File scan report
Verdict Safe
Is Ryujinx.
Nothing harmful found: none of the 67 antivirus engines that checked it flag it.
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 67 flagged
- Flagged 0
- No detection 67
- No result 8
- Code signing Unsigned
- Test run Completed
- First seen 6mo ago
Chapter 02
Why we think so
2 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This file is the Ryujinx Nintendo Switch emulator, an open-source project with medium prevalence (976 submissions). All 16 major antivirus engines report it clean. The direct-IP a control server behaviour rule matched on contact to Cloudflare infrastructure (162.159.36.2), which is benign for legitimate software. No malicious sandbox verdicts, files it created, or external intelligence corroborate a threat.
Ryujinx is a well-known open-source emulator with legitimate distribution (976 submissions, 831 unique sources over 54 days). Behaviour analysis shows sandbox/debug-environment detection, which is expected for emulators to avoid false positives during testing. No malicious sandbox verdicts, files it created, or external intelligence (CIRCL, YARAify, MalwareBazaar) support a threat classification.
What We Detected
Ryujinx.dll is a 73 MB Windows PE executable submitted 976 times across 831 unique sources over 54 days. The file is unsigned but carries no brand-mismatch indicators.
Threat Behavior
A rule-based rule flagged this as potential a control server evasion, but the contacted IP is a public CDN and DNS resolver commonly used by legitimate software for updates and content delivery. Behaviour shows 7 MITRE techniques: 1 offensive (T1562.001 — Disable or Modify Tools) and 6 routine (obfuscation, protocol use, system discovery, native API calls, virtualization evasion). This pattern is consistent with an emulator detecting sandbox/debug environments to ensure clean execution, not malware anti-analysis.
What To Do Now
No action required. This file is the Ryujinx open-source Nintendo Switch emulator, a legitimate software project. All major antivirus vendors report it clean, and no external intelligence (CIRCL, YARAify, MalwareBazaar) corroborates a threat.
Where this verdict could be wrong3 caveats
- Direct-IP a control server rule is a legitimate malware indicator in many contexts — if this file were truly contacting a malicious control server, the absence of DNS would be suspicious. However, the contacted IP 162.159.36.2 resolves to Cloudflare's public DNS / CDN infrastructure, which is commonly used by legitimate software for updates and content delivery.
- T1562.001 (Disable or Modify Tools) could indicate anti-analysis behaviour typical of malware, but in the context of an emulator, this technique is used to disable host-side debugging and virtualization detection to ensure the emulated environment runs cleanly — a legitimate use case.
- Unsigned status is a minor risk factor, but Ryujinx is an open-source project distributed via GitHub; unsigned binaries are common in open-source communities and do not indicate malice when paired with zero engine detections and medium prevalence.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Medium prevalence (976 submissions, 831 sources) — indicates legitimate commodity software
- Ryujinx is a well-known open-source Nintendo Switch emulator project
- No malicious sandbox verdicts, files it created, or external intelligence hits
- Contacted IP (162.159.36.2) resolves to Cloudflare public CDN/DNS infrastructure
- T1562.001 (Disable or Modify Tools) — consistent with emulator sandbox/debug detection, not malware anti-analysis
- Unsigned binary — common in open-source projects; not indicative of malice when paired with zero detections
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 7sandbox rule tags
- 3spawned processes
- 0network contacts
- 15filesystem & mutex artifacts
Includes 7 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
None of the 67 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Jun 10, 2026, 1:46 PM UTC
- SHA-256
f3b1d45074291625f510f9355051ef231e27d35475b20f0f886085c87ed41c56- SHA-1
e4e701d0f0497734e1a87716b767c64fd580cc96- MD5
5d1d6befc7cde77e7f1af35955c42851
About this file
Ryujinx.dll is a Win32 EXE file of 73.1 MB.
- Type and size
- Win32 EXE · 73.1 MB
- Signer
- UnsignedNo code signature.
- First seen
- Apr 18, 2026On VirusTotal.
- Submitted by
- 831 distinct sources
- Packer
- None detected
- Entropy
- 6.38 of 8
First scanned
Includes every engine result (75), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Ryujinx.dll safe?
What is Ryujinx.dll?
How many antivirus engines detected Ryujinx.dll?
What is the SHA-256 hash of Ryujinx.dll?
Is it safe to run Ryujinx.dll?
How up to date is this analysis of Ryujinx.dll?
Community
Member reviews and reports for this exact file hash.