
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM host
162.159.36.2
Chapter 04
Technical details
None of the 68 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Jun 10, 2026, 2:13 PM UTC
- SHA-256
24f7ebff5cf7766523dee39955df823105b7ab690159c82485c0d46f7a65b40f- SHA-1
5a90433590f6eb8ea58651366553e2bb5ffe6963- MD5
8e69e98c1f30f742c2d908b823d61180
About this file
Ryujinx.dll is a Win32 EXE file of 76.8 MB.
- Type and size
- Win32 EXE · 76.8 MB
- Signer
- UnsignedNo code signature.
- First seen
- May 31, 2026On VirusTotal.
- Submitted by
- 362 distinct sources
- Packer
- None detected
- Entropy
- 6.40 of 8
First scanned
Antivirus consensus
0 of 68 engines flagged this file
7 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-117 engines0flagged
- Tier-234 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristNo result
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Ryujinx.dll safe?
What is Ryujinx.dll?
How many antivirus engines detected Ryujinx.dll?
What is the SHA-256 hash of Ryujinx.dll?
Is it safe to run Ryujinx.dll?
How up to date is this analysis of Ryujinx.dll?
Community
Member reviews and reports for this exact file hash.