Safe
Ryujinx emulator shows zero malware detections across 68 engines; direct-IP contact heuristic is consistent with legitimate CDN/update infrastructure.
f3b1d45074291625f5…c87ed41c56The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
The file exhibits a clean engine profile: zero malicious detections across 68 engines, including 16 tier-1 vendors (Avast, BitDefender, Kaspersky, ESET-NOD32, Fortinet, Emsisoft, Ikarus, F-Secure, Avira, AVG, DrWeb, GData). Ryujinx is a well-known open-source emulator with legitimate distribution (976 submissions, 831 unique sources over 54 days). The triggered heuristic (DirectIpC2) flags direct-IP contact without DNS, but the contacted IP belongs to Cloudflare's public infrastructure, commonly used by legitimate software for updates and CDN services. Behaviour analysis shows sandbox/debug-environment detection (T1562.001, T1497), which is expected for emulators to avoid false positives during testing. No malicious sandbox verdicts, dropped children, or external intelligence (CIRCL, YARAify, MalwareBazaar) support a threat classification.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
engines: 0/68 malicious; tier1Malicious=0; tier1ReportedClean=16 (Avast, BitDefender, Kaspersky, ESET-NOD32, Fortinet, Emsisoft, Ikarus, F-Secure, Avira, AVG, DrWeb, GData all undetected)
File identified as Ryujinx (open-source Nintendo Switch emulator); prevalence=medium (976 submissions, 831 sources) over 54 days — consistent with legitimate commodity software
triggeredHeuristics: MalwareTips.Synth.DirectIpC2 fired (medium) on direct-IP contact 162.159.36.2; however, heuristic is evidence not verdict; emulators commonly contact CDNs/update servers via IP
behaviour: 1 offensive MITRE (T1562.001) + 6 ambient (T1027, T1071, T1082, T1106, T1497); pattern consistent with sandbox/debug-environment detection, not malware C2
No malicious sandbox verdicts, no malicious children, no malicious host contacts; external intel (CIRCL, YARAify, MalwareBazaar) all negative
- Zero malicious detections across 68 engines; 16 tier-1 vendors all clean
- Medium prevalence (976 submissions, 831 sources) — indicates legitimate commodity software
- Ryujinx is a well-known open-source Nintendo Switch emulator project
- No malicious sandbox verdicts, dropped children, or external intelligence hits
- Contacted IP (162.159.36.2) resolves to Cloudflare public CDN/DNS infrastructure
- Direct IP contact without DNS (162.159.36.2) — however, IP belongs to Cloudflare public infrastructure
- T1562.001 (Disable or Modify Tools) — consistent with emulator sandbox/debug detection, not malware anti-analysis
- Unsigned binary — common in open-source projects; not indicative of malice when paired with zero detections
This file is safe to use. It is the legitimate Ryujinx emulator, confirmed clean by all major antivirus vendors. The direct-IP contact and environment-detection techniques are normal for emulator operation and do not indicate malware.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 162.159.36.2
- C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Humanizer.Core.nb-NO
- C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Open.NAT.Core,2.1.0.5
- C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Avalonia.Angle.Windows.Natives,2.1.25547.20250602
- C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,static
- C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Avalonia.Controls.DataGrid,11.3.12
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache.
- e3b0c44298fc1c149afb…52b855Never scannednever seen before
YARA + heuristic rules that fired
One or more medium-severity heuristic rules matched. Not definitive, but the patterns match known malware behaviour.
Sample contacted 1 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.
Evidence162.159.36.2
0 detections across 75 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How often this file shows up in the wild
Moderate prevalence — neither rare nor common. No strong prior applies.
Forensic fingerprint
- File name
- Ryujinx.dll
- Size
- 69.75 MB
- MIME type
- (unknown)
- Detected type
- Win32 EXE
- SHA-256
- f3b1d45074291625f510f9355051ef231e27d35475b20f0f886085c87ed41c56
- MD5
- 5d1d6befc7cde77e7f1af35955c42851
- SHA-1
- e4e701d0f0497734e1a87716b767c64fd580cc96
- PE imphash
- 759a3c183e9207f0571ae8ae7b2a52e0
- First seen (VT)
- 4/17/2026, 8:57:57 PM
- Last analysis (VT)
- 5/22/2026, 12:11:51 AM
- First scan (MalwareTips)
- 6/10/2026, 9:46:54 AM
- Last scan (MalwareTips)
- 6/10/2026, 9:46:54 AM
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.